[anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)

Hi,

>> Many huge ISPs have a cert and an abuse department, which are
>> sometimes located in different cities and do completely different
>> work. A cert does want to contact the other cert and not the abuse
>> department. A spamrun should be reported to the abuse department.
> 
> You have an ideas about the difference in work that certs and abuse
> departments do, but I'm sure that we all have slightly different
> definitions. These differences are likely to be extremely subtle to
> someone outside of the CSIRT and abuse communities.
> 
> I'm not convinced that the differences in these roles are is in fact
> obvious, or that the choice between either or both of these roles is
> clear to a new member of the RIPE community or someone reporting a
> network event. I think I understand what you are trying to achieve by
> having these two options available, but we need to be sure that this
> choice makes it easier for people involved at all stages to do the
> right thing.

And that is exactly what we are trying to do. ;-)

First of all the abuse-c (Abuse Contact) gives a better idea that it is
a Contact about Abuse, than mnt-IRT will ever do. New members or people
outside the abuse community should be able to understand it more easily.

Creating an abuse-c is much more easy than creating an IRT object. Using
the abuse-finder tool giving back the abuse-mailbox attribute of the
abuse-c will help RIPE NCC to reduce Queries in the DB and makes things
for people much more easy to query for.

It makes the hole person, role, organization object mechanism much more
easy, than it is at the moment.

The whole cleanup will lead to easier understandable information and
makes things easier.

And at the end, if all the IRT Object holders show up and say we do not
need the irt object anymore as soon as we have an abuse-c in place,
there would not be a reason to keep the irt any longer. This is not part
of this proposal, but the abuse-c will make things more understandable,
than the IRT. Don't get me wrong, I do not want to get rid of the IRT,
just mentioning the possibilities.

Why we are not using the IRT and make it mandatory? There have been
several reasons for this. We also discussed about this option for a while.

Thanks,

Tobias

-- 
abusix

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 307 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20111124/012ea27c/attachment.sig>