[anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)

Gilles,

On Thu, Nov 24, 2011 at 09:55:02AM +0100, Gilles Massen wrote:

> This policy proposal seems a bit incomplete to, as it fails to address
> the problem statement from the summary.

thanks for pointing this out.  There is a bit of confusion w.r.t. the
target audience and intended goals.  Let me give you my view. Any
change we make to the DB schema or the Port 43 interface is unlikely
to please the random end user who is looking for a target to report
spam or other issues.  Those are much better served by a service
like the NCC's "abuse contact finder" tool, which in turn may benefit
from a crisper data structure.  But there is also a lot of (semi-)automated
reporting going on between ISPs, CSIRTs and other entities, where
timely detection, reporting and mitigation is crucial. Some of these
use standardized message formats.  Those are not well served by a
web-based service or heuristics that may or may not end up with a "human"
mailbox.  And there's a range of grey between these examples.

> >From the summary: "...it is not clear whether to use the
> "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.".
> What is supposed to happen to IRT objects, or data from them?
> 
> For existing records: at the very least it should be explicit which tags
> should no longer be used or would be deprecated / removed in order to
> give clear guidance.

Both questions would be addressed in a migration plan, but my reading is
that "abuse-mailbox" is going to disappear.
 
> Another point: if the general idea of the policy is acceptable, wouldn't
> it be nice to have 2 abuse mailboxes: one for humans, one for bots?

+1;

-Peter (again, not speaking for the TF)