[anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)

Peter Koch wrote:
> Gilles,
>
> On Thu, Nov 24, 2011 at 09:55:02AM +0100, Gilles Massen wrote:
>
>> This policy proposal seems a bit incomplete to, as it fails to address
>> the problem statement from the summary.
>
> thanks for pointing this out.  There is a bit of confusion w.r.t. the
> target audience and intended goals.  Let me give you my view. Any
> change we make to the DB schema or the Port 43 interface is unlikely
> to please the random end user who is looking for a target to report
> spam or other issues.  Those are much better served by a service
> like the NCC's "abuse contact finder" tool, which in turn may benefit
> from a crisper data structure.  But there is also a lot of (semi-)automated
> reporting going on between ISPs, CSIRTs and other entities, where

The proposal helps these kinds of automatic reporting a lot, simply
because the field will not be mandatory anymore and there will be
only one place to look.

Furthermore: the amount of whois queries to the abuse-c cannot
be restricted anymore.

So: a bit +1 here from us.

> timely detection, reporting and mitigation is crucial. Some of these
> use standardized message formats.  Those are not well served by a
> web-based service or heuristics that may or may not end up with a "human"
> mailbox.  And there's a range of grey between these examples.
>
>> > From the summary: "...it is not clear whether to use the
>> "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.".
>> What is supposed to happen to IRT objects, or data from them?
>>
>> For existing records: at the very least it should be explicit which tags
>> should no longer be used or would be deprecated / removed in order to
>> give clear guidance.
>
> Both questions would be addressed in a migration plan, but my reading is
> that "abuse-mailbox" is going to disappear.

A "migration plan" cannot be located in a proposal, because it heavily
depends on the work of the RIPE NCC and a plan include dates (to my
understanding) wich shouldnt end up in a proposal.

But a "migration outlook/idea" would be a really good idea to have
in the proposal.

>> Another point: if the general idea of the policy is acceptable, wouldn't
>> it be nice to have 2 abuse mailboxes: one for humans, one for bots?
>
> +1;

Having two contacts might complicates things, it might be complicated
for the end user to decide wich one to contact.

Maybe it would be easier to make one contact wich has to be marked
as "person", "role" or "robot".
Both, end user or automatic reporting tools, could then decide themself,
if the type of the contact fits their intention.
It might also be nice to have a "preferred reporting method" field
included, what could be "email, phone, url, ARF, X-ARF" or similar.


Kind regards, Frank

>
> -Peter (again, not speaking for the TF)
>
>
>


-- 

Mit freundlichen Gruessen,
--
PHADE Software - PowerWeb                       http://www.powerweb.de
Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
Schinkelstrasse 17                                fon: +49 33200 52920
14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
======================================================================
Public PGP Key available for frank at powerweb.de