[anti-abuse-wg] New Abuse Regulations

Leo Vegoda wrote:
> Frank Gadegast wrote:
>
> [...]
>
>> For a start I would like to force resource holders to actually
>> read the mail arriving under their abuse address.
>> This will not force anybody to control all the traffic.
>
> Can you describe the incentive that would force this?

Could be a step-by-step educational/regulation process.

First, when NCC gets a complaint about a netblock, they
could check if the abuse address is working at all.
Or they send an email ordering a return receipt (might
indicate something, but is probably no proof).

NCC could also check regulary of they exist.
(I know, it could also be filtered or faked at the
  receivers side)

Or it could be a regulation, that such an
address has to return something (email, ticket).

Or abuse reports should always be sent with a CC
to an ripe address, where the NCC does some counting.
Or the abuse-c has to send a CC to the NCC
when replying ... or both together ...
When an netblock is suspiscous, these "sums" could be looked at
(going up, going down, short outbreak or beeing very
high all the time compared to others with that size
of allocations aso).

Or trusted blacklist could prepare some kind of counting
and forward this to the NCC (we can tell quite a lot
about non-existing, not-working or non-reponsive addresses
and also about spam-per-networksize ratios, just looked
into our database:
some ISPs in Poland, Ukraine and Spain are still
at the top, then a lot of nothing, but Kazachstan is
moving, aehm, forward).

All this is a kind of "indirect force".
When there are audits, no network admin likes to have
a bad reputation, right ?

If I knew how to start an audit process, I would
have a few nice candidates, that did nothing
during the last years to get their complaint ratio down.


Another example:
we also have some netblock from another LIR not belonging
to our AS. Surely this LIR forwards complaints to us
and we are forced to reply, because its his abuse-c
address visible through whois.
The LIR is always pretty happy, when we reply and audits
this again after a while, if the complaints stopped or not.
If not, they will start to look closer at us and
maybe revoke our netblocks ...


NCC could do the same, it only depends on what
kind of regulations we want, what kind of framework,
rules, values, whatever.

I know, that there are lots of holes we could fall into
(like faked reports to kill somebodies reputation,
automatic replies that look, if everything is good
aso), but we cannot get this going, if we do not collect
ideas, how it could work ...

But I guess, it would be pretty easy to find and seperate
the really bad ones from the ones, that only sometimes
have a problem and those, that have never a problem.


Kind regards, Frank

>
> Regards,
>
> Leo Vegoda
>