[anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")

In message <30174D32-225F-467E-937A-5BC42650F955 at consulintel.es>, 
JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg at ripe.net> wrote:

>I think if we try to agree on those ratings, we will never reach consensus

Right, and that was a part of my point about eBay-like feedback ratings
for resource holders, i.e. "Let's not even try."

Instead, let the people decide.  Let anyone register a feedback point,
positive or negative, against any resource holder, with the proviso
that if they are registering a negative feedback point, they should assert
exactly *why* they are unhappy (e.g. "mail to abuse address bounced as
undeliverable", "no response for eight days" etc.) and if possible,
provide some context also, e.g. a copy of the spam, a copy of some
logs showing hack attempts, etc.

>So it is not just easier to ask the abuse-c mailboxes that don't want to
>process to setup an autoresponder with an specific (standard) text about
that, for example:...

In the "eBay feedback" model I am proposing there is no need for *RIPE NCC*
to ask anybody about anything.  People will register negative points
against any resource holder with an undeliverable abuse address.  (I know
I will!)

I'm sorry Jordi, if this idea sounds like it is undermining everything
you have been trying to do, which is all very very admirable.  But I have
only just realized what you said above, i.e. if we really start to try
to design a system where RIPE NCC will do 100% of the work of "reviewing"
all one zillion RIPE resource holders, the size of the task will almost
be the least of the worries.   The first order problem, as you already
know since you have been doing yeoman's work on this for awhile now, is
just getting people in the various RIRs to agree on the numerous fine
details.  (Hell! You can't even get *me* to agree that a 15 day turn-
around is in any sense "reasonable", and apparently I'm not alone in
that regard.)

So, my solution is just don't.  Let the whole planet vote on whether
they think this provider or that provider are ***heads, and let the
chips fall where they may.

I'm not saying that even this idea would neessarily be piece-of-cake easy.
The first problem would be working out a way to prevent the system from
being gamed by bad actors for malicious purposes, or for positive "PR"
purposes.  (Don't get me started about the fake positive review over on
TripAdvisor.)  But I am not persuaded that these are in any sense
insoluable problems.


Regards,
rfg