[anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")

Hi Ronald,


El 14/1/20 13:10, "anti-abuse-wg en nombre de Ronald F. Guilmette" <anti-abuse-wg-bounces at ripe.net en nombre de rfg at tristatelogic.com> escribió:

    In message <30174D32-225F-467E-937A-5BC42650F955 at consulintel.es>, 
    JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg at ripe.net> wrote:
    
    >I think if we try to agree on those ratings, we will never reach consensus
    
    Right, and that was a part of my point about eBay-like feedback ratings
    for resource holders, i.e. "Let's not even try."
    
    Instead, let the people decide.  Let anyone register a feedback point,
    positive or negative, against any resource holder, with the proviso
    that if they are registering a negative feedback point, they should assert
    exactly *why* they are unhappy (e.g. "mail to abuse address bounced as
    undeliverable", "no response for eight days" etc.) and if possible,
    provide some context also, e.g. a copy of the spam, a copy of some
    logs showing hack attempts, etc.


This may have legal consequences for RIPE NCC, as somebody could use the system to publish untrue information for competitors ... not a good idea.

    
    >So it is not just easier to ask the abuse-c mailboxes that don't want to
    >process to setup an autoresponder with an specific (standard) text about
    that, for example:...
    
    In the "eBay feedback" model I am proposing there is no need for *RIPE NCC*
    to ask anybody about anything.  People will register negative points
    against any resource holder with an undeliverable abuse address.  (I know
    I will!)
    
    I'm sorry Jordi, if this idea sounds like it is undermining everything
    you have been trying to do, which is all very very admirable.  But I have
    only just realized what you said above, i.e. if we really start to try
    to design a system where RIPE NCC will do 100% of the work of "reviewing"

No ... this is an automated process. It is working already in ARIN, in APNIC and now will be also implemented in LACNIC.

It is just an email sent to each abuse-c twice a year, and they have 15 days to click in the link to verify that this mailbox is working.

RIPE NCC will only take care of the failed emails. It may mean some extra work at the beginning, but after a pass will be less and less work. Some of those emails that fail, have already been escalated by RIPE NCC with the existing policy, so it means even less work.

    all one zillion RIPE resource holders, the size of the task will almost
    be the least of the worries.   The first order problem, as you already
    know since you have been doing yeoman's work on this for awhile now, is
    just getting people in the various RIRs to agree on the numerous fine
    details.  (Hell! You can't even get *me* to agree that a 15 day turn-
    around is in any sense "reasonable", and apparently I'm not alone in
    that regard.)
    
    So, my solution is just don't.  Let the whole planet vote on whether
    they think this provider or that provider are ***heads, and let the
    chips fall where they may.
    
    I'm not saying that even this idea would neessarily be piece-of-cake easy.
    The first problem would be working out a way to prevent the system from
    being gamed by bad actors for malicious purposes, or for positive "PR"
    purposes.  (Don't get me started about the fake positive review over on
    TripAdvisor.)  But I am not persuaded that these are in any sense
    insoluable problems.
    
    
    Regards,
    rfg
    
    



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.