[anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

JORDI PALET MARTINEZ via anti-abuse-wg wrote on 08/05/2020 12:07:
> [Jordi] The job of the RIPE NCC is to implement the policies agreed
> by the community. Different folks may consider different pieces of
> all of our policies as "inappropriate" or "arbitrary"

which is fine, mostly. Subject to usual discretion of the RIPE NCC to 
ignore policy which is harmful to itself or others.  Various board 
members have confirmed in the past that the RIPE NCC will not buy an 
island if instructed to do so by the RIPE Community.

> and the goal is
> to find a point in the middle, which is what we call consensus.

The goal is to try to find consensus.  There's nothing in the concept of 
consensus about trying to find a point in the middle.

If I make a policy proposal to demand that the RIPE NCC buy an island, 
would it be reasonable to settle on a compromise which involved the RIPE 
NCC buying only half an island?

It's ok for consensus to be that a policy proposal be rejected entirely.

> I believe is perfectly understandable the need to avoid using manual
> forms which don't follow a single standard, which means extra work
> for *everyone*.

Couple of things on this:

- if you want to standardise a mechanism for abuse reporting, then that 
would be useful and by all means, go ahead with that idea first.  There 
are many forums available for doing this.

- your proposal threatens to close down RIPE NCC members if they decline 
to support abuse reports over email.  This is unhinged.

> [Jordi] The actual policy has a bigger level of micro-management, by
> setting one year and not allowing the NCC to change that. I think it
> is much better to explicitly allow it. One alternative, I will be
> fine with that, is not define the time at all, and let the NCC to
> adapt it to the needs. Would you thing this is more appropriate?

The entire policy is poorly thought-through to start with.  You can't 
fix bad policy with minor tweaks around the edges.

> [Jordi] What I'm asking here is to make sure that we have stats. I'm
> not changing what is an actual practice. You can always report to
> *any* RIR, what you think is wrong and if you're a good internet
> citizen, you should do that.

If you're a good internet citizen, you have some moral obligation to 
report abuse to an internet number resources registry?

You're completely putting the cart before the horse here.  The purpose 
of the RIRs is number resource registration.

> I'm happy if you believe that my wording
> is not good, and we agree on that goal, to find an alternative one.
> Any suggestion?

Firstly, if you propose to collect stats about anything, you need to 
think about what sort of stats should be collected.

Secondly, you need to make a credible argument about why the RIPE NCC 
should be obliged to spend membership funds collecting these stats and 
why the RIPE NCC is a more appropriate vehicle for collecting these 
stats than other organisations which specialise in online security and 
abuse issues, particularly those which already collect statistics about 
online abuse.

Nick