[anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

Hi Alessandro,


El 12/5/20 19:26, "anti-abuse-wg en nombre de Alessandro Vesely" <anti-abuse-wg-bounces at ripe.net en nombre de vesely at tana.it> escribió:

    Hi Jordy,

    On Tue 12/May/2020 11:34:19 +0200 JORDI PALET MARTINEZ via anti-abuse-wg wrote:
    >> El 8/5/20 20:18, "anti-abuse-wg en nombre de Alessandro Vesely" <anti-abuse-wg-bounces at ripe.net en nombre de vesely at tana.it> escribió:
    >>  On Fri 08/May/2020 13:28:10 +0200 JORDI PALET MARTINEZ via anti-abuse-wg wrote:
    >>> 
    >>> As I've indicated already several times (and not just in this discussion), all the RIRs have forms or other methods to escalate any issues.
    >>> 
    >>> The proposal is only changing "let's have stats".
    >> 
    >> 
    >>     I read:
    >> 
    >>         The RIPE NCC will validate the “abuse-mailbox:” attribute at least
    >>         annually. Where the attribute is deemed incorrect, it will follow up in
    >>         compliance with relevant RIPE Policies and RIPE NCC procedures.
    >>                    https://www.ripe.net/participate/policies/proposals/2019-04
    >> 
    >>     The anonymized statistics is mentioned afterward.  It seems to result from
    >>     community escalation and reporting, rather than from the abuse-mailbox
    >>     validation itself.  By my proposal, instead, the output of the validation
    >>     process is borne out when the abuse address is removed from the database —and
    >>     the corresponding IP ranges duly transmitted.
    > 
    > [Jordi] Yes, RIPE provide stats for many things and probably this text is
    > not really needed, but if we want to make sure to have this specific set of
    > stats, *we need the text*. If we try to reach consensus in what I'm
    > interpreting from your last half of the paragraph, it is very difficult to
    > get consensus, and reclaiming resources must be only done in my opinion, in
    > extreme cases. What cases are already described in
    > https://www.ripe.net/publications/docs/ripe-716, not specific to abuse
    > cases.

    You misunderstood me.  I'm not advocating de-registration of IP resources.  I
    meant to remove just the abuse-c email address, since it does not work.  As an
    alternative, as Àngel noted, there could be a tag saying that the email address
    is not valid, without actually removing it.

[Jordi] I got your point now, thanks!

I think it is more useful instead of removing the address, marking the record as invalid, and this is being done if I recall correctly from RIPE NCC presentations. Because it may be a temporary failure of the address, so *not removing it* may bring it back in a subsequent verification.

Of course all this depends on the detailed procedure that RIPE NCC is using,  but I don't think having so many operational details is good in a policy, unless (I'm not saying is the case, just speaking in general, and not about this specific policy) RIPE NCC is doing so badly and ignoring the community inputs, that the community can only enforce a specific procedure via a policy proposal - but still needs to reach consensus. In one of my earlier versions of the proposal, I had a detailed "example procedure, not part of the policy text".

    Knowing if an abuse team is reachable is much more useful than statistics which
    onehas to interpret in order to derive the same information.  Setting that
    information has to be done with care, after making sure that the corresponding
    organization has acknowledged that their abuse-c doesn't work and doesn't seem
    to be after fixing it.

[Jordi] I think both are useful to know. Is the address valid/invalid. If valid, is this LIR processing abuse reports or there is information escalated from the community that is not?

    At that point, actions like transmitting the relevant IP ranges to a DNSBL can
    take place.  Such actions are derived from a public database and don't have to
    be carried out by RIPE NCC.  In particular, they imply no termination.

[Jordi] Totally agree. I still think ideally, we should have X-ARF as the single way to do all the abuse reporting. Not sure if this could be also connected to provide feedback to DNSBL, but I'm not convinced RIPE NCC (or any other RIR) could do that ... very difficult to reach consensus on that at the time being. The stats might prove that on the long term and then we can change our minds.

    Best
    Ale
    -- 































**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.