<html><body><span style="font-family:Verdana; color:#000; font-size:12pt;"><div><i>"In the day of blocklists and large email providers imposing arbitrary restrictions on email <br>senders it is not guaranteed that a verification email reaches the intended address or that a reply reaches the sender."</i></div><div><br></div><div>You have a social responsibility to ensure you can be contacted by people who are suffering the effects of your network's misuse.</div><div><br></div><div><i>"this proposal would impose unneccessary work on LIRs and the NCC, using unsuitable means to rectify a non-existing issue, <br> and I therefore oppose it."</i><br></div><div><br></div><div>So rather than an employee taking 30 seconds every year to confirm an email address is active, hundreds of other people around the world should be subjected to never-ending misuse of network resources?</div><div>Or what about how they have to spend much more than 30 seconds trying to contact the admin by email, faxing the admin, contacting RIPE NCC by submitting a form, by attaching evidence of bouncing emails/faxes, by waiting for RIPE NCC to contact admin. Then waiting for the admin to decide whether they want to update the entry?</div><div><br></div><div><br></div><div><br></div><blockquote id="replyBlockquote" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;" webmail="1"> <div id="wmQuoteWrapper"> -------- Original Message --------<br> Subject: Re: [anti-abuse-wg] [db-wg] RIPE Policy Proposal 2017-02<br> Validates Database Attributes<br> From: "Sascha Luck [ml]" <<a href="mailto:dbwg@c4inet.net">dbwg@c4inet.net</a>><br> Date: Fri, September 08, 2017 2:54 am<br> To: <a href="mailto:db-wg@ripe.net">db-wg@ripe.net</a><br> Cc: <a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a><br> <br> All,<br> <br> I will discuss this here as I do not accept the Anti-Abuse WG as<br> a forum for this proposal. For one thing, this proposal affects<br> every ripedb user - in fact, as this entails changes to how the<br> NCC provides services, the services-wg would be an even better<br> venue. For another, given the "population" and culture of<br> "debate" on the AAWG, any "consensus" reached there would be so<br> worthless as to be farcical. (If anyone wants amplification on<br> this, <a href="https://www.ripe.net/ripe/mail/archives/anti-abuse-wg">https://www.ripe.net/ripe/mail/archives/anti-abuse-wg</a>/<br> provides ample evidence.<br> <br> To the meat of the proposal:<br> <br> Firstly, this proposal conflicts somewhat with NWI-7 in this very<br> WG. (Another reason why it should have gone here in the first<br> place) With the upcoming possibility of delegating abuse-c: to<br> (customers') resource objects, who bears any consequences of<br> these customers not replying to this proposed email? <br> <br> >Rationale<br> >a. Arguments supporting the proposal<br> <br> >Accurate and validated information in the RIPE Database is<br> >essential to establish a trusted and transparent environment in<br> >which all network operators can operate safely.<br> <br> abuse-c: is a contact object, just as admin-c: or tech-c: and<br> (correct me if I'm wrong) audited at the same time as the rest of<br> the contact information. What makes it so unique that this<br> verification is not enough?<br> <br> >Accurate and<br> >validated information helps Internet troubleshooting at all<br> >levels, <br> >but it also helps to attribute malicious online<br> >activities that undermine this trusted environment.<br> <br> See above.<br> <br> >The lack of reliable accurate and validated information in the<br> >database negatively impacts legitimate uses of the RIPE Database,<br> >including:<br> <br> An *email adress* that doesn't reply once a year does NOT equate<br> to a "lack of reliable accurate and validated information". I<br> find this statement somewhat insulting to the NCC team who do<br> make the effort to keep the ripedb data accurate and do audit<br> resource holders.<br> There is an issue with the reliability of out-of-region and<br> legacy resource data but as the NCC has no "enforcement" powers<br> over these resource holders, in these cases this proposal<br> snatches at thin air. <br> <br> >Assuring the security and reliability of the network by<br> >identifying points of contact for IP addresses for network<br> >operators, ISPs, and certified computer incident response teams;<br> <br> "org:", "admin-c:", "tech-c:", "mnt-by:" and, yes, "abuse-c:" exist.<br> <br> >Ensuring that IP address holders are accountable, so individuals,<br> >consumers and the public are empowered to resolve abusive<br> >practices that impact safety and security;<br> >Assisting businesses, consumer groups, healthcare organisations<br> >and other organisations that are combating fraud (some of which<br> >have mandates to electronically save records) to comply with<br> >relevant legal and public safety safeguards;<br> <br> The contact object that does (or *should*) stand for the person(s) who<br> can speak for a LIR, legally, is "admin-c:". "abuse-c:" is some role<br> account in a NOC or even a ticket system unlikely to have any<br> decision-making power. An attempt to make these roles (perhaps<br> even personally) responsible for the behaviour of a LIR and its<br> customers is counter-productive. I for one would flatly refuse to<br> do any abuse report handling under these circumstances.<br> <br> >Complying with national, civil and criminal due process laws in<br> >support of investigations and providing justice for victims.<br> <br> Would the proposers please amplify exactly which law or due<br> process is violated by the NCC not sending an email once a year<br> to an abuse-c:? Myself, and I'm sure the NCC legal team, would be<br> interested to know.<br> <br> On a technical note, email is neither a secure nor a reliable<br> transport for such verification. In the day of blocklists and<br> large email providers imposing arbitrary restrictions on email<br> senders it is not guaranteed that a verification email reaches<br> the intended address or that a reply reaches the sender. The NCC<br> ARC procedure, however employs both email and personal contact<br> via telephone to verify the accuracy of the ripedb information.<br> <br> In toto, this proposal would impose unneccessary work on LIRs and<br> the NCC, using unsuitable means to rectify a non-existing issue, <br> and I therefore oppose it.<br> <br> </div> </blockquote></span></body></html>