<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style></style></head><body lang=PT link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><a name="_MailEndCompose"><span lang=EN>Hello everyone,<br><br>Someone said: You must be new here, yes it's true, I'm on the list for a few months. Maybe that's why you're still optimistic.<br><br>Someone said that the shower of comments against any proposed amendment was Democracy. Maybe that is what we really need.<br><br>Many complain that this working group never produces anything, some agree that either the community does something for itself, or sooner or later we will have politicians imposing laws and following goals that may not be beneficial.<br><br>I have been on the list for a very short time but today I have learned one thing: Those who want to do something are more than I imagined, probably a silent majority and a noisy blocking group (maybe small). Respect divergence of opinion and respect freedom of expression a lot, we debate a lot and do little, maybe because we don't put democracy into practice.<br><br>Perhaps what we need is for the RIPE NCC to allow us to create polls within the site (to have votes with registered accounts) and instead of arguing backwards and forwards, we submit ideas to votes, if the proposals have the majority then RIPE NCC should take into account the proposals. What I have seen is that all attempts to change something die in the debate and we never count votes.<o:p></o:p></span></a></p><p class=MsoNormal><span lang=EN><o:p> </o:p></span></p><p class=MsoNormal><span class=tlid-translation><span lang=EN>let's keep arguing but let’s vote at the end</span></span><span lang=EN-US><br><br>Sergio<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>De:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] <b>Em nome de </b>Liam Glover via anti-abuse-wg<br><b>Enviada:</b> 17 de janeiro de 2020 00:14<br><b>Para:</b> ripedenis@yahoo.co.uk<br><b>Cc:</b> anti-abuse-wg@ripe.net<br><b>Assunto:</b> Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:2.25pt;margin-left:0cm'><span style='color:black'>I’ve been following this mailing list for the last couple of years having read far too many arguments resulting in next to no progress. <o:p></o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal;min-height: 18.4px'><span style='color:black'><o:p> </o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal'><span style='color:black'>This post from Denis was a refreshing read and one that many should read more than once!<o:p></o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal;min-height: 18.4px'><span style='color:black'><o:p> </o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal'><span style='color:black'>Thank you Denis for a reasoned, adult (accepting the UK jab) and constructive message. <o:p></o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal;min-height: 18.4px'><span style='color:black'><o:p> </o:p></span></p><p style='margin:0cm;margin-bottom:.0001pt;font-stretch: normal'><span style='color:black'>Liam<o:p></o:p></span></p><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='margin-bottom:12.0pt'>On 16 Jan 2020, at 23:30, ripedenis--- via anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a>> wrote:<o:p></o:p></p></blockquote></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='font-family:"Tahoma",sans-serif'></span><o:p></o:p></p><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>Colleagues</span><span style='font-family:"Helvetica",sans-serif'><o:p></o:p></span></p></div></div><div id="ydp222ed11eyahoo_quoted_9552941811"><div><div><div id=ydp222ed11eyiv0011432852><div><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>I have just read this whole thread, it took a while (I should get sick more often and spend a day in bed reading emails). I have a few points to make. Some are similar to points already raised but I will reinforce them. I cut out the bits I want to respond to, but sorry I have not included the authors (you will know if it's you).<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"If I need to use a web form, which is not standard, for every abuse report that I need to submit, there is no sufficient time in the world to fill all them."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>So instead each resource holder must interpret randomly written emails and find any relevant information from within lots of junk.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"ever since the day that RIPE NCC first<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>published an abuse reporting address in the data base, it has, in<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>effect, injected itself, even if only to a minimal degree, into<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>the relationship between a network abuse victim and the relevant<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>resource holders that have clear connections to the abuse source"<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>To be clear, the RIPE NCC is the data controller, not the data content provider. The RIPE NCC does not publish the abuse contacts, they facilitate resource holders to publish them.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"make abuse-c: an optional attribute<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>(basically, unrolling the "mandatory" part of the policy proposal that<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>introduced it in the first place)"<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>As co-author/designer of "abuse-c:" one of the original aims of the "abuse-c:" attribute was to provide one single point of contact for a resource holder's abuse reports. If it is made optional, abuse reports would simply be sent to the "admin-c:", "tech-c:", "notify:", etc email addresses, as they were before. People will simply search the database for any email address associated with the resource holder and spam them all. It won't stop abuse reports being sent 'somewhere'. And once someone has had to go to the trouble of finding a list of email addresses to use for the resource holder who has no "abuse-c:", then they will probably do the same for all reports they send. So those of you who do respond to abuse complaints will find complaints being sent to a whole host of your email addresses from the RIPE Database. We lose the 'keep it in one well defined location' benefit.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"at the very least, RIPE NCC could set<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>up and maintain just a basic review "platform" where the public at large<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>can at least make it known to all observers which networks are the assholes<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>and which ones aren't."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>This would be an excellent way for a network operator to 'take out' their competitors.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"While I would accept Gert's proposal for making abuse-c an optional<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>attribute, the reason I offered a counter proposal for publishing "a<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>statement to the effect that the network operator does not act on<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>abuse reports" is to add clarity at a high level."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>How many operators are going to make such a statement? It would become an invitation to block their traffic. If that was the alternative to any verification then they know if they don't make such a statement there will be no penalty. So just don't make a statement and still ignore the reports.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"i'm more worried about someone using real e-mail<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>addresses of real unrelated people than the /dev/null or unattended<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>mailboxes."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>Separately to this discussion we need to have a mechanism to say "Remove my email address from this resource", as Google has when someone uses your gmail address as a recovery address. (A service I use on a weekly basis)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>"Nice analogy, but when you add the eCommerce Directive into the mix, where a network provider (or hosting provider) is not liable for what their users do, the outcome changes. Only if you have knowledge there might be a possibility for liability, but if you do not accept abuse notices, and therefore do not have knowledge you are not liable. Also note there is no monitoring obligation, but if you do monitor you can gain knowledge and become liable for -everything-."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>If you hide behind this type of logic, the EU in particular could easily change the law so that refusal to accept notifications renders you liable as if you had received it. 'Ignorance of the law is no excuse' comes to mind.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>">It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>It's called 'democracy'."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>Many of the countries in the RIPE region are not democracies (including the UK now).<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>Having been on this mailing list for many years, as others have said, this discussion has gone round in circles so many times. It really makes it hard to follow what the general view is. To me there seems to be 2 camps. One camp wants to 'do something' to try to improve the situation. The other camp wants to do nothing for a variety of reasons (not the RIPE NCC's job, gets tangled up with other policies, too much work/time, a burden on those who do the right thing, won't help with those who avoid it, we are engineers not social workers or police). These are the same reasons used against almost every policy proposal on this list. We are in a new decade now. We have to take a more holistic view of the RIPE Database and services around it. I started at the RIPE NCC as a software engineer working on the database. But over time I became involved in almost every aspect of it, including legal, policy, feature design, contracts, etc. I thought the days of demarcation lines went out in the 70s when an engineer thought only about engineering issues. Abuse (in all its forms) is a problem on the internet. Some organisations work hard to tackle it, others ignore it. As a community (of holistic engineers) we need to try things out to reduce abuse. There have been so many negative comments in this thread and so few positive ones. It isn't just LEAs that watch what we do, it's governments as well. If we don't 'try' to reduce abuse, we may find a form of GDPR coming down the line for abuse on the internet. Then every organisation, large and small, will be rushing to their lawyers to ensure they are GDPR(abuse) compliant. Avoiding a little effort now may involve a huge effort later. We are no longer a little group of chatty engineers. We are prominent figures in a global, life critical service. Lets try to be a little more positive and constructive....<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>cheers<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>denis<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'>co-chair DB-WG<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div></div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#26282A'><o:p> </o:p></span></p></div></div></div></div></div></div></blockquote></div></body></html>