<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style></style></head><body lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>Maybe I’m not using the right wording.<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'>What I’m suggesting is and “intermediation” but automated. NCC staff doesn’t “see” anything, just goes thru a system that logs everything and forwards to each other party.</span><span lang=EN-US style='font-size:12.0pt;color:black;mso-fareast-language:EN-US'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div><p class=MsoNormal style='margin-left:35.4pt'>El 17/1/20 13:04, "Volker Greimann" <<a href="mailto:vgreimann@key-systems.net">vgreimann@key-systems.net</a>> escribió:<o:p></o:p></p></div></div><div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-left:35.4pt'>Hmm, if you include RIPE NCC in all responses, you will greatly increase the overhead and noise to signal ratio it has to deal with. It may be better to maintain the ability to audit the responses. instead of receiving them all.<br clear=all><o:p></o:p></p><div><div><div><div><p class=MsoNormal style='margin-left:35.4pt'><span lang=EN-US>-- <br>Volker A. Greimann<br>General Counsel and Policy Manager<br><b>KEY-SYSTEMS GMBH</b><br><br>T: +49 6894 9396901<br>M: +49 6894 9396851<br>F: +49 6894 9396851<br>W: </span><a href="http://www.key-systems.net/" target="_blank"><span lang=EN-US style='color:#1155CC'>www.key-systems.net</span></a><span lang=EN-US><br><br>Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835<br>CEO: Alexander Siffrin<br><br>Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.</span><o:p></o:p></p></div></div></div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p></div></div><p class=MsoNormal style='margin-left:35.4pt'><o:p> </o:p></p><div><div><p class=MsoNormal style='margin-left:35.4pt'>On Fri, Jan 17, 2020 at 12:00 PM JORDI PALET MARTINEZ via anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;color:black'>I will be fine with this (having RIPE NCC as an intermediator just to send the abuse report), if instead of a web form (or in addition to it), it is possible to automate it, for example RIPE NCC also accepts x-arf via email.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;color:black'>RIPE NCC has the obligation to keep the information without disclosing it, so why we need to have a way to encypt it so RIPE NCC can’t read it? Furthermore, this should be an automated process. The staff is not going to handle every report manually. And moreover, in case of a bigger dispute, even if going to the courts, RIPE NCC can provide in a neutral way all the info of what happened.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;color:black'>However, I’ve the feeling that in order to get this working, the policy must mandate that all the responser from the operator which customer is producing the abuse, also follow the same path, so:</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt;color:black'>Abuse reporter (Victim or its ISP) -> RIPE NCC -> abuser operator -> RIPE NCC -> abuse reporter</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt'>Otherwise, there will not be a way for RIPE to have stats of who is responding to abuse cases and who is not, or even simpler than that, what abuse mailboxes get bounced (which will be a policy violation if happens all the time with the same operator). Never mind we decide or not that not-responding is an abuse-c violation. Stats are good, even if not published with operator names.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:35.4pt'><span lang=EN-US style='font-size:12.0pt'> </span><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'>El 17/1/20 1:12, "anti-abuse-wg en nombre de ripedenis--- via anti-abuse-wg" <<a href="mailto:anti-abuse-wg-bounces@ripe.net" target="_blank">anti-abuse-wg-bounces@ripe.net</a> en nombre de <a href="mailto:anti-abuse-wg@ripe.net" target="_blank">anti-abuse-wg@ripe.net</a>> escribió:<o:p></o:p></p></div></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'> <o:p></o:p></p></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>Hi Sergio</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>As I read through this thread similar ideas came to my mind. The question I would ask is "Is it too late to take a completely different approach to abuse contacts and reporting via the RIPE Database?"</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>Suppose we had a standard form available via the <a href="http://ripe.net" target="_blank">ripe.net</a> website for providing details of abuse. If you are able to find the "abuse-c:" details in the database now then you must know the IP address involved. The RIPE NCC could send the report to the abuse contact taken from the database via the specified IP address. This does not have to be an email interface either. We could look at other options. The RIPE NCC would then at least know if the report was successfully delivered. Using a standard form would make it much easier for the resource holder to interpret the information.</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>Someone said:</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>"Making such a scheme compulsory would be unacceptable to people who wish to interact with network owners without disclosing that in public ..."</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>I have no understanding of the technology involved here, but when I send you a message on WhatsApp it is encrypted end to end. WhatsApp have no idea (they say) of the content of the message. Would it be possible to submit a form on <a href="http://ripe.net" target="_blank">ripe.net</a> in a way that the content of that form is encrypted and sent to the resource holder so the RIPE NCC have no idea of the content of the form? That would satisfy this concern.</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>Regardless of the outcome of the RIPE Database Requirements Task Force, something like this could still be implemented as it is external to the RIPE Database.</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>Food for thought...</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>cheers</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>denis</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'>co-chair DB-WG</span><o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:12.0pt;font-family:"Helvetica Neue"'> </span><o:p></o:p></p></div></div><div id="gmail-m_-718762117679136026ydpeeeadb22yahoo_quoted_9795829140"><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A'>On Wednesday, 15 January 2020, 10:22:28 CET, Sérgio Rocha <<a href="mailto:sergio.rocha@makeitsimple.pt" target="_blank">sergio.rocha@makeitsimple.pt</a>> wrote: </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A'> </span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A'> </span><o:p></o:p></p></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:70.8pt'><span style='font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A'>Hi,<br><br>Maybe we can change the approach.<br>If RIPE website had a platform to post abuse report, that send the email for<br>the abuse contact, it will be possible to evaluate the responsiveness of the<br>abuse contact.<br><br>This way anyone that report an abuse could assess not only the response but<br>also the effectiveness of the actions taken by the network owner. After some<br>time with this evaluations we would easy to realize who manages the reports<br>and even who does not respond at all.<br><br>Sérgio </span><o:p></o:p></p><div id="gmail-m_-718762117679136026ydpeeeadb22yqtfd58523"><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt;margin-left:70.8pt'><span style='font-size:10.0pt;font-family:"Helvetica Neue";color:#26282A'><br>-----Original Message-----<br>From: anti-abuse-wg [mailto:<a href="mailto:anti-abuse-wg-bounces@ripe.net" target="_blank">anti-abuse-wg-bounces@ripe.net</a>] On Behalf Of<br>Gert Doering<br>Sent: 15 de janeiro de 2020 08:06<br>To: Carlos Friaças <<a href="mailto:cfriacas@fccn.pt" target="_blank">cfriacas@fccn.pt</a>><br>Cc: Gert Doering <<a href="mailto:gert@space.net" target="_blank">gert@space.net</a>>; anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net" target="_blank">anti-abuse-wg@ripe.net</a>><br>Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation<br>of "abuse-mailbox")<br><br>Hi,<br><br>On Wed, Jan 15, 2020 at 07:23:38AM +0000, Carlos Friaças via anti-abuse-wg<br>wrote:<br>> I obviously don't speak for the incident handling community, but i <br>> think this (making it optional) would be a serious step back. The <br>> current situation is already very bad when in some cases we know from <br>> the start that we are sending (automated) messages/notices to blackholes.<br><br>So why is it preferrable to send mails which are not acted on, as opposed to<br>"not send mail because you know beforehand that the other network is not<br>interested"?<br><br>I can see that it is frustrating - but I still cannot support a policy<br>change which will not help dealing with irresponsible networks in any way,<br>but at the same time increases costs and workload for those that do the<br>right thing alrady.<br><br><br>> To an extreme, there should always be a known contact responsible for <br>> any network infrastructure. If this is not the case, what's the <br>> purpose of a registry then?<br><br>"a known contact" and "an *abuse-handling* contact" is not the same thing.<br><br>Gert Doering<br> -- NetMaster<br>--<br>have you enabled IPv6 on something today...?<br><br>SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael<br>Emmer<br>Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann<br>D-80807 Muenchen HRB: 136055 (AG Muenchen)<br>Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279</span><o:p></o:p></p></div></div></div></div></div></div><p class=MsoNormal style='mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt'><br>**********************************************<br>IPv4 is over<br>Are you ready for the new Internet ?<br><a href="http://www.theipv6company.com" target="_blank">http://www.theipv6company.com</a><br>The IPv6 Company<br><br>This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<o:p></o:p></p></div></blockquote></div></div><br>**********************************************<br> IPv4 is over<br> Are you ready for the new Internet ?<br> http://www.theipv6company.com<br> The IPv6 Company<br> <br> This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.<br> <br> </body></html>