<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div dir="ltr">This is correct but additionally, I don’t see how adding a separate security contact resolves the problem of outdated or misdirected (as in, not from your network) compromise incident reports.</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
<div dir="ltr">You don’t have to break into your customers offices to patch their machines. You can just as well acl those IPs off till your customer has patched the vuln. Might even deploy a walled garden like Comcast implemented over a decade back, if you’re
a large SP.</div>
<div dir="ltr"><br>
</div>
<div style="direction:ltr">--srs</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Steve Atkins <steve@blighty.com><br>
<b>Sent:</b> Tuesday, June 7, 2022 4:50:58 PM<br>
<b>To:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> Re: [anti-abuse-wg] Adding a "Security Information" contact?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText"><br>
<br>
> On 7 Jun 2022, at 12:14, Gert Doering <gert@space.net> wrote:<br>
> <br>
> Hi,<br>
> <br>
> On Tue, Jun 07, 2022 at 11:02:19AM +0000, Ángel González Berdasco via anti-abuse-wg wrote:<br>
>> I don't think the problem would be to add a new attribute if needed.<br>
>> The problem would be to *define* what should go there (and then get<br>
>> everyone downstream to use that new attribute)<br>
> <br>
> This... so, what would you suggest?<br>
<br>
It would be nice, both for abuse contacts, and the potential security contact, to be able to advertise that you<br>
accept machine readable reports, what formats and how to accept them. There’s an obvious advantage<br>
for the abuse/security desk consuming reports for that, but it would also be an improvement in many ways<br>
for generators of reports over the current system where abuse-c contains an email address, and that email<br>
address is just an autoresponder saying that mail sent there isn’t read (but there’s this other channel over<br>
here you can use).<br>
<br>
I’ve a nasty feeling that any email address added as a security contact will be used as an additional<br>
place to report spam coming from the network, which might not be what the people on the end of that<br>
alias really need more of.<br>
<br>
Cheers,<br>
Steve<br>
-- <br>
<br>
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
</div>
</span></font></div>
</body>
</html>