Re: Abuse address attribute in RIPE whois?

[Rodney Tillotson <]

At 16:40 21/08/2001, Amar wrote:

 > Maybe a little OT or wrong WG. But I see that this could maybe
 > be a benefit for all involved.
 > ...
 > And the reason why they instead have choosen to send the abuse 
 > report to the person that have created/updated the object is 
 > this ( taken from their webpage):
 > 
 > "Addresses should usually be chosen starting from the bottom of the 
 >  dialog, since information toward the bottom tends to be more specific 
 >  than at the top. Alternatively, you can attempt to contact a network 
 >  administrator using other WHOIS information, such as their phone 
 >  number or mailing address"
 > ...
 > My question is if there is an interest to create an "draft" for an
 > identifier in the inetnum object that could be used for abuse reports.
 > Like the "X-Complaints-To:" in NNTP. That identifier could the be used
 > by programs like the one mentioned in this mail. And could also be
 > easier to find on each assignment. As most LIRs have only created info
 > about this in the object for the whole block.

This is an interesting idea. It only works if we get the other RIRs and
LIRs to do the same, but a workable proposal from RIPE would be a good
start.

It is exactly the sort of thing Rob wanted us to start thinking about
in Bologna. It isn't specific to spam, although I think the anti-spam
WG probably sees the need most clearly. Other people (perhaps in the
DB WG) have considered whether CSIRTs should be recorded in the
database.

We need a mechanism for answering the question
   'Who is responsible for this IP address?'
(where 'responsible' may have several different meanings each needing
a different answer).

I don't know whether you can do this with a convention about some
fields already in the DB, or whether it would be an extension.

Perhaps some people will think this is an extra application for the
DNS, rather than the RIR whois services?

Rodney Tillotson, JANET-CERT
+44 1235 822 255.