Re: [anti-spam-wg] Fwd: IRT abuse-mailbox things...

[Markus Stumpf maex-lists-ripe-antispam-wg@localhost]

On Thu, Feb 08, 2007 at 02:11:44PM +0100, Jørgen Hovland wrote:
> And you don't think popularity has anything to do with usability?

Definitely no.
Popularity is about marketing.

> Just because I have a NS pointer for my reverse ip-address directed to
> me doesn't mean I am the responsible person.

NS RRs point to NameServers. Delegating a (reverse) zone to one or more
nameservers makes them authoritative for information within the limits
of this zone. This is not about reponsible persons.
However there are persons who are responsible for the information
within this delegated zone. The SOA record has a field RNAME that
should carry an email-address in a well defined form which allows to
contact those persons responsible for the information within the
zone.

A RP RR can be used with any name within a zone to list an email
contact for that particular (name or) host. The person responsible for
the information within in RP RR and whether there is one or not can be
contacted via the RNAME field of the SOA record.
Clearly the contact in the RNAME field of the SOA record is not
responsible for any services running on any hosts within that zone
(besides of course DNS servers within that zone listed in the NS
section of the zone).

> DNS has in fact nothing to
> do with the responsibility of a service or machine behind an ip-address. 

DNS has in fact nothing to do with mail delivery, also. DNS has in
fact nothing to do with anything.
DNS is a hierarchical, distributed database that can be queried to
retrieve information.
It provides mechanisms to delegate queries to different incarnations
of this database.
Some information stored in the database is about names, some is about mail
delivery, some is about finding services, some is about fingerprints and
authentication and some is about responsible persons. There is a lot
more information in this database, like location of hosts, information
about hosts ... and also free text.

> > And define the difference to "responsible person".
> If I understood your question; RP records can ergo be manipulated by third parties.

Third party of what? Who is the first party and who is the second party?
And if they can also be manipulated by a third party depends on whether
this "third party" can manipulate the contents of a zone. But this is
probably up to the first party and/or the second party allowing it.

> My statement is still valid.

Sure, even wrong statements are statements.

> You are arguing that you can do X because Y is doing the same thing
> without taking X into consideration.

This is wrong.
I am arguing that I can use X as X, because Y defined X to be X.
You are arguing I cannot use X as X, because X is not X,
which is contrary to the definition of X by Y.

> That basically means you would
> jump out of a cliff if all others did the same thing.

No it basically means that I don't see a problem to use a slide as a
slide if it was designed to be a slide.

> Responsibility depends on many factors.

Yes. I agree.
And what exactly is your point? A RP RR lists an email address that
should be contacted if there are problems with e.g. the host the RR is
associated with. The person(s) behind the address are taking responsibility
for being a contact that can either fix the problem or pass the problem
on to other people that can fix the problem. This is a standard setup
for responsibilities.

> Exaggerating, are we?

No. This happend more then once (accompanied by being kicked out off the
line by users not being able to handle switching and parking of calls
and starting over again at the switchboard) in the about ten years I
handled abuse and security incidents for an ISP. The larger the
company and the less (Internet) tech related the business the more
intermediate people you usually have before getting through to the
right people ... if at all. And it gets even worse if IT things are
handled by external consultants.

	\Maex