[db-wg] abuse-c

MarcoH wrote:

> On Fri, Jan 09, 2004 at 01:32:39PM +0100, Jan Meijer wrote:
> 
> 
>>>It seems there is a pretty clear need for an extra field in inetnum and
>>>inet6num records, specifically something like an abuse-c field
>>>referencing a person record.
>>
>>It's already there :).
>>
>>Please check
>>http://www.ripe.net/ripe/docs/irt-object.html
>>
>>and the TF-CSIRT effort to make it easier to use this:
>>http://www.dfn-cert.de/team/matho/irt-object/
>>
>>It's not perfect but it's there.
> 
> 
> That's exactly the point, IRT is there but far for perfect for the purpose
> the original poster is refering to.
> 
> The problem is that there are a lot of 'tools' out there who have a
> mechansim to query ripe or another db for the inetnum and all person and role
> objects asociated with it to find line which contains an '@' to be a valid
> address to complain to.

Well, except that the word 'abuse' may be a bit easier to understand 
than 'irt' for many non-RIPE-database-gurus, I do not see much 
difference between a reference to an IRT object or a reference to a 
person/role object. The big difference is that an IRT is usually better 
protected (see below) and provides more information.

The protection that the IRT gives over a person/role object includes:
- It MUST be maintained, while a person or role object does not have to 
be; it can be completely unprotected.
- Authorization from the IRT is required, before the IRT can be linked 
to the inet[6]num object. This is important so not all mail for a 
malicious company can go to another (or non-existent) address.

Moreover, if the IRT object is maintained by TRUSTED-INTRODUCER-MNT (or 
possibly other organisations of Incident Response Teams), it means the 
object's information has been verified and is verified on a regular basis.

> Refering to an abuse address in remarks is possible, but then even you
> have to be carefull to not enclose the address in <> as some webbased
> tools strip them out.
> 
> Not to judge on all, but I get the feeling that there are a lot of people
> who don't know what the fields mean, let alone they will know on how to
> use the irt object.

The encryption information in the IRT object is just for communication 
that needs encryption. For normal abuse reports just the 
e-mail/phone/fax/address fields will suffice.

> So we can start advertising the irt mechanism to both the LIR's and the
> people who migth come searching for an address to send a complaint to. I
> don't think it is very likely to hit a large public in a reasonable time.

Neither would another extra attribute, because people will still be 
sending their mail to ALL adresses found...

> Introducing an extra (mandatory) field in inetnum objects to hold the
> abuse address for that specific netblock and nothing more makes it much
> more easier for all those people who write automated process to get the
> information requested and not have to fallback to listing addresses in
> changed: fields as a possible way to complain.

If they can find the information in a person/role object, so can they in 
an IRT object. If the tool finds an mnt-irt attribute, just let it look 
for the contact information (address, phone, fax-no and e-mail) in the 
IRT object and display that to the user.

> Introducing it and making some noise about it on certain mailinglists and
> fora, will probably be picked much faster.

I agree on that point...

> As such can this subject be put an the wg-agenda for ripe-47 ?
> 
> To formalize it a little bit I wan't to put forward the proposal to add an
> 'abuse' field to inetnum and inet6num objects.
> 
> This field will be limited to one line containing a syntactically correct
> email address which can be used to send abuse complaints on ip-addresses
> in that block.
> 
> Reasons to do so are to give people an easy way to automate finding a
> place to complain and giving LIR's an easy and generic way to publish the
> abuse address, without having to resort to the unknown and for the average
> database user complex method of the irt-object.

I agree that making an IRT object is a bit more difficult than making an 
extra attribute, but reading an IRT object is not so difficult and could 
be easily automated.

> As a side effect this might result in more spammers hitting the abuse box
> directly as they harvest the database :)

As if the abuse boxes aren't full enough already... ;-)

Personally, I would suggest promoting the current advanced mechanism 
instead of inventing something new.

Regards,

Menno Pieters

-- 
Menno Pieters - Stelvio
Postbus 215, 3740 AE Baarn
phone: +31-35-5.429.324 / fax: +31-35-5.429.327
XOIP: +31-84-8.720.349 / Web: http://www.stelvio.nl/