[db-wg] abuse-c

On Tue, Jan 13, 2004 at 01:47:32PM +0100, Christian Rasmussen wrote:
> I would very much like a solution to this problem so if more LIRs would be
> willing to accept modifying the current irt object I could support some kind
> of compromise. The current irt object template:

> The name: abuse is a much more common word, I don't really see the point in
> using a word that most normal user doesn't understand and maybe even some
> LIRs.

See my earlier messages on seperation of tasks and responsibilities in
larger companies and the fact that the irt object carries a lot of
information where the user is only looking for 1 single email address.

Renaming it to abuse might help, but you still need to get people aware of
the existence of the irt object (or whatever we decide to rename it to)
and get the pulbic, both LIRs and complainers, to start using it.

Part of this also needs to be done when we decide on adding an attribute
to an existing object, but my point on seperation stays.

Who forms our 'incident resposne team' depends on the type of incident.

Large scale hacking/cracking and collecting evidence is handled by other
people and with higher priority (24x7) as a normal "I got this unwanted
email and I can't read headers so it's all your fault" type of complained
which get handled by another department and only during office hours.

So either we have to create multiple irt objects and use remarks to point
people which one to use or we have to join the departments.

For the last one, we can also decide to join abuse, security, network
engineering, hostmasters and the people operating the LIR in one
department and replace each and every ip-address in the ripe database to
only contain abuse at isp.

I think it's clear that is not very likely to happen and the database is
not meant for this. Hence the seperation between admin-c, tech-c, mntner
and irt. And in my opnion in this seperation we missed out on the part
which handles the average abuse complaints coming from not very cluefull
users. If they had any clue they would have found the correct address and
not mailed the address in the changed: attribute.

Being techies we designed a beautifull thing called the irt object, but we
missed out on 90% of the users not even speak english and understand all
the remarks and database documentation. The simple term 'abuse' is widely
accepted and understood.

I want something similar to the usenet X-Complaints-To: header. We might
for simplicity even call it complaints-to: instead of abuse:

MarcoH