[db-wg] Suggestions to improve the IRT object

  Dear Philippe,

  thank you very much for these suggestions. At first glance they do make
  a lot of sense!

  I'll also put this topic onto the draft agenda for the next WG Meeting.
  In the meantime discussion on the mailing list is encouraged. Please!

  I took the liberty to forward these suggestions to the list for the
  European security and incident response teams, too, asking for feedback
  on *this* list.

  Wilfried.

Philippe Bourcier wrote:

> 
> Hi,
> 
> The -c flag which is going to be implemented soon for any standard IP
> query to the RIPE whois is a good thing. But since most IRT objects
> returned don't have an abuse-mailbox field, the result is pretty useless
> (no e-mail will be returned). Developers will keep using -B in their
> tools so that they can send their abuse reports somewhere...
> 
> 
> Facts
> =====
> 
> The e-mail field of an IRT object is hidden until you use the -B flag.
> Most IRT objects have been created without an abuse-mailbox field.
> For the IRT object, the e-mail field is mandatory, but the abuse-mailbox
> is optional.
> The e-mail field of an IRT object is by definition an abuse-mailbox.
> 
> 
> Proposal
> ========
> 
> One of the easiest way to make the -c flag really useful without -B is
> to have all IRT objects return an abuse-mailbox.
> Thus, the abuse-mailbox field should be mandatory and for all IRT
> objects which don't have one, the e-mail field should be copied to it.
> (To be logical, the e-mail attribute should be set to optional.)
> 
> 
> More Thoughts
> =============
> Another issue is to deploy the IRT object (or even the abuse-mailbox...)
> on a huge number of inetnum's.
> If we wait for people to modify all their inetnum objects so that they
> have an abuse-mailbox or irt-mnt attribute, it will take ages.
> A standard IP query to the RIPE whois now gives one "origin" attribute
> (or more).
> Maybe the mnt-irt of that aut-num could be displayed in the default
> output...
> A company not owning the AS announcing their prefix, and willing to use
> its own IRT object (or abuse-mailbox) could use the mnt-irt in their
> inetnum('s) to specify a "more specific" one.
> 
> 
> RFD
> ===
> What do people think about these 2 ideas ?
> 
> 
> Sincerely,
> Philippe Bourcier
> 
>