- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2017-02 Review Phase Reminder
by Name 19 Feb '18

19 Feb '18

2 1

Re: [anti-abuse-wg] 2017-02 Review Phase Reminder
by Name 17 Feb '18

17 Feb '18

3 3

2017-02 Review Phase Reminder
by Brian Nisbet 17 Feb '18

17 Feb '18

Colleagues, I'd like to remind you that the review phase for 2017-02 will end on the 16th of February. If you would like to participate in the discussion, change your point of view (either way of course!), ask any questions etc. then you have a few more days to do so. It would be especially useful if those who's point of view might be ambiguous could clarify their opinions on the policy at this point. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

4 5

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 24 Jan '18

24 Jan '18

1 0

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Wolfgang Tremmel 24 Jan '18

24 Jan '18

Do you want to solve a problem or create one? I can imagine as the "click here and solve captcha" emails will be standardized that a carefully crafted attack might lure fist line helpdesk people onto shady websides and making them click stuff. So if I were a helpdesk manager I would order my team not to click on these.... IMHO the policy should only check if emails to the abuse contact are delivered, which can bei done with some HELO, MAIL FROM and RCPT TO magic on port 25. best regards Wolfgang > On 19. Jan 2018, at 10:58, ox <andre(a)ox.co.za> wrote: > > you mean in practical "real life" work? > > practically, abuse admins and people that actually deal with abuse are > able to solve a capcha and tick a box. -- Wolfgang Tremmel Phone +49 69 1730902 26 | Fax +49 69 4056 2716 | Mobile +49 171 8600 816 | wolfgang.tremmel(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Köln HRB 51135 DE-CIX Management GmbH | Lindleystrasse 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net

11 24

2017-02 Review Phase (Regular abuse-c Validation)
by Marco Schmidt 24 Jan '18

24 Jan '18

Dear colleagues, Policy proposal 2017-02, "Regular abuse-c Validation" is now in the Review Phase. The goal of this proposal is to give the RIPE NCC a mandate to regularly validate "abuse-c:" information and to follow up in cases where the attribute is deemed to be incorrect. This proposal has been updated following the last round of discussion and is now at version v2.0. Some of the differences from version v1.0 include: - A focus on validating the "abuse-mailbox:" attribute and fixing incorrect contact information - Added references to RIPE Policies and RIPE NCC procedures The RIPE NCC has prepared an impact analysis on this latest proposal version to support the community’s discussion. You can find the full proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2017-02 And the draft documents at: https://www.ripe.net/participate/policies/proposals/2017-02/draft As per the RIPE Policy Development Process (PDP), the purpose of this four-week Review Phase is to continue discussing the proposal, taking the impact analysis into consideration, and to review the full draft policy document. At the end of the Review Phase, the WG Chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document, and share your comments on <anti-abuse-wg(a)ripe.net> before 16 February 2018. Kind regards, Marco Schmidt Policy Development Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

7 6

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 24 Jan '18

24 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 23 Jan '18

23 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 23 Jan '18

23 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Sascha Luck [ml] 23 Jan '18

23 Jan '18

On Mon, Jan 22, 2018 at 04:45:43PM +0200, ox wrote: >> Have I made myself sufficiently clear? >> >Not really. Right. I will then re-iterate all of my arguments including the ones against v1. 1) The proposal states: "Improving the trust and safety of the IP address space is a priority for the RIPE community. It has therefore established the Assisted Registry Check (ARC) in order to help its members strengthen registry data by explaining the risks of outdated information and the benefits of ensuring their data is correct. ARC reviews are carried out for approximately 25%-30% of the membership every year and cover four subject areas: registry consistency, resource consistency, route/rDNS consistency and resource certification usage/consistency (RPKI). However, the ARC was not designed for the validation of the “abuse-c:” contact." While the ARC was not specifically designed to validate the correctness of abuse-c, it is *suitable* for the purpose. I disagree with the implication that the ARC can't be used to perform this validation. In my view, nothing makes abuse-c: any more special than admin-c: and tech-c:, so that it needs a separate ARC all of its own 2) The proposal states: "The objective of this proposal is not to devise a detailed validation procedure. The RIPE NCC is best placed to assess the technical challenges and the financial and human resources necessary to conduct validation tests in the most efficient manner." This actually makes the entire discussion around captchas and humans wasting their time with reading abuse-c emails redundant. Nothing of the kind of process you're dreaming about is actually part of the proposal, so I will forgo any further discussion on this unless a new implementation proposal comes along. What you have is a problem with the Impact Assessment and the way the NCC proposes to validate this contact. In fact, on this point alone, *I* should support the proposal and *you* should oppose it. (However, since I'm not sure the implementation process cannot just change without my consent, I still oppose it on this point, too) 3) Not explicitly stated in the proposal. The proposal and the IA assume that the abuse-c: is an email address (and the object, iirc explicitly asks for one). I don't think any new policy should be made that, even implicitly, ties RIPE NCC database information to legacy technologies. rgds, Sascha Luck

3 3