[AfriNIC-rpd] abuse contact information in whois database (AFPUB-2010-GEN-002)

[Tobias Knecht]

Hello together,

the AfriNIC meeting is over and the "abuse contact information in whois
database" unfortunately didn't find consensus. Due several technical
problems with internet connection and onsite computers I have not been
able to do my presentation and answer questions in an appropriate way.
Thanks to all that tried to give me a live overview about the discussion
on the jabber channel. Thanks.

But now back to the proposal and the exceptions made.

I think we are all on one page by saying AfriNIC needs a dedicated place
for abuse contact information. Right?

The first questions was, what would be the best way to do so.
Our opinion is that the IRT Object would be the best way for several
reasons:

1.) It is easy to implement for AfriNIC, because it is already there and
just needs to be activated and used. This makes it easy and does not
wastes to much resources.

2.) The IRT Object is already in place at RIPE and will follow for APNIC
end of this year. The point what works for RIPE and APNIC must not work
for AfriNIC is in my opinion no reason. We are all looking for the same
standards while using IPv4/IPv6, routing protocols, whois as a hole and
than we start to differentiate in one of the smallest parts that has
nothing to do with the operating of the network itself and is just used
as an important information field? That sounds a little bit crazy for me.

In addition I heard somebody say that it may be to complicated for some
African Network Owners to introduce the IRT Object. Please tell me that
that is not true. We are talking about creating an Object, not
reinventing BGP or the internet. You are able to organize a so far great
Soccer World Championship and operate your own country domains, operate
your own IP networks. Please do not tell me creating an Object is to
complicated.

And if this is still to complicated I want to destroy some IRT rumors
that have been coming up due a misunderstanding documentation at RIPE.
This http://www.ripe.net/db/support/security/irt/irt-h2.html document is
facing the use of an IRT Object for a CERT purpose and not for the
purpose of an Abuse Department.

* There is no need to have PGP Key for using the IRT Object!
* There is no need for a Trusted Introducer!
* There is an abuse-mailbox attribute optional!

If you wanna have a look at the real documentation
http://www.ripe.net/db/support/update-reference-manual.html#1.2.9 you'll
find out that the IRT Object has nothing magic and is as easy to
introduce as any other Object.

So why don't we use a role or person object and call it abuse-c?

Because a person or role object is a personal object and it underlies
the whois query restrictions. That means a single IP address can only
query 250(?) time per day and that is not enough for reporting abuse
issues.


And why should we make it mandatory?

If it is mandatory everybody has to use it. Most of the members will use
it in a reasonable way and publish it with real and working data.
Parties who offer wrong data will be fined by the community and
everybody knows that this is not a real reliable partner. There will be
lists like rfc-ignorant and other reputation providers will downrate ip
space if the network owner is not reliable. As they already do today.


But how do you want to control if he is processing this reports?

We do not want to. If he is deleting all incoming reports, he will not
change behavior in his network, which will corrupt his network more and
more. So his network is getting worse, while other ISPs doing a good job
in abuse handling will get better.


I do not know, if there were any other exceptions against this proposal,
but if, let me know, so I can explain or think about our view.

Thank you so far an have a nice week.


Tobias Knecht

--
| Tobias Knecht | CEO | abusix UG (haftungsbeschraenkt)
| tk at abusix.com | http://abusix.com
| Postfach 210127 | 76151 Karlsruhe | Germany
| ---
| Register of Companies(Handelsregister): HRB 707959
| District of Court(Amtsgericht) Mannheim/Germany
| Registered Office: Karlsruhe/Germany
| CEO: Tobias Knecht

















-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 262 bytes
Desc: OpenPGP digital signature
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20100614/6ea498ec/attachment.sig>