January 2018 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 24 Jan '18

24 Jan '18

1 0

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Wolfgang Tremmel 24 Jan '18

24 Jan '18

Do you want to solve a problem or create one? I can imagine as the "click here and solve captcha" emails will be standardized that a carefully crafted attack might lure fist line helpdesk people onto shady websides and making them click stuff. So if I were a helpdesk manager I would order my team not to click on these.... IMHO the policy should only check if emails to the abuse contact are delivered, which can bei done with some HELO, MAIL FROM and RCPT TO magic on port 25. best regards Wolfgang > On 19. Jan 2018, at 10:58, ox <andre(a)ox.co.za> wrote: > > you mean in practical "real life" work? > > practically, abuse admins and people that actually deal with abuse are > able to solve a capcha and tick a box. -- Wolfgang Tremmel Phone +49 69 1730902 26 | Fax +49 69 4056 2716 | Mobile +49 171 8600 816 | wolfgang.tremmel(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Köln HRB 51135 DE-CIX Management GmbH | Lindleystrasse 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net

11 24

2017-02 Review Phase (Regular abuse-c Validation)
by Marco Schmidt 24 Jan '18

24 Jan '18

Dear colleagues, Policy proposal 2017-02, "Regular abuse-c Validation" is now in the Review Phase. The goal of this proposal is to give the RIPE NCC a mandate to regularly validate "abuse-c:" information and to follow up in cases where the attribute is deemed to be incorrect. This proposal has been updated following the last round of discussion and is now at version v2.0. Some of the differences from version v1.0 include: - A focus on validating the "abuse-mailbox:" attribute and fixing incorrect contact information - Added references to RIPE Policies and RIPE NCC procedures The RIPE NCC has prepared an impact analysis on this latest proposal version to support the community’s discussion. You can find the full proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2017-02 And the draft documents at: https://www.ripe.net/participate/policies/proposals/2017-02/draft As per the RIPE Policy Development Process (PDP), the purpose of this four-week Review Phase is to continue discussing the proposal, taking the impact analysis into consideration, and to review the full draft policy document. At the end of the Review Phase, the WG Chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document, and share your comments on <anti-abuse-wg(a)ripe.net> before 16 February 2018. Kind regards, Marco Schmidt Policy Development Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

7 6

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 24 Jan '18

24 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 23 Jan '18

23 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 23 Jan '18

23 Jan '18

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Sascha Luck [ml] 23 Jan '18

23 Jan '18

On Mon, Jan 22, 2018 at 04:45:43PM +0200, ox wrote: >> Have I made myself sufficiently clear? >> >Not really. Right. I will then re-iterate all of my arguments including the ones against v1. 1) The proposal states: "Improving the trust and safety of the IP address space is a priority for the RIPE community. It has therefore established the Assisted Registry Check (ARC) in order to help its members strengthen registry data by explaining the risks of outdated information and the benefits of ensuring their data is correct. ARC reviews are carried out for approximately 25%-30% of the membership every year and cover four subject areas: registry consistency, resource consistency, route/rDNS consistency and resource certification usage/consistency (RPKI). However, the ARC was not designed for the validation of the “abuse-c:” contact." While the ARC was not specifically designed to validate the correctness of abuse-c, it is *suitable* for the purpose. I disagree with the implication that the ARC can't be used to perform this validation. In my view, nothing makes abuse-c: any more special than admin-c: and tech-c:, so that it needs a separate ARC all of its own 2) The proposal states: "The objective of this proposal is not to devise a detailed validation procedure. The RIPE NCC is best placed to assess the technical challenges and the financial and human resources necessary to conduct validation tests in the most efficient manner." This actually makes the entire discussion around captchas and humans wasting their time with reading abuse-c emails redundant. Nothing of the kind of process you're dreaming about is actually part of the proposal, so I will forgo any further discussion on this unless a new implementation proposal comes along. What you have is a problem with the Impact Assessment and the way the NCC proposes to validate this contact. In fact, on this point alone, *I* should support the proposal and *you* should oppose it. (However, since I'm not sure the implementation process cannot just change without my consent, I still oppose it on this point, too) 3) Not explicitly stated in the proposal. The proposal and the IA assume that the abuse-c: is an email address (and the object, iirc explicitly asks for one). I don't think any new policy should be made that, even implicitly, ties RIPE NCC database information to legacy technologies. rgds, Sascha Luck

3 3

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Sascha Luck [ml] 22 Jan '18

22 Jan '18

On Mon, Jan 22, 2018 at 03:56:05PM +0200, ox wrote: >so, still, there has been no objections to the verification process - >if you have an objection to the process or would like to contribute an >improvement, please do so Sascha? OK, so for the avoidance of doubt among the trolls and the rules lawyers: 1) I object to the verification process proposals as floated on this list and i 2) I stand by my interpretation of the IA as stating that the NCC has no mandate to impose arbitrary hoops on members to jump through. Have I made myself sufficiently clear? On a further note, there is a discussion in the DB-WG with the goal of enabling delegation of more specific abuse-c for assigned or sub-allocated resources. The verification process, if implemented, should take care not to conflict with this. rgds, Sascha Luck

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Sascha Luck [ml] 22 Jan '18

22 Jan '18

On Mon, Jan 22, 2018 at 03:42:09PM +0200, ox wrote: >I have not seen any objections to the process of emailing a alpha >numeric number to abuse-c and then having that number entered into a >website (after solving a capcha) >This would solve many problems as it would mean that the abuse-c exists >and is functional and not an auto-responder or other bot Did my email somehow not make it to the list? I believe I clearly objected to anything of this sort. And, moreover, the IA clearly states that the NCC has *no* mandate to prescribe to operators how they handle abuse email. Additionally, the "community" has no mandate to prescribe to the NCC exactly how to implement a policy - this is a contractual matter. rgds, Sascha Luck

2 1

Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase (Regular abuse-c Validation)
by Name 20 Jan '18

20 Jan '18

2 2