Hi,
Many huge ISPs have a cert and an abuse department, which are sometimes located in different cities and do completely different work. A cert does want to contact the other cert and not the abuse department. A spamrun should be reported to the abuse department.
You have an ideas about the difference in work that certs and abuse departments do, but I'm sure that we all have slightly different definitions. These differences are likely to be extremely subtle to someone outside of the CSIRT and abuse communities.
I'm not convinced that the differences in these roles are is in fact obvious, or that the choice between either or both of these roles is clear to a new member of the RIPE community or someone reporting a network event. I think I understand what you are trying to achieve by having these two options available, but we need to be sure that this choice makes it easier for people involved at all stages to do the right thing.
And that is exactly what we are trying to do. ;-) First of all the abuse-c (Abuse Contact) gives a better idea that it is a Contact about Abuse, than mnt-IRT will ever do. New members or people outside the abuse community should be able to understand it more easily. Creating an abuse-c is much more easy than creating an IRT object. Using the abuse-finder tool giving back the abuse-mailbox attribute of the abuse-c will help RIPE NCC to reduce Queries in the DB and makes things for people much more easy to query for. It makes the hole person, role, organization object mechanism much more easy, than it is at the moment. The whole cleanup will lead to easier understandable information and makes things easier. And at the end, if all the IRT Object holders show up and say we do not need the irt object anymore as soon as we have an abuse-c in place, there would not be a reason to keep the irt any longer. This is not part of this proposal, but the abuse-c will make things more understandable, than the IRT. Don't get me wrong, I do not want to get rid of the IRT, just mentioning the possibilities. Why we are not using the IRT and make it mandatory? There have been several reasons for this. We also discussed about this option for a while. Thanks, Tobias -- abusix