2017-02: what does it achieve?
I would like to clarify the effect of this proposal. The proposal states: "The RIPE NCC will validate the “abuse-mailbox:” attribute at least annually. If no valid reply is received by RIPE NCC within two weeks (including if the email bounces back), the “abuse-mailbox:” contact attribute will be marked as invalid." Scenario 1: An LIR directs e-mail sent to their abuse-cc: address to an auto-responder that says "This mailbox is not monitored by a human being", and advises on alternate "support services" (e.g. a FAQ, a webform that feeds a ticketing system etc). Is RIPE NCC intended to mark the attribute as invalid in this scenario? Scenario 2: An LIR filters incoming e-mail sent to their abuse-cc: address. Email from RIPE NCC gets "priority treatment", i.e. is directed to someone who passes a Turing test administered by the NCC. E-mail from anyone else gets the same treatment as in scenario 1. Is Scenario 2 compliant with the policy? If not, how is RIPE NCC supposed to know to mark the attribute as invalid? What tests are the NCC supposed to administer? And what must an LIR do to pass them? Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA
On Mon, 25 Sep 2017 10:55:09 +0100 Malcolm Hutty <malcolm@linx.net> wrote:
Scenario 1: An LIR directs e-mail sent to their abuse-cc: address to an auto-responder that says "This mailbox is not monitored by a human being", and advises on alternate "support services" (e.g. a FAQ, a webform that feeds a ticketing system etc). Is RIPE NCC intended to mark the attribute as invalid in this scenario?
there is no point to have an email address that does not exist or is not monitored. if or when email ever stops working and is replaced by alternate "support services" this will be a good timeTM to accept non monitored email addresses but to granularly define generally accepted forms of communications, is pointless as there will always be a good reason for whatever form of communication, to not be suitable or acceptable to someone. take mobile, or phone numbers, it can easily be argued "but i am not available to take calls" or whatever... - everything always has exceptions, it is whether those exceptions are generally reasonable or not and/or generally acceptable.
Scenario 2: An LIR filters incoming e-mail sent to their abuse-cc: address. Email from RIPE NCC gets "priority treatment", i.e. is directed to someone who passes a Turing test administered by the NCC. E-mail from anyone else gets the same treatment as in scenario 1.
Is Scenario 2 compliant with the policy? If not, how is RIPE NCC supposed to know to mark the attribute as invalid? What tests are the NCC supposed to administer? And what must an LIR do to pass them?
probably, yes. if ai is advanced enough to deal with incoming communications in an acceptable fashion, this will be just fine. ianal but, there are legal implications, if your ai receives x notice, replies, etc. - your trust in your ai would be most commendable and as imho, ai will be running everything in a few years anyway, this is perfectly acceptable :) Andre
Hello Malcom, Thank you for your clarification. The complete answer will be part of the RIPE NCC impact analysis and will refer to this Registry's understanding. Before that, we can give some preliminary remarks, in phase with RIPE NCC discussions. As we stated in your last answer with Grégory, a gradual approach will be implemented, in a flexible manner with dialogue as a priority. The validation or invalidation of the "abuse-mailbox" will be studied carefully. With regard to your first scenario, the auto-answer you mention can be considered as a valid reply, and the "support service" would help to proceed with the abuse report. Your scenario 2 is a little more questionable. A first question would be: which provider would do the effort to treat RIPE NCC emails different than normal abuse reports ? Besides that, this fact would show that the abuse contact is technically reachable. And furthermore, if other abuse reports are bounced by the provider, RIPE NCC report can be used for investigation. Regards Hervé and Greg -----Message d'origine----- De : anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] De la part de Malcolm Hutty Envoyé : lundi 25 septembre 2017 11:55 À : anti-abuse-wg@ripe.net Objet : [anti-abuse-wg] 2017-02: what does it achieve? I would like to clarify the effect of this proposal. The proposal states: "The RIPE NCC will validate the “abuse-mailbox:” attribute at least annually. If no valid reply is received by RIPE NCC within two weeks (including if the email bounces back), the “abuse-mailbox:” contact attribute will be marked as invalid." Scenario 1: An LIR directs e-mail sent to their abuse-cc: address to an auto-responder that says "This mailbox is not monitored by a human being", and advises on alternate "support services" (e.g. a FAQ, a webform that feeds a ticketing system etc). Is RIPE NCC intended to mark the attribute as invalid in this scenario? Scenario 2: An LIR filters incoming e-mail sent to their abuse-cc: address. Email from RIPE NCC gets "priority treatment", i.e. is directed to someone who passes a Turing test administered by the NCC. E-mail from anyone else gets the same treatment as in scenario 1. Is Scenario 2 compliant with the policy? If not, how is RIPE NCC supposed to know to mark the attribute as invalid? What tests are the NCC supposed to administer? And what must an LIR do to pass them? Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.
On 25/09/2017 14:26, herve.clement@orange.com wrote:
With regard to your first scenario, the auto-answer you mention can be considered as a valid reply, and the "support service" would help to proceed with the abuse report.
Hervé, Thank you for your reply. If an autoresponder directing the enquirer to go read a FAQ, and possibly submit a web ticket, is deemed compliant with this policy it seems unlikely to do much harm, albeit equally unlikely to do anything terribly useful. I still think Gregory's/Europol's needs would be better addressed by asking the NCC to provide a simple visualisation tool for the BGP routing table that enabled investigators to easily discover for a given network that was targetted for investigation which other network was providing the transit. I strongly suspect that for most of the suspect networks Europol has difficulty pinning down there is a very small number (maybe even only one) much larger, more reputable, and more easily found located network operator who would also be much more willing to be cooperative - and the only thing standing in the way of Europol making such an approach is difficulty in inspecting routing and visualising these relationships. That may not provide a perfect solutions in all cases, but neither will asking the NCC to validate data submitted by a small number of organisations that wish to conceal/lie about their data, hiding in amongst a large number of organisations that fail to maintain their data for less nefarious reasons. Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA
Malcolm At the moment people can put in any rubbish they want into an abuse-c and there is zero validation. The proposed change will mean that at least there is a valid email address at the other side even if it triggers an auto-response. In fact an auto-reply would be preferable to the black holes in many cases .. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 25/09/2017, 15:02, "anti-abuse-wg on behalf of Malcolm Hutty" <anti-abuse-wg-bounces@ripe.net on behalf of malcolm@linx.net> wrote: On 25/09/2017 14:26, herve.clement@orange.com wrote: > With regard to your first scenario, the auto-answer you mention can be > considered as a valid reply, and the "support service" would help to > proceed with the abuse report. Hervé, Thank you for your reply. If an autoresponder directing the enquirer to go read a FAQ, and possibly submit a web ticket, is deemed compliant with this policy it seems unlikely to do much harm, albeit equally unlikely to do anything terribly useful. I still think Gregory's/Europol's needs would be better addressed by asking the NCC to provide a simple visualisation tool for the BGP routing table that enabled investigators to easily discover for a given network that was targetted for investigation which other network was providing the transit. I strongly suspect that for most of the suspect networks Europol has difficulty pinning down there is a very small number (maybe even only one) much larger, more reputable, and more easily found located network operator who would also be much more willing to be cooperative - and the only thing standing in the way of Europol making such an approach is difficulty in inspecting routing and visualising these relationships. That may not provide a perfect solutions in all cases, but neither will asking the NCC to validate data submitted by a small number of organisations that wish to conceal/lie about their data, hiding in amongst a large number of organisations that fail to maintain their data for less nefarious reasons. Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA
participants (4)
-
herve.clement＠orange.com -
Malcolm Hutty -
Michele Neylon - Blacknight -
ox