Dear Philippe, thank you very much for these suggestions. At first glance they do make a lot of sense! I'll also put this topic onto the draft agenda for the next WG Meeting. In the meantime discussion on the mailing list is encouraged. Please! I took the liberty to forward these suggestions to the list for the European security and incident response teams, too, asking for feedback on *this* list. Wilfried. Philippe Bourcier wrote:
Hi,
The -c flag which is going to be implemented soon for any standard IP query to the RIPE whois is a good thing. But since most IRT objects returned don't have an abuse-mailbox field, the result is pretty useless (no e-mail will be returned). Developers will keep using -B in their tools so that they can send their abuse reports somewhere...
Facts =====
The e-mail field of an IRT object is hidden until you use the -B flag. Most IRT objects have been created without an abuse-mailbox field. For the IRT object, the e-mail field is mandatory, but the abuse-mailbox is optional. The e-mail field of an IRT object is by definition an abuse-mailbox.
Proposal ========
One of the easiest way to make the -c flag really useful without -B is to have all IRT objects return an abuse-mailbox. Thus, the abuse-mailbox field should be mandatory and for all IRT objects which don't have one, the e-mail field should be copied to it. (To be logical, the e-mail attribute should be set to optional.)
More Thoughts ============= Another issue is to deploy the IRT object (or even the abuse-mailbox...) on a huge number of inetnum's. If we wait for people to modify all their inetnum objects so that they have an abuse-mailbox or irt-mnt attribute, it will take ages. A standard IP query to the RIPE whois now gives one "origin" attribute (or more). Maybe the mnt-irt of that aut-num could be displayed in the default output... A company not owning the AS announcing their prefix, and willing to use its own IRT object (or abuse-mailbox) could use the mnt-irt in their inetnum('s) to specify a "more specific" one.
RFD === What do people think about these 2 ideas ?
Sincerely, Philippe Bourcier