------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal@ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ That problem that we weren't having yesterday, is it better? (Big ISP NOC) ---------- Forwarded message ---------- Date: 7 Jan 2002 22:02:47 -0000 From: owner-techsec-wg@ripe.net To: techsec-wg-approval@ripe.net Subject: BOUNCE techsec-wg@ripe.net: Non-member submission from [Philippe Bourcier <philippe@cyberabuse.org>] Received: (qmail 22109 invoked by uid 0); 7 Jan 2002 22:02:47 -0000 Received: from birch.ripe.net (193.0.1.96) by postman.ripe.net with SMTP; 7 Jan 2002 22:02:47 -0000 Received: from postman.ripe.net (postman.ripe.net [193.0.0.199]) by birch.ripe.net (8.11.6/8.11.6) with SMTP id g07M2kl12212 for <techsec-wg@ripe.net>; Mon, 7 Jan 2002 23:02:46 +0100 Received: (qmail 22098 invoked by uid 0); 7 Jan 2002 22:02:46 -0000 Received: from lafontaine.noos.net (HELO smtp.noos.fr) (212.198.2.72) by postman.ripe.net with SMTP; 7 Jan 2002 22:02:46 -0000 Received: (qmail 138538585 invoked by uid 0); 7 Jan 2002 22:02:45 -0000 Received: from unknown (HELO psy.cyberabuse.org) ([195.132.136.27]) (envelope-sender <philippe@cyberabuse.org>) by 212.198.2.72 (qmail-ldap-1.03) with SMTP for <gabriella.paolini@garr.it>; 7 Jan 2002 22:02:45 -0000 Message-Id: <5.1.0.14.2.20020107222534.027724c8@ns0.ovh.net> X-Sender: (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Mon, 07 Jan 2002 23:04:07 +0100 To: gabriella.paolini@garr.it From: Philippe Bourcier <philippe@cyberabuse.org> Subject: Re: Status of IRT object Cc: techsec-wg@ripe.net, db-wg@ripe.net, lir-wg@ripe.net, enzo.valente@garr.it In-Reply-To: <3C3A0794.7F8F97F6@surfnet.nl> References: <Pine.OSF.4.40.0201071757070.8825-100000@dxgarr.dir.garr.it> <p05100305b85f8b712c40@[193.0.1.185]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Re,

...

if nothing unexpected happens, you will be able to look at irt objects in the RIPE DB this week.

As a member of another CERT team, I'd like to say I am very pleased with this :).

As the coder of the CyberAbuse whois and a heavy user of all the whois db's I'm happy to hear things finally goes in the right direction. Note that the CyberAbuse whois does check remarks/descr/trouble fields for emails starting with abuse@/csirt@/security@. I had removed cert@ since it seemed not to be used. Though, since the CyberAbuse whois abuse contacts are in most cases netadmin's emails (coordinators/admin-c) I provide a way for admins to modify the Abuse contact field. If you go to http://www.cyberabuse.org/whois/?page=change, then you can have enzo.valente@infn.it become cert@garr.it. Though this won't be needed since I re-added cert@ in the list of mails to catch. Note that there is a web version of the CyberAbuse whois at http://www.cyberabuse.org/whois/?page=whois , it's a bit more powerfull (reverse AS checking and host lookup). There is also a "light" version at whois.light.cyberabuse.org, for the anti-spam community which runs batch against it to contact administrators of open relays. Sincerely, Philippe Bourcier