<html><body><span style="font-family:Verdana; color:#000; font-size:12pt;"><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><i><span style="">" it does not prove at all that abuse reported to </span><span style="">this address will be handled or acted upon in any way."</span></i></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style="">We aren't here to enforce appropriate abuse handling (unfortunately),</span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style="">we are discussing how to make sure an abuse mailbox is valid. The only way to do that is to send a link to the abuse mailbox, requiring the person to access their RIPE account and to enter a CAPTCHA.</span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style=""><span style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;">Proving that an email account exists as somehow being relevant is wrong, because if i own a RIPE resource and I set my abuse mailbox to </span><font face="verdana, geneva"><span style="font-size: 12pt;">zsako AT <a href="http://iszt.hu">iszt.hu</a>, under the current proposal it will be validated as "true." There is no </span><span style="font-size: 16px;">opportunity</span><span style="font-size: 12pt;"> for you to even say "no, that's not the abuse mailbox, it's mine" because RIPE only accept bounce emails to their complaints form.</span></font></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style="">More importantly, there is nothing about the current proposal that even requires a policy. RIPE could set up today this mail server check today with out the consensus of RIPE.</span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""> </span></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><i><span style="">"On the other hand, most probably there will also be people who - for some reason -</span><br style=""><span style="">will not want to handle abuse e-mails."</span></i></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div><div style=""><font face="verdana, geneva"><span style="font-size: 12pt;">That is a </span><span style="font-size: 16px;">separate</span><span style="font-size: 12pt;"> discussion to this one. Not wanting to handle abuse emails is different to not even having to receive them.</span></font></div><div style=""><font face="verdana, geneva"><span style="font-size: 12pt;"><br></span></font></div><div style=""><font face="verdana, geneva"><span style="font-size: 12pt;"><br></span></font></div><div style="color: rgb(0, 0, 0); font-family: verdana, geneva; font-size: 12pt;"><span style=""><br></span></div>
<blockquote id="replyBlockquote" webmail="1" style="color: black; font-family: verdana; font-size: 10pt; border-left: 2px solid blue; margin-left: 8px; padding-left: 8px;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [anti-abuse-wg] Decision on Proposal 2017-02<br>
From: Janos Zsako <<a href="mailto:zsako@iszt.hu">zsako@iszt.hu</a>><br>
Date: Tue, March 20, 2018 11:23 pm<br>
To: Name <<a href="mailto:phishing@storey.xxx">phishing@storey.xxx</a>>, <a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a><br>
<br>
Dear Anonymous Name,<br>
<br>
> /"And an annual checking would ensure that the contacts remain more up-to-date."/<br>
> <br>
> Yes, an annual checking would do that. This isn't an annual checking. It involves checking if a mail server exists.<br>
<br>
I am afraid I was not clear last time. I wrote:<br>
"One can determine with a high degree of confidence whether mail sent to a<br>
given address is accepted for delivery by the mail server specified as MX<br>
in the DNS for the given e-mail address. To me it is a good start and<br>
much more than not checking anything."<br>
<br>
The acceptance of the mail is slightly more than the existence of the<br>
mail server. In particular, in one of your previous e-mails you state:<br>
'If a resource owner sets their abuse mailbox to "Ronald.McDonald@hotmail.com",<br>
they will be deemed to have a valid abuse contact, because <a href="http://hotmail.com">hotmail.com</a> has a<br>
valid email server associated.'<br>
In the light of my clarification above, this is not the case, as the mail<br>
server (which by the way does exist), does not accept mail for this recipient:<br>
5.5.0 Requested action not taken: mailbox unavailable. [<a href="http://BL2NAM02FT023.eop-nam02.prod.protection.outlook.com">BL2NAM02FT023.eop-nam02.prod.protection.outlook.com</a>]<br>
<a href="mailto:Ronald.McDonald@hotmail.com">Ronald.McDonald@hotmail.com</a> ... User unknown<br>
<br>
> Mail server exists ≠ update-to-date contact<br>
> Mail server exists ≠ valid abuse mailbox<br>
<br>
At the same time, I agree that the above holds even if you replace<br>
"Mail server exists" with "Mail server accepts mail for given recipient".<br>
<br>
Unfortunately, as it has already been pointed out, the fact that a human does<br>
reply to a mail sent by the NCC during the annual check (assuming for a moment<br>
they do send such mail), it does not prove at all that abuse reported to<br>
this address will be handled or acted upon in any way.<br>
<br>
Unfortunately I agree with Gert Doering who said:<br>
"I maintain the position that those that do care can be reached today, and<br>
those that do not care will find ways to fulfill the letter of the policy,<br>
and not change their ways."<br>
<br>
At the same time, I do see some benefit in checking regularly the provided<br>
e-mail address, because I am convinced that there will always be cases where<br>
people simply forget to update the database. If they are reminded, they will<br>
be happy to correct it.<br>
<br>
On the other hand, most probably there will also be people who - for some reason -<br>
will not want to handle abuse e-mails. They will certainly find a way to ignore<br>
such mail whatever policies we put in place.<br>
<br>
Best regards,<br>
Janos<br>
</div>
</blockquote></span></body></html>