[anti-abuse-wg] Question about spam to abuse inbox

I've been responsible for the abuse handling of a large dedicated hoster for approx 8 years and I learnt:

 * not all complainers are honest,
 * not all complainers share an understanding of what is allowed/legal etc,
 * not all complainers share an understanding of what a hoster is and can do,
 * not all complaints are 'crisp and clear',
 * not all complaints provide all data needed to  be actionable,
 * not all complaints 'make sense'
 * not all complaints are directed to the proper ISP.
A webform is a way to ensure some of these issues are addressed. 

Most ISP's want their networks to be clean. 
Most ISP's are responsive to complaints (if not please check if your complaints touch on issue #1-7)
Most ISP's will work with you if you take time to adapt your complaint to their procedure.

Most ISP's do not like to work with Don Qioxote type of ppl.
Most ISP's do not like to be told their system sucks because your fringe procedure does not work.

So all the armchair anti abuse handling specialists here can come up with nice procedures that check all imaginary boxes they feel are needed, make proposals that have no anti-abuse effect in practise and complaints if their proposals are rejected, however in the end it's the companies that process the abuse that need to deal with all this. And if you ensure #1-7 are not in your complaint you have contributed more than sending emails as the armchair specialist.

​-- 
IDGARA | Alex de Joode | alex at idgara.nl | +31651108221 


On Thu, 25-02-2021 14h 41min, Cynthia Revström via anti-abuse-wg <anti-abuse-wg at ripe.net> wrote:
> 
I think you have misunderstood my point.

> 
> Would they send such report using their customer's own web form?

> 
No? I don't know what implied that?

> 
> Yes, doing so requires some work too, but heck aren't we paying for that already?

> 
The person sending the abuse report is rarely a paying customer.

> 
> The right thing to do would be to arrange for the abuse mailbox address to point (in)directly to the actual user of the IP address.

> 
I am assuming you are referring to having a separate abuse contact for each customer, so like abuse.cust123 at domain and registering it in the RIPE Registry/DB?
In some cases with large customers maybe but if you are a hosting provider where each customer might only have one or two IPv4 addresses, that can get to an insane amount of handles and make the database really messy.
Also the customer in question is not the only info that is relevant, like is it DoS, spam, or port scanning, etc?

> 
But in general I think there are pros and cons to web forms and email templates just as there are pros and cons to arbitrarily structured emails.

> 
-Cynthia


> 
> 
On Thu, Feb 25, 2021 at 10:05 AM Alessandro Vesely <vesely at tana.it> wrote:
> 
> Sorry for being late to the party...
> 

> 
On Sun 21/Feb/2021 03:44:07 +0100 Cynthia Revström via anti-abuse-wg wrote:
> 
> If the hosting company provides a web form, they can have a field where they 
> 
> explicitly ask for the offending IP address.
> 
> This report could then automatically also be sent to the customer in question, 
> 
> because we shouldn't assume the customer is malicious, they might just have a 
> 
> bad config that made them a relay for example.
> 

> 

> 
Would they send such report using their customer's own web form?
> 

> 
The right thing to do would be to arrange for the abuse mailbox address to 
> 
point (in)directly to the actual user of the IP address.  Yes, doing so 
> 
requires some work too, but heck aren't we paying for that already?
> 

> 

> 
Best
> 
Ale
> 
-- 
> 

> 

> 

> 

> 

> 

> 

> 







-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20210225/739b0be9/attachment.html>