[arin-ppml] Policy Proposal 2003-1: Required Performance of Abuse Contact

[Bell, Brad (TIS)]

I spend a great deal of time dealing with and thinking like "bad actors" on the internet. Anything that would entail requirements for abuse contacts is open to, honestly, abuse. If people are getting swatted over Instagram and Twitter accounts, how much abuse is ARIN and the average small to mid-size organization going to tolerate?


  1.
A company with deep pockets is being "named and shamed" in this email thread. What if someone there unleashes a deluge of falsified requests to a large number of internet sites which implicate the person who brought them up in this policy thread?  DNS amplification-style attacks are easy enough to achieve.
  2.
Actually, it was an entirely different entity who wanted it to look like the company with deep pockets in #1, just to deflect blame from themselves with the obvious scapegoat.
  3.
If someone dumps a few thousand emails per hour into abuse@<your domain here> and you are required to generate a ticket and respond, can they break a ticketing system or the admins who have to respond?  How long until a "bad actor" can justifiably point to policy and claim you are not following it? How can I automate this to make my "take domains offline-as-a-service" company more profitable?
  4.
There is grey market for almost everything. IPv4 and domain names can be lucrative. A policy that would prompt ARIN to reclaim resources from people who do not fit a "required performance metric" make the process easier and give me a legal option to achieve my goals.

I would encourage a stronger focus on promoting "good netizen" behaviour than creating a policy which can be used to malicious effect. I thought of those 4 examples in about 5 minutes. If I have learned one thing, it is that people way smarter than I am probably have a list of 40 items and are already looking at implementation options.

Best regards,

Brad

*The opinions and beliefs expressed in this email are mine alone and do not reflect the opinions and beliefs of my employer.*

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20250829/dcec44ed/attachment.htm>