So you ignore/don't deal with the abuse coz it's shipped in a format you refuse to handle?
And you don't even bother telling the reporter you would like it in a per ip format? Or make attempts to make it work the way they report it (split out the ip's and modify the to be forwarded mail to only contain the ip's belonging to that customer)???
Kind regards,
Alexander Maassen
- Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer
-------- Oorspronkelijk bericht --------Van: Baldur Norddahl <baldur.norddahl@gmail.com> Datum: 21-09-16 10:37 (GMT+01:00) Aan: nanog@nanog.org Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses
Hi
We have the opposite problem with PSN: Sometimes they will send abuse
reports with several of our IP addresses listed. The problem with that
is that we can not give data about one customer to another customer. By
listing multiple IP addresses we are prevented from forwarding the email
to the customer. Which means we may ignore it instead.
Regards,
Baldur
You will have to remember that these are automated mails from the reporter.
If I write them back it goes into their bit bucket, because they do not
really care enough to bother replying. I am betting they are sending out
thousands mails each day and they can not handle manually replying to all
of that. In the same way we receive a large amount of automated mail so we
have to be able to handle it automatically. Send me something sane and I
will make a script that forwards it. Send me something unusable and I wont
- but I will not do manual handling of your automated mail.
All I am trying to do here is tell people that send abuse mails not to
combine multiple abuse complaints in one mail, because that makes it harder
for everybody and makes it more likely that your mail will be dropped as
too much work. Double so if your abuse mails is from an automated system,
because I will try to match your automated system with my own. However it
is much harder to make a system that can edit your complaint and duplicate
it to several recipients, than it is to run a simple filter that just
forwards the mail as is.
As to PSN they will usually send multiple mails if the abuse is ongoing. At
some point they will send a mail with just one IP and that one gets
forwarded. So we are dropping some of the mails, but the users eventually
get notified anyway. It is not ideal but it works.
Regards,
Baldur
So you ignore/don't deal with the abuse coz it's shipped in a format you
refuse to handle?
And you don't even bother telling the reporter you would like it in a per
ip format? Or make attempts to make it work the way they report it (split
out the ip's and modify the to be forwarded mail to only contain the ip's
belonging to that customer)???
You will have to remember that these are automated mails from the reporter.
If I write them back it goes into their bit bucket, because they do not
really care enough to bother replying. I am betting they are sending out
thousands mails each day and they can not handle manually replying to all
of that. In the same way we receive a large amount of automated mail so we
have to be able to handle it automatically. Send me something sane and I
will make a script that forwards it. Send me something unusable and I wont
- but I will not do manual handling of your automated mail.
All I am trying to do here is tell people that send abuse mails not to
combine multiple abuse complaints in one mail, because that makes it harder
for everybody and makes it more likely that your mail will be dropped as
too much work. Double so if your abuse mails is from an automated system,
because I will try to match your automated system with my own. However it
is much harder to make a system that can edit your complaint and duplicate
it to several recipients, than it is to run a simple filter that just
forwards the mail as is.
As to PSN they will usually send multiple mails if the abuse is ongoing. At
some point they will send a mail with just one IP and that one gets
forwarded. So we are dropping some of the mails, but the users eventually
get notified anyway. It is not ideal but it works.
Regards,
Baldur
We've also started ignoring their abuse emails, for the same reason. Their abuse emails at one point contained the line:
> P.S. If you would prefer an individual email for each IP address on this list, please let us know.
But, they didn't respond after we contacted them requesting it (and that line has since been removed).
Considering that there are likely to be many such emails - just how much time is it going to take your abuse desk staffer to just parse out those IPs from whatever log that they send you?
And how much time would processing say 50 individual emails take compared to 50 IPs in a single email?
--srs
Single IP per email: automated, zero time at all.
Multiple IPs per email: manual process, minutes per IP.
The format of the abuse complaint doesn't mean anything if it still doesn't
contain any relevant data to say what the abuse IS. (Or, even if it IS
abuse at all.)
Well yes – if you have the automation, that is great.
Of course the format of whatever log they send you matters too.
I’ve had abuse complaints in a past life where the abuse report was a screenshot from a checkpoint firewall with “Dear team, for your attention” in bright red in a large font.
Personally I don’t trash abuse reports that are valid.
--srs