Re: botnet reporting by AS - what about you?

["Christopher L. Morrow" <christopher.morrow () mci com>]

On Sat, 13 Aug 2005, Hannigan, Martin wrote:

> I was on it and unsubscribed. They wouldn't disclose the collection or
> validation process at that time. This made it useless for the most part
> as its hard to act on someones word without some idea of how they are
> getting their data and avoiding collateral damage.

this was part of my point ;( It's hard to call up a customer and say:
"someone told me that you were bad, could you stop please?" normally they
hangup after saying something uncooth and about 'you are crazy'... :( I
may be crazy, but most of the abuse folks aren't.

there has to be complete info in the complaint:

1) logs
2) timestamps
3) timezones

they should be in some structured (see inch-wg/rid for some
almost-standards-based examples) text-based format that is easily parsable
by machines.