On Mon, 6 Jun 2022 at 19:27, Richard Clayton <rich...@highwayman.com> wrote: > > In message <CAKvLzuGDaye7RTgCbS=Y29aDpNViTaZs+9Xpe72yo- > jgzda...@mail.gmail.com>, denis walker <ripede...@gmail.com> writes > > >On Mon, 6 Jun 2022 at 17:57, Suresh Ramasubramanian <ops.li...@gmail.com> > >wrote: > >> > >> Always a useful thing to do if you want to block all resources held by a > >single actor or set of actors. > > > >So are you saying that you DO use the ORGANISATION object address to > >match resources held by different members at the same location? If so > >there are technical ways to offer that functionality within the > >database without exposing the full address of natural person members. > > you're about to suggest hashing ... that doesn't provide what is needed > because it is far too fragile to be useful given that WHOIS entries are > not canonicalised and also contain minor errors
I had something similar in mind. > > you can find countless examples of typos, old addresses etc within the > RIPE data. For a contemporary example check for inconsistent use of > Kiev/Kyiv for resources held by exactly the same person/organistion. OK lets narrow it down a bit. The address of a registered business will still be publicly available in the database. So if someone has registered multiple businesses at the same address this data will still be available, even with any spelling mistakes. What we are talking about are the resource holders who are natural persons. When these people apply to be a member I am sure the RIPE NCC requires proof of identity and proof of address. (They will correct me if I am wrong.) So unless a group of natural persons are all living at the same address and all provide proof of that, then you are not going to get this address correlation anyway. If a group of natural persons are all operating from a common commercial address, not a personal address, then the address will still be publicly available in the database. The only resource holder's addresses that will be restricted are for natural persons who are operating from their home address. Those addresses are likely to be unique in the database. I will give a balanced argument and point out that there is a downside. RIPE policy allows multiple LIRs. So a natural person operating from their home address can become a Member and then set up multiple LIR accounts. Each of these accounts will be linked to separate ORGANISATION objects with the same address. Because it is a natural person and their home address, that address will have restricted access. Each of these LIRs can get separate, distinct allocations and the address link between these allocations is lost publicly. This can be fixed if we modify address policy, requiring the RIPE NCC to publicly identify the link between multiple LIRs with the same owner. Relying on the address as the main link between multiple LIRs is not perfect anyway. A Member may be able to set up multiple LIR accounts with different addresses. Having an official link would be far more reliable. The bottom line is that there are honest, law abiding people who are, or would like to be, resource holders but are exposed to considerable personal danger by making their name and address public. We must take the personal privacy issue seriously. If this creates problems in other areas we need to find solutions to those problems. cheers denis proposal author > > -- > richard Richard Clayton > > Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755 > -- > > To unsubscribe from this mailing list, get a password reminder, or change > your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
