Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update PR Template Requiring Abuse Contact for Subdomain Registry Requestors #2201

Merged
Merged
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion .github/pull_request_template.md
Original file line number Diff line number Diff line change
Expand Up @@ -123,8 +123,31 @@ stay that way for an indefinite period of time (typically long).
(Link: [about propagation/expectations](https://github.com/publicsuffix/list/wiki/Guidelines#appropriate-expectations-on-derivative-propagation-use-or-inclusion))

* [ ] *Yes, I understand*. I could break my organization's website cookies and cause other issues, and the rollback timing is acceptable. *Proceed anyways*.
---
groundcat marked this conversation as resolved.
Show resolved Hide resolved

<!--
For Subdomain Registries: Abuse Contact Confirmation

If your project operates as a subdomain registry, please confirm that you have an accessible abuse contact information on your website.

This requirement applies to entities including but not limited to:
- Registries of gTLDs/ccTLDs operating on third-level domains: For example, registries managing domains like .eu.org that offer third-level domain registrations.
- Registries that resell subdomains to registrars: These are entities that manage domains and sell subdomains of those domains to other registrars, who then distribute them to end users.
- Registries that directly resell subdomains to end customers: These operators provide subdomains directly to individuals or businesses, acting as an intermediary for domain usage.
- Hosting providers offering subdomains: Hosting services that offer free/paid subdomains (such as clientname.example.com) as part of their hosting package, making them de facto registries for their hosted clients.
- Dynamic DNS providers: These are services like Synology's *.quickconnect.to, which provide subdomains for users to dynamically map IP addresses, functioning similarly to subdomain registries.
- URL shortening services using subdomains: Services that provide shortened URLs utilizing subdomains also fall under this broad definition.

At a minimum, you must provide an abuse contact either in the form of an email address or a web form that can be used to report abuse. This contact should be easily accessible to allow concerned parties to notify the registry or subdomain operator directly when malicious activities such as phishing, malware, or abuse are detected. For example, if you provide subdomains at example.com, where users may register subdomains such as clientname.example.com, then in case of abuse, reporters should be able to visit example.com and easily find the relevant abuse contact information.

Uncomment the following checkbox if applicable:

* [ ] This request is made for a subdomain registry service. Abuse contact information (email or web form) is available and easily accessible.

**URL where abuse contact or abuse reporting form can be found**:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**URL where abuse contact or abuse reporting form can be found**:
**Abuse contact email address or web form**:

Maybe simplify it a bit

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the suggestion @wdhdev ! The difference between URL where abuse contact or abuse reporting form can be found and Abuse contact email address or web form is subtle but somewhat important though.

  • The original wording "URL where abuse contact or abuse reporting form can be found" aims to ask subdomain registry operators to provide a direct method on their website where internet users can report abuse. Ideally, anyone can easily reach the responsible party (i.e., the registry, a DDNS service, etc.) directly without relying on PSL to identify the abuse contact or forward abuse cases, which is not PSL’s role.
    • For example, if someone finds that a user at fake-bank.ip-dynamic.org (a subdomain managed by ClouDNS) is being malicious, they should be able to visit ip-dynamic.org, identify that the domain belongs to ClouDNS, and find clear instructions on how to report abuse directly to ClouDNS. The feedback loop from discovering abuse to reporting it should be straightforward and transparent.
  • On the other hand, the alternative phrasing, "Abuse contact email address or web form," could lead requestors to only submit an abuse contact email address to PSL but not make it publicly visible or accessible to their users. However, I believe the intention of this change is to allow internet users to directly report abuse to the registry's website where they can access a properly maintained contact method (email or web form).

That said, I’m open to any further suggestions on how we can make this clearer or more effective in practice!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, ignore this review then.


-->

---

<!--
As you complete each item in the checklist please mark it with an X.
Expand Down
Loading