7 ms·

BGP and RPKI

108 points by tolien 7y ago

abafazi 7y ago
The article quotes that Cloudflare are cultivating an unnecessary fear, when it's actually a necessary fear
samcday 7y ago
> and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation. Weird angle. Unless the RPKI standard is somehow actively encouraging people to violate social distancing policies, I don't see any connection with Covid-19.. To me this whole article just reads like a network operator complaining that someone else is trying to hold them accountable.
- gorgoiler 7y ago
  It’s a small business. Their staff could be infected or furloughed, or worse. In terms of our day to day lives it might feel like the proverbial month of Sundays right now, but for operations teams it’s more like an unending stream of Friday afternoons in terms of sensitivity to making big infrastructure changes.
  - tolien 7y ago
    Yeah, that was how I read it - the impact of getting this wrong is that you break the internet for your customers (and staff, if they're all or mostly WFH) at a time when they're potentially depending on it to eat (e.g. if you're in a vulnerable group and need to order food for delivery) or work. We've known BGP's been vulnerable in this way for years, so it's a bit of a weird time to actively encourage people to publicly shame their ISPs for being "unsafe".
    - oasisbob 7y ago
      Cloudflare's BGP activism isn't exactly a new thing, so critiquing their exact timing here seems misplaced perhaps?
      - tolien 7y ago
        isbgpsafeyet.com only appeared at 4 p.m BST yesterday, a Friday [1]. It's the timing of that which I took the OP to be commenting on. The GGP mentioned that we're in a month of Friday afternoons, this page dropped literally towards the end of the working day on a Friday afternoon! As you say, Cloudflare have been promoting RPKI for a couple of years now and it's disappointing that more of the big players haven't implemented it yet but is now the time? 1: https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec... > 17/04/2020, 4:00:00 pm BST > Today, we are releasing isBGPSafeYet.com, a website to track deployments and filtering of invalid routes by the major networks.
        Avamander 7y ago
        For some, it's never the time they should do something. ISPs are notorious for dragging their feet and they'd just find new excuses if CF had delayed the publish.
        tolien 7y ago
        I mean, the bigger ISPs will just ignore it like they've ignored IPv6 ¯\_(ツ)_/¯ On the other hand, AAISP started automatically assigning IPv6 addresses ~9 years ago, so you can hardly accuse them of dragging their feet. The OP was published on a Saturday, after all.
        gorgoiler 7y ago
        ...and /48s at that too.
        judge2020 7y ago
        Maybe bad optics to do it right now but it needed to be released at some point. If they delayed it until we were at the tail end of the curve of Covid-19 infections, this blog could still rely on "we're still recovering from the pandemic" to support the "bad timing" argument.
- oasisbob 7y ago
  It's a very weird angle, indeed. My home ISP hasn't deployed IPv6 yet. Though, if they cited COVID-19 as a contributing factor when asked about it, I wouldn't be stunned...
  - samgranieri 7y ago
    My home ISP (RCN) also hasn't turned IPV6 on yet either. However, they turned on RPKI between when I tested IsBGPSafeYet.com in the morning and evening.
    - jamieweb 7y ago
      They most likely didn't actually 'turn on' RPKI, but just began filtering the test range that Cloudflare are using. This will allow them to pass Cloudflare's test page, without actually validating and rejecting invalid routes or even necessarily signing their own.
- Avamander 7y ago
  It doesn't only read like a asinine complaint, it actually is. "How dare someone highlight what we've left undone" Saying things like "it's scaring our users", "others are not using it", "it's bad timing", "transit providers should be filtering", no actual non-emotional arguments why they aren't doing it and only shifting the responsibility to secure the internet. I'm too done with companies like that.
- diath 7y ago
  > To me this whole article just reads like a network operator complaining that someone else is trying to hold them accountable. Not really though, they do agree in the post that something needs to be done, they just don't agree that RPKI is quite the right answer and that Cloudflare's fearmongering scaretactic is the right move to push for RPKI.
  - windexh8er 7y ago
    IMO it's easy to have an opinion on either side of the fence - based on what you've done (or not done). Cloudflare, for example, committed to RPKI very publicly in 2018 [0]. This article, by ThousandEyes, does a nice job of visualizing the problem [1], published in July of 2019. As I read the parent article to this thread it strikes me as a bit defensive - which smells of a lie of omission (not exactly the whole truth, but conveniently cherry picked). They do very little in the article to state two missing arguments: 1) their timeline to implement RPKI (they only state: "At this stage we are looking in to this. We want to be sure we take the right approach, some of which will involved asking our transit providers what they are doing about it.") and 2) the rationale for not being further along of protecting customers with regard to the topic of RPKI. They also grab Coronovirus as a rationale for doing nothing right now: "Since this has now happened a few times, we felt it worth giving some more information that may be useful to customers and others who've seen these tweets (either directed at us, or at other ISPs), explaining a bit about what BGP is and how RPKI can extend it, and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation." If you look at this NANOG thread [2] nobody is complaining about ATT announcing they have implemented RPKI. So is there a negative downside? No. Has CloudFlare pushed some carriers into an awkward position given they are showcasing the true state of carriers as it pertains to route security in BGP? Yes. Andrews & Arnold are trying to tell their customers that their safety is paramount. Yet, they don't have a timeline to address the problem that other carriers have spent considerable time implementing over the last couple years. So, while Andrews & Arnold may be a great ISP - are they above public disclosure of an area they need to improve? No. I applaud CloudFlare for showing end users which carriers are not spending time and resources on doing their due diligence to protect their customers. Especially business customers who rely on their parent AS to operate their business safely. Andrews & Arnold's response is suspect at best given their subjective response to the "why" behind why they've chosen to do nothing. Finally - beyond CloudFlare NIST has been publishing these statistics for much longer. Just because CloudFlare has shown light on the topic - does not mean they are the bad actor. There are plenty of other outlets that have been highly supportive of these deployments - NIST [3] and RIPE [4], among very vocal proponents. So, after parsing the reality of the values of RPKI for a small amount of time - the question around why Andrews & Arnold have chosen to do nothing feels different and, in my opinion, even more appropriate. Beyond that their response feels very hollow and weak on the technicalities which have put them in a spotlight they'd rather not deal with right now. [0] https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ [1] https://blog.thousandeyes.com/visualizing-the-benefits-of-rpki/ https://blog.thousandeyes.com/visualizing-the-benefits-of-rp... [2] https://mailman.nanog.org/pipermail/nanog/2019-February/thread.html#99501 https://mailman.nanog.org/pipermail/nanog/2019-February/thre... [3] https://rpki-monitor.antd.nist.gov/#rpki_adopters https://rpki-monitor.antd.nist.gov/#rpki_adopters [4] https://labs.ripe.net/Members/antony_stergiopoulos/results-of-the-first-rpki-deployathon https://labs.ripe.net/Members/antony_stergiopoulos/results-o...
- edf13 7y ago
  Not really - at the moment all businesses are having to readjust efforts and work with less resources available. They don’t want to jump into rash decisions with minimal staff or staff dispersed across home locations and not able to work as effectively as normal - which could lead to broken BGP routes.
ngcc_hk 7y ago
Do not trust any centralised authority. But if PKI Involved, what are those and what is meant by court in the article? We have to be aware certain countries (China, Russia) may not be of best interest of humanity in mind.
pbowyer 7y ago
Andrews & Arnold are the best UK ISP I've used in 20 years of being online. As well as going above and beyond when it comes to sorting problems with BT, I appreciate that like with this post they are not afraid to stick their neck out and say what they think.
- mystcb 7y ago
  I have recently (within the last year) joined AAISP, and I am in agreement with you on this. One thing it does show to me is that, even though the site was made available by Cloudflare only recently, my ISP has already acknowledged and responded to the post. Given that they have explained the situation, what it means, and that they are actively looking into it. The trust they built up with me since I started with them, means that I do trust that they are looking into this. BGP as a whole does need a solution, and this may be one of a few ways to achieve this. I am glad they are not rushing their solution so that my connection stays online while I have to stay isolated. On the flip side, I do agree that some ISPs will drag their feet, and try to ignore everything for the sake of "money" or "can't be bothered" types of excuses. These are the ones that really should be pushed hard against to make the changes that are required. - I am just glad AAISP isn't one of them.
- teh_klev 7y ago
  I agree. I've used them since ~2007 and though they may be a bit more expensive they provide a solid service and their tech support is damned fine. Prior to A&A I used Nildram but their service turned to crap after they were bought out by Tiscali.
znpy 7y ago
Possibly related: http://rpki.me/ http://rpki.me/
judge2020 7y ago
I'd like to see what the potential issues with RPKI are (if there are any), this seems like a blog post that would address those but anything about the protocol isn't mentioned, outside of "it takes time to implement and we'd rather our upstream do it".
vbernat 7y ago
https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ is a bit misleading. They mention both IRR filtering and RPKI. Both of them are needed. RPKI currently only is used to validate the origin. When a peer only relies on RPKI, it is trivial to announce a route you are not authorized to announce: just append the legit ASN at the end of the AS path. That's what IRR filtering prevents. Both are therefore useful. RPKI protects from mistake and mitigate a bit the ability to spoof a route (adding the legit ASN makes the AS path longer and less preferred).
azranoman 7y ago
what is iq option? how to use https://coinmarket01.blogspot.com/2020/04/what-is-iq-option-how-to-use.html https://coinmarket01.blogspot.com/2020/04/what-is-iq-option-...
hugoromano 7y ago
Cloudflare approach is pushy, but many companies need a push. No RPKI and also no DNSSEC support. When will Andrews & Arnold do something about it?
- tptacek 7y ago
  Hopefully never, on the DNSSEC side. Of course, very few other ISPs (or tech and telecom companies of any sort) use DNSSEC either.
  - mlyle 7y ago
    Yay, let's leave DNS pwned because we have some disputes and the alternative isn't perfectly technically pretty. /s
    - tptacek 7y ago
      This is snark but it's snarking up an interesting architectural issue, that being: "where do we draw the line?" Say we protect DNS (we could, with a better protocol design). But other redirection protocols aren't protected. Do we similarly authenticate OSPF? IP options? ARP? The easy response to your snark is "no, people are just going to use DoH".
      - mlyle 7y ago
        We've had decent authentication in OSPF for ... decades. Most of the egregious problems with IP options have been worked around well, again for decades. ARP is problematic, but only within a segment. Your attacker has to be close. For IPv6, we have SEND, but it is not without problems. > The easy response to your snark is "no, people are just going to use DoH". DoH doesn't prevent someone from poisoning well-trafficked DoH resolvers to redirect individual domains. DNSSEC does. I run it on my zones, and it's not so bad... About 40% of resolver traffic to my domains is verifying, too, so we're getting there...
        tptacek 7y ago
tialaramex 7y ago
I have been an A&A customer for years and so this is disappointing because it's exactly the sort of crappy response I'd criticise other ISPs for. Hopefully in the not too distant future we can talk some sense into RevK and co. The choice to block one route to make isbgpsafeyet apparently pass is bogus, it's like silencing a fire alarm (which is also something I see far too many businesses choosing to do, oh Zone A keeps alarming, we'll just disable it even though now that means more danger, engineer calls are too expensive) Those familiar with my work will know that I read a lot of accident investigation reports, and a recurring theme in maritime accidents involving large vessels is that the BNWAS (a technology which alerts sleeping crew elsewhere on a vessel that for some reason nobody on the bridge is paying attention, probably because they're asleep) is "somehow" muted, with its logging disabled or even entirely switched off during an incident. That might not seem like a big deal but big ships are slow and so these incidents often take place over many minutes or hours, thus there is plenty of time for somebody to wake up, realise there's a problem, wake someone else up to help fix it, and fix the problem before you smash the ship into an island clearly marked on your chart. If Cloudflare has any sense they'll change the bogus route up every week or two so that outfits like A&A keep getting these "annoying" alarms and concerns from customers never cease. > This is marginally better than routing to somewhere else (some attacker) but it still means a black hole in the Internet. No. It's the difference between an inconvenience (routing problem which can be reported and then corrected by a human) and a grave security problem (data is being sent to completely the wrong place because you didn't bother with the mechanism to prevent that). Also, this glosses over the _very common_ scenario where the bogus routes are more specific than legitimate ones. If AA doesn't have a route to one specific /24 containing secure.bankofamerica.com that has "somehow" been advertised by a Taiwanese ISP for the past hour, that data will be bundled along with the rest of the /16 or whatever else (BoA's assignment is old and a mess) to the Akamai boxes (I think) which actually serve it anyway. Rather than a "black hole" there was no problem except for the bogus advertisement, which RPKI would have helped block.
anfilt 7y ago
I am not a fan of RPKI since it's centralized. I guess better than nothing, but what I find annoying is that IP protocol has the ability for source routing. So instead blinding trusting routes in BGP, clients/nodes who knows the route could avoid BGP entirely. It also allows the internet to be more resistant to censorship. Yet network operators seem to hate the idea of source routing because someone can spoof an ip address. So they just disable it so they don't have deal with it. Also smaller network operators seem to disable it as well to make firewall rules simpler IPv6 implements source routing too, but again is hardly used. However it does include an other standard that also works like source routing for mobile networks, but is no where as powerful.

108 points by tolien 7y ago

The article quotes that Cloudflare are cultivating an unnecessary fear, when it's actually a necessary fear

> and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation. Weird angle. Unless the RPKI standard is somehow actively encouraging people to violate social distancing policies, I don't see any connection with Covid-19.. To me this whole article just reads like a network operator complaining that someone else is trying to hold them accountable.

gorgoiler 7y ago
It’s a small business. Their staff could be infected or furloughed, or worse. In terms of our day to day lives it might feel like the proverbial month of Sundays right now, but for operations teams it’s more like an unending stream of Friday afternoons in terms of sensitivity to making big infrastructure changes.
- tolien 7y ago
  Yeah, that was how I read it - the impact of getting this wrong is that you break the internet for your customers (and staff, if they're all or mostly WFH) at a time when they're potentially depending on it to eat (e.g. if you're in a vulnerable group and need to order food for delivery) or work. We've known BGP's been vulnerable in this way for years, so it's a bit of a weird time to actively encourage people to publicly shame their ISPs for being "unsafe".
  - oasisbob 7y ago
    Cloudflare's BGP activism isn't exactly a new thing, so critiquing their exact timing here seems misplaced perhaps?
    - tolien 7y ago
      isbgpsafeyet.com only appeared at 4 p.m BST yesterday, a Friday [1]. It's the timing of that which I took the OP to be commenting on. The GGP mentioned that we're in a month of Friday afternoons, this page dropped literally towards the end of the working day on a Friday afternoon! As you say, Cloudflare have been promoting RPKI for a couple of years now and it's disappointing that more of the big players haven't implemented it yet but is now the time? 1: https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec... > 17/04/2020, 4:00:00 pm BST > Today, we are releasing isBGPSafeYet.com, a website to track deployments and filtering of invalid routes by the major networks.
      - Avamander 7y ago
        For some, it's never the time they should do something. ISPs are notorious for dragging their feet and they'd just find new excuses if CF had delayed the publish.
        tolien 7y ago
        I mean, the bigger ISPs will just ignore it like they've ignored IPv6 ¯\_(ツ)_/¯ On the other hand, AAISP started automatically assigning IPv6 addresses ~9 years ago, so you can hardly accuse them of dragging their feet. The OP was published on a Saturday, after all.
        gorgoiler 7y ago
        ...and /48s at that too.
      - judge2020 7y ago
        Maybe bad optics to do it right now but it needed to be released at some point. If they delayed it until we were at the tail end of the curve of Covid-19 infections, this blog could still rely on "we're still recovering from the pandemic" to support the "bad timing" argument.
oasisbob 7y ago
It's a very weird angle, indeed. My home ISP hasn't deployed IPv6 yet. Though, if they cited COVID-19 as a contributing factor when asked about it, I wouldn't be stunned...
- samgranieri 7y ago
  My home ISP (RCN) also hasn't turned IPV6 on yet either. However, they turned on RPKI between when I tested IsBGPSafeYet.com in the morning and evening.
  - jamieweb 7y ago
    They most likely didn't actually 'turn on' RPKI, but just began filtering the test range that Cloudflare are using. This will allow them to pass Cloudflare's test page, without actually validating and rejecting invalid routes or even necessarily signing their own.
Avamander 7y ago
It doesn't only read like a asinine complaint, it actually is. "How dare someone highlight what we've left undone" Saying things like "it's scaring our users", "others are not using it", "it's bad timing", "transit providers should be filtering", no actual non-emotional arguments why they aren't doing it and only shifting the responsibility to secure the internet. I'm too done with companies like that.
diath 7y ago
> To me this whole article just reads like a network operator complaining that someone else is trying to hold them accountable. Not really though, they do agree in the post that something needs to be done, they just don't agree that RPKI is quite the right answer and that Cloudflare's fearmongering scaretactic is the right move to push for RPKI.
- windexh8er 7y ago
  IMO it's easy to have an opinion on either side of the fence - based on what you've done (or not done). Cloudflare, for example, committed to RPKI very publicly in 2018 [0]. This article, by ThousandEyes, does a nice job of visualizing the problem [1], published in July of 2019. As I read the parent article to this thread it strikes me as a bit defensive - which smells of a lie of omission (not exactly the whole truth, but conveniently cherry picked). They do very little in the article to state two missing arguments: 1) their timeline to implement RPKI (they only state: "At this stage we are looking in to this. We want to be sure we take the right approach, some of which will involved asking our transit providers what they are doing about it.") and 2) the rationale for not being further along of protecting customers with regard to the topic of RPKI. They also grab Coronovirus as a rationale for doing nothing right now: "Since this has now happened a few times, we felt it worth giving some more information that may be useful to customers and others who've seen these tweets (either directed at us, or at other ISPs), explaining a bit about what BGP is and how RPKI can extend it, and also our feelings about Cloudflare attempting to build support in this manner, especially now, during the Corona Virus situation." If you look at this NANOG thread [2] nobody is complaining about ATT announcing they have implemented RPKI. So is there a negative downside? No. Has CloudFlare pushed some carriers into an awkward position given they are showcasing the true state of carriers as it pertains to route security in BGP? Yes. Andrews & Arnold are trying to tell their customers that their safety is paramount. Yet, they don't have a timeline to address the problem that other carriers have spent considerable time implementing over the last couple years. So, while Andrews & Arnold may be a great ISP - are they above public disclosure of an area they need to improve? No. I applaud CloudFlare for showing end users which carriers are not spending time and resources on doing their due diligence to protect their customers. Especially business customers who rely on their parent AS to operate their business safely. Andrews & Arnold's response is suspect at best given their subjective response to the "why" behind why they've chosen to do nothing. Finally - beyond CloudFlare NIST has been publishing these statistics for much longer. Just because CloudFlare has shown light on the topic - does not mean they are the bad actor. There are plenty of other outlets that have been highly supportive of these deployments - NIST [3] and RIPE [4], among very vocal proponents. So, after parsing the reality of the values of RPKI for a small amount of time - the question around why Andrews & Arnold have chosen to do nothing feels different and, in my opinion, even more appropriate. Beyond that their response feels very hollow and weak on the technicalities which have put them in a spotlight they'd rather not deal with right now. [0] https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ [1] https://blog.thousandeyes.com/visualizing-the-benefits-of-rpki/ https://blog.thousandeyes.com/visualizing-the-benefits-of-rp... [2] https://mailman.nanog.org/pipermail/nanog/2019-February/thread.html#99501 https://mailman.nanog.org/pipermail/nanog/2019-February/thre... [3] https://rpki-monitor.antd.nist.gov/#rpki_adopters https://rpki-monitor.antd.nist.gov/#rpki_adopters [4] https://labs.ripe.net/Members/antony_stergiopoulos/results-of-the-first-rpki-deployathon https://labs.ripe.net/Members/antony_stergiopoulos/results-o...
edf13 7y ago
Not really - at the moment all businesses are having to readjust efforts and work with less resources available. They don’t want to jump into rash decisions with minimal staff or staff dispersed across home locations and not able to work as effectively as normal - which could lead to broken BGP routes.

ngcc_hk 7y ago

Do not trust any centralised authority. But if PKI Involved, what are those and what is meant by court in the article? We have to be aware certain countries (China, Russia) may not be of best interest of humanity in mind.

pbowyer 7y ago

Andrews & Arnold are the best UK ISP I've used in 20 years of being online. As well as going above and beyond when it comes to sorting problems with BT, I appreciate that like with this post they are not afraid to stick their neck out and say what they think.

mystcb 7y ago
I have recently (within the last year) joined AAISP, and I am in agreement with you on this. One thing it does show to me is that, even though the site was made available by Cloudflare only recently, my ISP has already acknowledged and responded to the post. Given that they have explained the situation, what it means, and that they are actively looking into it. The trust they built up with me since I started with them, means that I do trust that they are looking into this. BGP as a whole does need a solution, and this may be one of a few ways to achieve this. I am glad they are not rushing their solution so that my connection stays online while I have to stay isolated. On the flip side, I do agree that some ISPs will drag their feet, and try to ignore everything for the sake of "money" or "can't be bothered" types of excuses. These are the ones that really should be pushed hard against to make the changes that are required. - I am just glad AAISP isn't one of them.
teh_klev 7y ago
I agree. I've used them since ~2007 and though they may be a bit more expensive they provide a solid service and their tech support is damned fine. Prior to A&A I used Nildram but their service turned to crap after they were bought out by Tiscali.

znpy 7y ago

Possibly related: http://rpki.me/ http://rpki.me/

judge2020 7y ago

I'd like to see what the potential issues with RPKI are (if there are any), this seems like a blog post that would address those but anything about the protocol isn't mentioned, outside of "it takes time to implement and we'd rather our upstream do it".

vbernat 7y ago

https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ is a bit misleading. They mention both IRR filtering and RPKI. Both of them are needed. RPKI currently only is used to validate the origin. When a peer only relies on RPKI, it is trivial to announce a route you are not authorized to announce: just append the legit ASN at the end of the AS path. That's what IRR filtering prevents. Both are therefore useful. RPKI protects from mistake and mitigate a bit the ability to spoof a route (adding the legit ASN makes the AS path longer and less preferred).

azranoman 7y ago

what is iq option? how to use https://coinmarket01.blogspot.com/2020/04/what-is-iq-option-how-to-use.html https://coinmarket01.blogspot.com/2020/04/what-is-iq-option-...

hugoromano 7y ago

Cloudflare approach is pushy, but many companies need a push. No RPKI and also no DNSSEC support. When will Andrews & Arnold do something about it?

tptacek 7y ago
Hopefully never, on the DNSSEC side. Of course, very few other ISPs (or tech and telecom companies of any sort) use DNSSEC either.
- mlyle 7y ago
  Yay, let's leave DNS pwned because we have some disputes and the alternative isn't perfectly technically pretty. /s
  - tptacek 7y ago
    This is snark but it's snarking up an interesting architectural issue, that being: "where do we draw the line?" Say we protect DNS (we could, with a better protocol design). But other redirection protocols aren't protected. Do we similarly authenticate OSPF? IP options? ARP? The easy response to your snark is "no, people are just going to use DoH".
    - mlyle 7y ago
      We've had decent authentication in OSPF for ... decades. Most of the egregious problems with IP options have been worked around well, again for decades. ARP is problematic, but only within a segment. Your attacker has to be close. For IPv6, we have SEND, but it is not without problems. > The easy response to your snark is "no, people are just going to use DoH". DoH doesn't prevent someone from poisoning well-trafficked DoH resolvers to redirect individual domains. DNSSEC does. I run it on my zones, and it's not so bad... About 40% of resolver traffic to my domains is verifying, too, so we're getting there...
      - tptacek 7y ago

tialaramex 7y ago

I have been an A&A customer for years and so this is disappointing because it's exactly the sort of crappy response I'd criticise other ISPs for. Hopefully in the not too distant future we can talk some sense into RevK and co. The choice to block one route to make isbgpsafeyet apparently pass is bogus, it's like silencing a fire alarm (which is also something I see far too many businesses choosing to do, oh Zone A keeps alarming, we'll just disable it even though now that means more danger, engineer calls are too expensive) Those familiar with my work will know that I read a lot of accident investigation reports, and a recurring theme in maritime accidents involving large vessels is that the BNWAS (a technology which alerts sleeping crew elsewhere on a vessel that for some reason nobody on the bridge is paying attention, probably because they're asleep) is "somehow" muted, with its logging disabled or even entirely switched off during an incident. That might not seem like a big deal but big ships are slow and so these incidents often take place over many minutes or hours, thus there is plenty of time for somebody to wake up, realise there's a problem, wake someone else up to help fix it, and fix the problem before you smash the ship into an island clearly marked on your chart. If Cloudflare has any sense they'll change the bogus route up every week or two so that outfits like A&A keep getting these "annoying" alarms and concerns from customers never cease. > This is marginally better than routing to somewhere else (some attacker) but it still means a black hole in the Internet. No. It's the difference between an inconvenience (routing problem which can be reported and then corrected by a human) and a grave security problem (data is being sent to completely the wrong place because you didn't bother with the mechanism to prevent that). Also, this glosses over the _very common_ scenario where the bogus routes are more specific than legitimate ones. If AA doesn't have a route to one specific /24 containing secure.bankofamerica.com that has "somehow" been advertised by a Taiwanese ISP for the past hour, that data will be bundled along with the rest of the /16 or whatever else (BoA's assignment is old and a mess) to the Akamai boxes (I think) which actually serve it anyway. Rather than a "black hole" there was no problem except for the bogus advertisement, which RPKI would have helped block.

anfilt 7y ago

I am not a fan of RPKI since it's centralized. I guess better than nothing, but what I find annoying is that IP protocol has the ability for source routing. So instead blinding trusting routes in BGP, clients/nodes who knows the route could avoid BGP entirely. It also allows the internet to be more resistant to censorship. Yet network operators seem to hate the idea of source routing because someone can spoof an ip address. So they just disable it so they don't have deal with it. Also smaller network operators seem to disable it as well to make firewall rules simpler IPv6 implements source routing too, but again is hardly used. However it does include an other standard that also works like source routing for mobile networks, but is no where as powerful.