6 ms·

I think the more important point, which I agree with, is that Cloudflare shouldn't be using this scare tactic, especially in the middle of a pandemic.

ceejayoz 7y ago
Could you explain why security matters less during a pandemic?
- toomuchtodo 7y ago
  You don't break critical infrastructure when it's needed the most, when what we have today is working "well enough" until a window of time presents itself when improvements can be made. You manage risk through balancing security and business requirements. You mitigate the risk you can, you accept the risk you can't (or choose to defer). Disclaimer: I work in risk. I have these conversations daily. When Cloudflare first published their RPKI marketing site, I thought it was an important issue until doing further research, and have since walked back my personal opinion (which was admittedly overzealous about RPKI initially) on the severity of the issue and the the timeline necessary for action to be taken.
  - 1over137 7y ago
    And it's not just "business requirements". Many people are now forced to work from home, and they need working internet to do so. Their paycheque and ability to buy food and shelter may now depend on it.
  - ceejayoz 7y ago
    They've been deferring for a long time. The RKPI RFC is from 2012. Cloudflare's been publishing blog articles like "RPKI - The required cryptographic upgrade to BGP routing" (https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/) for years now.
    - toomuchtodo 7y ago
      And? If a central authority (or statute) doesn't dictate implementation, connectivity providers have the ability to defer forever. Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. It's their dollars to spend on connectivity, not ours.
      - judge2020 7y ago
        This is going into the "America vs Europe ISPs" argument again. Americans almost always have only one ISP available to them for where they live, so they can't reasonably leave their ISP just because they don't do RPKI correctly since it would leave them without any internet, or they would have to go to satellite internet with slow speeds.
        toomuchtodo 7y ago
        Do you have a solution other than Cloudflare attempting to use their position as a large autonomous system to coerce implementation? If not, you might expect other providers to push back against such efforts.
      - ceejayoz 7y ago
        > Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. That's a silly assertion. What percentage of residential ISP customers do you think are aware at all of RPKI? Cloudflare's "is BGP safe" page is intended to highlight the ISPs that are deferring RPKI. If you claim customers are making an educated decision on whether RPKI is necessary, you shouldn't have an objection to the site's existence.
        toomuchtodo 7y ago
        It's a silly assertion to think most ISP customers would care about RPKI, even if made aware. Gmail works? Netflix works? Facebook works? Zoom works? Carry on. Prove me wrong! I would love to be wrong. People don't even care about PATRIOT act renewals, it is highly unlikely they're concerned about the implementation of cryptographic primitives for authenticating routing updates. "Did you know China could poison routing tables and see all your data?" "I don't do anything I care about them seeing." This is from a real conversation with your average non-tech individual. It is not a technology issue (today, you could use VPNs [WARP] and cryptography to create a mesh from end users to Cloudflare to server side endpoints and fail closed when BGP routing gets hijacked temporarily anywhere in the mesh), it is a privacy advocacy issue. Encouraging people to care is the hard part.
- mwcampbell 7y ago
  toomuchtodo's response covers the relative importance of security. My concern is more about taste in marketing.
zymhan 7y ago
What is your worry about pointing out BGP's flaws, that folks will start panic-deploying another routing algorithm like they hoarded toilet paper?
- mwcampbell 7y ago
  As the site itself points out, they could needlessly increase the load on their ISP's tech support.
  - zymhan 7y ago
    That would be awful! \s
sgammon 7y ago
you are deeply wrong

ceejayoz 7y ago

Could you explain why security matters less during a pandemic?

toomuchtodo 7y ago
You don't break critical infrastructure when it's needed the most, when what we have today is working "well enough" until a window of time presents itself when improvements can be made. You manage risk through balancing security and business requirements. You mitigate the risk you can, you accept the risk you can't (or choose to defer). Disclaimer: I work in risk. I have these conversations daily. When Cloudflare first published their RPKI marketing site, I thought it was an important issue until doing further research, and have since walked back my personal opinion (which was admittedly overzealous about RPKI initially) on the severity of the issue and the the timeline necessary for action to be taken.
- 1over137 7y ago
  And it's not just "business requirements". Many people are now forced to work from home, and they need working internet to do so. Their paycheque and ability to buy food and shelter may now depend on it.
- ceejayoz 7y ago
  They've been deferring for a long time. The RKPI RFC is from 2012. Cloudflare's been publishing blog articles like "RPKI - The required cryptographic upgrade to BGP routing" (https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/) for years now.
  - toomuchtodo 7y ago
    And? If a central authority (or statute) doesn't dictate implementation, connectivity providers have the ability to defer forever. Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. It's their dollars to spend on connectivity, not ours.
    - judge2020 7y ago
      This is going into the "America vs Europe ISPs" argument again. Americans almost always have only one ISP available to them for where they live, so they can't reasonably leave their ISP just because they don't do RPKI correctly since it would leave them without any internet, or they would have to go to satellite internet with slow speeds.
      - toomuchtodo 7y ago
        Do you have a solution other than Cloudflare attempting to use their position as a large autonomous system to coerce implementation? If not, you might expect other providers to push back against such efforts.
    - ceejayoz 7y ago
      > Customers have accepted the risk and deemed it acceptable if their provider does not support RPKI. That's a silly assertion. What percentage of residential ISP customers do you think are aware at all of RPKI? Cloudflare's "is BGP safe" page is intended to highlight the ISPs that are deferring RPKI. If you claim customers are making an educated decision on whether RPKI is necessary, you shouldn't have an objection to the site's existence.
      - toomuchtodo 7y ago
        It's a silly assertion to think most ISP customers would care about RPKI, even if made aware. Gmail works? Netflix works? Facebook works? Zoom works? Carry on. Prove me wrong! I would love to be wrong. People don't even care about PATRIOT act renewals, it is highly unlikely they're concerned about the implementation of cryptographic primitives for authenticating routing updates. "Did you know China could poison routing tables and see all your data?" "I don't do anything I care about them seeing." This is from a real conversation with your average non-tech individual. It is not a technology issue (today, you could use VPNs [WARP] and cryptography to create a mesh from end users to Cloudflare to server side endpoints and fail closed when BGP routing gets hijacked temporarily anywhere in the mesh), it is a privacy advocacy issue. Encouraging people to care is the hard part.
mwcampbell 7y ago
toomuchtodo's response covers the relative importance of security. My concern is more about taste in marketing.

zymhan 7y ago

What is your worry about pointing out BGP's flaws, that folks will start panic-deploying another routing algorithm like they hoarded toilet paper?

mwcampbell 7y ago
As the site itself points out, they could needlessly increase the load on their ISP's tech support.
- zymhan 7y ago
  That would be awful! \s

sgammon 7y ago

you are deeply wrong