4 ms·

> Also: BGP probably needs to redesigned from the ground up by software engineers with experience from designing systems that can remain working with hostile ac

by q3k 6y ago

> Also: BGP probably needs to redesigned from the ground up by software engineers with experience from designing systems that can remain working with hostile actors. This has been attempted a number of times, but this is a political problem, not a technical problem: there's no single agreed source of truth for routing policy. A lot of US Internet providers won't even sign up for ARIN IRR, or even move their legacy space to a RIR - so there isn't even any technical way of figuring out address space ownership and cryptographic trust (ie. via RPKI). Hell, some non-RIR IRRs (like irr.net) are pretty much the fanfiction.net equivalent of IRRs, with anyone being able to write any record about ownership, without any practical verification (just have to pay a fee for write access). And for some address space, these IRRs are the only information about ownership and policy that exists. Without even knowing for sure who a given block belongs to, or who's allowed to announce it, or where, how do you want to fix any issues with a new dynamic routing protocol?

kitteh 6y ago
RPKI is a totally diff problem here, though. If people refuse to sign ROAs, then they don't get protection. The ARIN TAL thing is real and people have to keep fighting that. As it is right now you can xfer v4 out of ARIN but not v6. So even if you wanted to you can't.
tpmx 6y ago
Build an industry coalition. Put pressure on those who don't join. Randomly throw away 1 out of 10000 packets from the providers that fail to get with the times. Increase that frequency according to some published time function.
- sneak 6y ago
  Having a single, cryptographically assured source of truth for routing data is a turnkey censorship nightmare waiting to happen. All it takes is a national military to care enough to put pressure on the database operator, legal or otherwise, and suddenly your legitimate routes are no longer accepted. If you think this wouldn't be used to shut down things like future Snowden-style leaks or Wikileaks or The Shadow Brokers, you may not have been paying attention to the news.
  - tpmx 6y ago
    Yes, obviously. How is that related to the discussion above?
  - kitteh 6y ago
    sneak you should come back to irc :)
    - sneak 6y ago
      Where? Send me an email rather than spamming this thread; my email address is on my profile.
- q3k 6y ago
  > Build an industry coalition. Put pressure on those who don't join. Randomly throw away 1 out of 10000 packets from the providers that fail to get with the times. Increase that frequency according to some published time function. What sort of incentive would anyone have to join such a coalition? Why would anyone work with providers from such a coalition, when they can work with an alternative ISP outside it and not have to deal with packet drops? I think you're underestimating how many people have been attempting to solve this. The Internet community has some quite clever people in it, but it's also very, very large, and sweeping changes are difficult to pull off (see: IPv6 adoption).
- kazen44 6y ago
  and who should be the spearhead of this coalition? Let's not forget that this is mainly a political problem and not a technical one. Would countries be willing to join a coalition with heavy influence from china for example? (or vice versa with the US).

by q3k 6y ago

kitteh 6y ago

RPKI is a totally diff problem here, though. If people refuse to sign ROAs, then they don't get protection. The ARIN TAL thing is real and people have to keep fighting that. As it is right now you can xfer v4 out of ARIN but not v6. So even if you wanted to you can't.

tpmx 6y ago

Build an industry coalition. Put pressure on those who don't join. Randomly throw away 1 out of 10000 packets from the providers that fail to get with the times. Increase that frequency according to some published time function.

sneak 6y ago
Having a single, cryptographically assured source of truth for routing data is a turnkey censorship nightmare waiting to happen. All it takes is a national military to care enough to put pressure on the database operator, legal or otherwise, and suddenly your legitimate routes are no longer accepted. If you think this wouldn't be used to shut down things like future Snowden-style leaks or Wikileaks or The Shadow Brokers, you may not have been paying attention to the news.
- tpmx 6y ago
  Yes, obviously. How is that related to the discussion above?
- kitteh 6y ago
  sneak you should come back to irc :)
  - sneak 6y ago
    Where? Send me an email rather than spamming this thread; my email address is on my profile.
q3k 6y ago
> Build an industry coalition. Put pressure on those who don't join. Randomly throw away 1 out of 10000 packets from the providers that fail to get with the times. Increase that frequency according to some published time function. What sort of incentive would anyone have to join such a coalition? Why would anyone work with providers from such a coalition, when they can work with an alternative ISP outside it and not have to deal with packet drops? I think you're underestimating how many people have been attempting to solve this. The Internet community has some quite clever people in it, but it's also very, very large, and sweeping changes are difficult to pull off (see: IPv6 adoption).
kazen44 6y ago
and who should be the spearhead of this coalition? Let's not forget that this is mainly a political problem and not a technical one. Would countries be willing to join a coalition with heavy influence from china for example? (or vice versa with the US).