7 ms·
Helping to secure internet routing
- ericpauley 6y agoSee also: https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ (2018)
- ed25519FUUU 6y agoISPs need this big time.
- jtdev 6y agoDoes this give AWS any ability to block/censor or influence access to segments of the internet that they might not politically "approve" of?
- advisedwang 6y agoNo. If anything this makes it harder for anyone to block segments of the internet, by ensuring the integrity of routing to any given netblock.
- jtdev 6y agoWho is the authority on the integrity of routing?
- colde 6y agoThe owner of the netblock.
- deleted 6y ago[deleted]
- superkuh 6y agoThe certificate authority that signs the routes. So yeah, this will centralize control of routing and expose it to things like government censorship and corporation exploitation. Sometimes the wild west is better than an authoritarian government. Like DNSSEC this is only good for megacorps and nationstates. If anything it will expose human people to more abuse and exploitation.
- ancarda 6y agoHas this happened as HTTPS adoption has increased? Do you believe BGP RPKI will be different? A lot of threads about rising use of encryption seem to have this fear - that it will be used against us at some point, and I'd really like to understand where this fear comes from Even taking a recent example of Parler; as far as I know it had HTTPS support and the corresponding X.509 cert was never revoked - instead hosting and I think the domain was terminated
- jtdev 6y agoIt seems like we should be more focused on the possibility of this being abused rather than asking if it’s been abused yet.
- skynet-9000 6y agoIn this case, certificate revocation being so broken probably saved Parler from having it being done to them.
- superkuh 6y agoLet's put it another way. Do you think the Arab spring and Libyan civil war would've taken place if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? I don't. Now think of that on kind of thing happening with routes. Yikes. At least with the way things are now there's no ground truth. Every AS has it's own perception of the routing table and the ability to act on it. That's the way it should be. Securing BGP means less security because there is no global consensus even implied in the protocol. Securing BGP means centralizing BGP, not security.
- deleted 6y ago[deleted]
- icedchai 6y agoNot really. ISPs can still send your traffic to null0. They can still filter routes. On top of that, it will be years, likely decades, before the majority even bother to validate routes with RPKI.
- bawolff 6y agoAmazon at any point can create a firewall (it would be business suicide however to do so for geopolitical reasons). This however has nothing to do with that.
- freedomben 6y agoWhy the downvotes for this question? Given recent events, this seems like an incredibly important consideration. No matter your perspective, this seems like something to think about. If you think Amazon did the right thing, then you would probably want them to be able to refuse routes from networks that are too dangerous. If you think Amazon did the wrong thing, then you may be afraid that this gives them even more power to de-platform. Either way, this seems relevant to me. Thanks OP for asking the question.
- kodah 6y agoFYI, asking about downvotes usually yields downvotes. That said, votes usually come in waves. It'll end up where it needs to.
- dangerboysteve 6y agolistened to a good podcast about this a while back https://softwareengineeringdaily.com/2020/12/02/bgp-with-andree-toonk/ https://softwareengineeringdaily.com/2020/12/02/bgp-with-and...
- jgrahamc 6y agoSee also https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ and https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
- rossdavidh 6y agoWell, I feel so much more secure about that, now.
- ancarda 6y ago>We are happy to have over 99% of our IPv4 and IPv6 -Space covered under a Route Origination Authorization, and that we are right now dropping RPKI invalid routes in every single Point-of-Presence for AS16509. Does anyone know if AWS is going to push the remaining 1% to implement ROA? Also, it sounds like an unsigned route - which I think most BGP announcements are - is still accepted, right? Any idea when we can start to require routes be signed?
- wmf 6y agoMaking RPKI mandatory is like turning off IPv4 after everyone has adopted IPv6.
- tialaramex 6y agoI believe it is likely that global IPv4 routing goes away before universal adoption of IPv6 at clients. Transitional technologies allow IPv4 holdouts to have "working" Internet despite an increasing proportion of IPv6 nodes, there's some device somewhere which is mapping your connection to some IPv6-only service as an imaginary IPv4 connection. Such things wouldn't scale with 99% of users and usages, but can handle say, five thousand IPv4 users on your ten million customer ISP who mostly visit Facebook and check email. Eventually the long distance traffic for IPv4 is tiny, because there's a transition device nearer almost all remaining IPv4 users and that's turning their traffic into IPv6 for the long haul anyway. At that point if you're a backbone provider, IPv4 is a sizeable cost (the routing tables for it are horrendous) for negligible benefit (hardly any of your traffic) and its future only looks more dismal. So you start deprecating this service for your customers, and they don't bother to buy a replacement because they have a transition device to help any residual IPv4 users. And so one day, without a fanfare, there just isn't really an IPv4 Internet any more, and the RIRs will just deprecate their management of the numbering for that network because it's obsolete. Ideally this is an obscure nerd event, like a leap second, which your friends at first don't understand, and then when you explain it they realise it's boring and they don't care. I hope to live to see it.
- p1mrx 6y ago
- skynet-9000 6y agoWith RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR's, which still have to operate according to the laws of the jurisdiction that they operate in, but span country laws. Follow up question. What happens when a judge in (any country) issues legal notice to terminate the certificate to the RIR of a region for a netblock of an entity in another country?
- lima 6y ago> Does the netblock "owner" suddenly see all of its traffic dropped? Assuming everyone implements RPKI validation AND the RIR signs a new valid ROA with a different origin: Yes, eventually. Depends on sync intervals. It's unlikely it would even be legally possible to compel them to do this. Individual ASNs can still choose to accept the invalid route anyway. The RIR already has the power to revoke assignments, and IRRs would likely remove the route objects which most large networks use to generate filters. It was simply a slower process, and filtering according to IRR data is much more error-prone and open to abuse. For example, here's RIPE's policy: https://www.ripe.net/publications/docs/ripe-541 https://www.ripe.net/publications/docs/ripe-541
- apple_innocent 6y ago"It's unlikely it would even be laglly possible to compel them to do this." But then, at a higher level, look at the unilateral/collective censorship ("deplatforming") that is happening right now... and being carried out in part by Amazon. None of the censors have been legally compelled to take any such actions.
- xenadu02 6y agoWhat you are calling "censorship" is a free market business transaction. There are many cloud services, colo facilities, etc. If Amazon chooses not to do business with you there are certainly other options. This certainly happens at the local level all the time: really toxic customers can get "fired" and banned from all the local movie theaters or all the local grocery stores. It is really no different online - some people just got used to living consequence-free on the internet. Wider society had no idea what the internet was at first then later didn't grasp the seriousness or impact the internet had. Fewer people hold such obviously disprovable beliefs now. The internet is just slowly catching up with how the physical world usually works. Neo-Nazi groups often can't find private venues willing to host their rallies, caterers willing to serve them food, etc. Newspapers refuse to run ads all the time. Broadcast networks don't hand over the microphone to everyone who demands it. If every newspaper in the country refuses to run your political ad that doesn't make it a grand conspiracy to censor you - perhaps you're just an asshole they don't want to do business with. RIRs are not regular for-profit businesses and operate under very different policies for many reasons not the least of which is there are no alternatives since the RIR controls your access to the internet within your region via IP assignments.
- asdfsfkwqe 6y agoGiven recent AWS activities. One can foresee AWS dropping routing request for sites they don't like.
- godzillabrennus 6y agoI’m happy to see this get addressed yet simultaneously disappointed that Pirate Bay can’t knock North Korea off the Internet anymore.
- jharohit 6y agoWe need to get to a fully trustless routing mechanism on global networks
- hossbeast 6y agoFully trustless is where we started.
- kornbattery 6y agoIf you have to trust everyones routing to be correct to have a working internet, it doesen't seem trustless
- deleted 6y ago[deleted]