4 ms·

Does this give AWS any ability to block/censor or influence access to segments of the internet that they might not politically "approve" of?

• advisedwang 6y ago
  No. If anything this makes it harder for anyone to block segments of the internet, by ensuring the integrity of routing to any given netblock.
  • jtdev 6y ago
    Who is the authority on the integrity of routing?
    • colde 6y ago
      The owner of the netblock.
      • deleted 6y ago
        [deleted]
    • superkuh 6y ago
      The certificate authority that signs the routes. So yeah, this will centralize control of routing and expose it to things like government censorship and corporation exploitation. Sometimes the wild west is better than an authoritarian government. Like DNSSEC this is only good for megacorps and nationstates. If anything it will expose human people to more abuse and exploitation.
      • ancarda 6y ago
        Has this happened as HTTPS adoption has increased? Do you believe BGP RPKI will be different? A lot of threads about rising use of encryption seem to have this fear - that it will be used against us at some point, and I'd really like to understand where this fear comes from Even taking a recent example of Parler; as far as I know it had HTTPS support and the corresponding X.509 cert was never revoked - instead hosting and I think the domain was terminated
        • jtdev 6y ago
          It seems like we should be more focused on the possibility of this being abused rather than asking if it’s been abused yet.
        • skynet-9000 6y ago
          In this case, certificate revocation being so broken probably saved Parler from having it being done to them.
        • superkuh 6y ago
          Let's put it another way. Do you think the Arab spring and Libyan civil war would've taken place if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? I don't. Now think of that on kind of thing happening with routes. Yikes. At least with the way things are now there's no ground truth. Every AS has it's own perception of the routing table and the ability to act on it. That's the way it should be. Securing BGP means less security because there is no global consensus even implied in the protocol. Securing BGP means centralizing BGP, not security.
          • dane-pgp 6y ago
            > if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? But Gaddafi was already in control of all Libyan ISPs and the .ly ccTLD. Why would DNSSEC have made his job any easier? Also, surely Facebook was more instrumental in the Arab Spring than bit.ly was.[0] If anything, the lack of DNSSEC made it easier for Gaddafi to spoof DNS results for facebook.com and other sites. [0] https://en.wikipedia.org/wiki/Social_media_and_the_Arab_Spring https://en.wikipedia.org/wiki/Social_media_and_the_Arab_Spri...
            • tptacek 6y ago
              Gaddafi was not, to my knowledge, in control of any WebPKI CA=True certificates.
              • dane-pgp 6y ago
      • simonjgreen 6y ago
        Actually, it's a level playing for all ISPs. So if you want safety, support your smaller ISPs rather than the big names who are often under the surveillance radar and will still be using RPKI.
  • deleted 6y ago
    [deleted]
  • icedchai 6y ago
    Not really. ISPs can still send your traffic to null0. They can still filter routes. On top of that, it will be years, likely decades, before the majority even bother to validate routes with RPKI.
• bawolff 6y ago
  Amazon at any point can create a firewall (it would be business suicide however to do so for geopolitical reasons). This however has nothing to do with that.
• freedomben 6y ago
  Why the downvotes for this question? Given recent events, this seems like an incredibly important consideration. No matter your perspective, this seems like something to think about. If you think Amazon did the right thing, then you would probably want them to be able to refuse routes from networks that are too dangerous. If you think Amazon did the wrong thing, then you may be afraid that this gives them even more power to de-platform. Either way, this seems relevant to me. Thanks OP for asking the question.
  • kodah 6y ago
    FYI, asking about downvotes usually yields downvotes. That said, votes usually come in waves. It'll end up where it needs to.