3 ms·

No dependency on a registrar sounds nice. More anonymous.

by axus 9mo ago

organsnyder 9mo ago
IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).
- buckle8017 9mo ago
  Arguably neither is particularly secure, but you must have an IP so only needing to trust one of them seems better.
- traceroute66 9mo ago
  > IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance). To be pedantic for a moment, ARIN etc. are registries. The registrar is your ISP, cloud provider etc. You can get a PI (Provider Independent) allocation for yourself, usually with the assistance of a sponsoring registrar. Which is a nice compromise way of cutting out the middleman without becoming a registrar yourself.
  - immibis 9mo ago
    You can also become a registrar yourself - at least, RIPE allows it. However, fees are significantly higher and it's not clear why you'd want to, unless you were actually providing ISP services to customers (in which case it's mandatory - you're not allowed to use a PI allocation for that)
    - traceroute66 9mo ago
      > and it's not clear why you'd want to The biggest modern-era reason is direct access to update your RPKI entries. But this only matters if you are doing stuff that makes direct access worthwhile. If your setup is mostly "set and forget" then you should just accept the lag associated with needing to open a ticket with your sponsor to update the RPKI.
traceroute66 9mo ago
> No dependency on a registrar sounds nice. Actually the main benefit is no dependency on DNS (booth direct and root). IP is a simple primitive, i.e. "is it routable or not ?".
- saltcured 9mo ago
  The popular HTTP validation method has the same drawback whether using DNS or IP certificates? Namely, if you can compromise routes to hijack traffic, you can also hijack the validation requests. Right?
  - zinekeller 9mo ago
    Yes, there have been cases where this has happened (https://notes.valdikss.org.ru/jabber.ru-mitm/ https://notes.valdikss.org.ru/jabber.ru-mitm/), but it's really now into the realm of 1) How to secure routing information: some says RPKI, some argues that's not enough and are experimenting with something like SCION (https://docs.scion.org/en/latest/ https://docs.scion.org/en/latest/) 2) Principal-Agent problem: jabber.ru's hijack relied on (presumably) Hetzner being forced to do it by German law agents based on the powers provided under the German Telecommunications Act (TKG)
    - traceroute66 9mo ago
      > some says RPKI Part of the issue with RPKI is its taking time to fully deploy. Not as glacial as IPv6 but slower than it should be. If there was 100% coverage then RPKI would have a good effect.

No dependency on a registrar sounds nice. More anonymous.

by axus 9mo ago

No dependency on a registrar sounds nice. More anonymous.

organsnyder 9mo ago

IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).

buckle8017 9mo ago
Arguably neither is particularly secure, but you must have an IP so only needing to trust one of them seems better.
traceroute66 9mo ago
> IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance). To be pedantic for a moment, ARIN etc. are registries. The registrar is your ISP, cloud provider etc. You can get a PI (Provider Independent) allocation for yourself, usually with the assistance of a sponsoring registrar. Which is a nice compromise way of cutting out the middleman without becoming a registrar yourself.
- immibis 9mo ago
  You can also become a registrar yourself - at least, RIPE allows it. However, fees are significantly higher and it's not clear why you'd want to, unless you were actually providing ISP services to customers (in which case it's mandatory - you're not allowed to use a PI allocation for that)
  - traceroute66 9mo ago
    > and it's not clear why you'd want to The biggest modern-era reason is direct access to update your RPKI entries. But this only matters if you are doing stuff that makes direct access worthwhile. If your setup is mostly "set and forget" then you should just accept the lag associated with needing to open a ticket with your sponsor to update the RPKI.

traceroute66 9mo ago

> No dependency on a registrar sounds nice. Actually the main benefit is no dependency on DNS (booth direct and root). IP is a simple primitive, i.e. "is it routable or not ?".

saltcured 9mo ago
The popular HTTP validation method has the same drawback whether using DNS or IP certificates? Namely, if you can compromise routes to hijack traffic, you can also hijack the validation requests. Right?
- zinekeller 9mo ago
  Yes, there have been cases where this has happened (https://notes.valdikss.org.ru/jabber.ru-mitm/ https://notes.valdikss.org.ru/jabber.ru-mitm/), but it's really now into the realm of 1) How to secure routing information: some says RPKI, some argues that's not enough and are experimenting with something like SCION (https://docs.scion.org/en/latest/ https://docs.scion.org/en/latest/) 2) Principal-Agent problem: jabber.ru's hijack relied on (presumably) Hetzner being forced to do it by German law agents based on the powers provided under the German Telecommunications Act (TKG)
  - traceroute66 9mo ago
    > some says RPKI Part of the issue with RPKI is its taking time to fully deploy. Not as glacial as IPv6 but slower than it should be. If there was 100% coverage then RPKI would have a good effect.