RPKI now protects 70% of internet routes

RPKI now protects 70% of internet routes(ipinfo.io)

78 points by emot 3 hours ago | 23 comments

cowlevel 2 hours ago |

My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database.

gizmo686 2 hours ago | |

Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.

Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).

This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.

maxclark 2 hours ago | |

RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.

mzajc 2 hours ago | |

I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.

ggm 2 hours ago | |

So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.

Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?

The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.

adastra22 2 hours ago | | |

The internet is supposed to be a decentralized network.

daishi55 2 hours ago | | |

I don’t think that one country should get to unilaterally decide whether another country gets internet, no.

yipinwong 2 hours ago | | |

This is what happens when someone wants to regulate the crap outta everything. what a dumb ass take.

kortilla 2 hours ago | | |

>Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?

Yes. It was the vision of the internet to continue on outside of the whatever political whims some tiny slice of western governments.

It’s just too ripe for abuse.

You can make whatever “whatabout” arguments on DNS, etc but none of those are required to get connectivity (DHT, p2p hosts, tor names, etc).

Any centralization around the narrow middle IP layer of the internet should be treated with extreme skepticism and pushback.

aftbit 2 hours ago | |

Certificate revocation as an act of war... the 2030s are gonna be wild.

teraflop 1 hour ago | | |

I'm reminded of Vernor Vinge's novel Rainbows End, which is set in 2025. It features a cyberattack against a rogue AI, which involves revoking a root CA certificate belonging to Credit Suisse, causing massive collateral damage to the European economy and infrastructure.

Vinge didn't quite get to see his rogue AI prediction become (sort of) reality, right on schedule, but he did at least outlive Credit Suisse.

stouset 2 hours ago | |

I get your broader point, but making it potentially easier to cut Russia specifically off from the Internet might not be the worst thing in the world.

1473-bytes 1 hour ago |

A couple years ago our org made a big push to have our routes and our downstream customer routes RPKI valid. It's good to see the high adoption rate. It looks like ASPA is now available for ASN path validation. Probably should look at adopting ASPA at some point here.

est 1 hour ago |

so is there a public service that can verify some IP block belongs to which country/cert?

whois is so deprecated.

reincoder 1 hour ago | |

We have country level breakdown for ASNs.

  - https://ipinfo.io/AS214822#geolocation

We have some IP range breakdown as well:

  - https://ipinfo.io/AS214822/45.8.228.0/24
  - https://ipinfo.io/ips/45.8.228.0/24

We have the data. How would you like us to present it? (Bonus point if you can tell me why that will be helpful because that will help me to make a better pitch to engineering!)