Skip to content
Register

Route leaks improve the internet long-term

Networking by HeadRich 24 replies 3.1K views
FlowSana

Member

SRE

#11
HeadRich said:
Without MainOne, how many African ISPs would have IRR-only policies today?

This is the core disagreement. You're attributing causation to coincidence. RPKI deployment curves show steady growth from 2016, not step-function jumps at leak dates. The 2021 Cloudflare RPKI validator release did more for adoption than any outage — https://www.cloudflare.com

I have been paged at 3am for leaks I did not cause. The "free penetration testing" is not free for the people holding the pager.

It's always DNS. Always.
tinaworm

Member

#12
HeadRich said:
Pain concentrates the mind.

Pain concentrates the lawyers. MainOne's customers did not receive compensation from "the lesson." They received failed transactions.

I buy scrap routers and deploy filters before connecting. This is not expensive. This is not difficult. The "we needed the leak" narrative lets negligent operators feel wise after the fact.

-t

worst bandwidth, best stories
StuSpock

Member

NTP fundamentalist

6 #13
HeadRich said:
MikroTik CCR2216

What NTP sources?

salavi

Member

Threat Modeler

#14
HeadRich said:
MikroTik CCR2216-1G-12XS-2XQ

I assume breach. I assume your MikroTik is the breach. RouterOS has had enough CVEs to fill a weekend.

The "free penetration testing" framing ignores that route leaks are not tests. They are uncontrolled incidents with asymmetric impact. You in Dubai with your 128GB toy do not feel the pain of a Nigerian payment processor losing BGP visibility for two hours.

HeadRich

Member OP

128GB or nothing

#15
FlowSana said:
RPKI deployment curves show steady growth from 2016

Steady growth from what base? Near zero. The validator release helped the willing. Leaks converted the unwilling.

tinaworm said:
Lawyers

Litigation is also a forcing function. I do not love it. I observe it.

StuSpock said:
What NTP sources?

Pool.ntp.org plus my own stratum 1 from GPS. Why?

readerkrakw

Member

Backup Paranoid

#16
HeadRich said:
Litigation is also a forcing function.

I test backups by deleting things. I do not wait for production to fail. This is the same principle.

Route leaks as "forcing function" only works if you survive the first one. Some networks do not. I have seen ASNs disappear after multi-hour leaks destroyed their transit relationships.

The internet is not your chaos engineering lab.

ReykjavikFilch

Member

CDN skeptic

#17

Methinks the gentleman from Dubai doth possess a router grander than many a small nation's, yet the question remaineth whether the grandness of the RAM doth correlate with the wisdom of the policy, for the serpent that struck MainOne struck not because filters were too small but because they were not there at all, and no quantity of gigabytes doth substitute for absence, yet the argument that absence must be revealed by catastrophe rather than foresight doth strike me as the philosophy of one who hath not been the village burned that the province might learn of fire.

brusselsdzire1

Member

#18
HeadRich said:
Litigation is also a forcing function.

Regulation is infrastructure. The EU's NIS2 directive mandates RPKI validation for significant entities from October 2024. No leak required. Just law.

Belgian operators I speak with deployed validators because compliance officers asked, not because they suffered outages. The "pain teaches" narrative is Anglo-American tech culture imported where it does not belong.

TR

Member

#19
brusselsdzire1 said:
The EU's NIS2 directive mandates RPKI validation for significant entities from October 2024.

Italian implementation of NIS2 is slower. My ISP in Bologna still does not validate. I asked. They said "planned for 2027."

Leaks or laws, neither has reached them yet.

FlowSana

Member

SRE

#20
tranbird3 said:
Italian implementation of NIS2 is slower.

This is the practical reality. Regulatory timelines slip. RPKI deployment is uneven. Leaks happen in gaps.

My original point stands: deploy now, do not wait for incidents or compliance deadlines. I do not celebrate leaks. I note that they sometimes accelerate action where other mechanisms failed.

The 340% growth figure I cited earlier? Mostly North American and Northern European networks. Not global.

It's always DNS. Always.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft