Skip to content
Register

RPKI ROAs hurt small networks more than help

Networking Locked by wilmaethqn44 24 replies 3.6K views
This thread is locked — new replies are not accepted. (Wrong category — please repost)
sarahjey

Member

3 #21

CS student perspective: RPKI is actually elegant in theory. Signed prefix lists, cryptographic origin validation, beautiful. The implementation reality is "here is a web panel with three dropdowns and a prayer button." The abstraction leaks everywhere.

I run on Hetzner Nuremberg and CloudCone LA for my projects. Hetzner at least has docs. CloudCone has nothing, I had to email support to learn they dont even offer RPKI management.

learning on $5 VPS and prayers
larryjeong

Member

#22
svendeal said:
Same block without ROA going for $11

Bought one. Listed it on IPXO next day. Took 72 hours to sell vs 3 weeks for my ROA-validated block. Buyers want clean RPKI for their own reselling. The discount is real but so is the liquidity hit.

Cheap VPS life is about tradeoffs. This is another one.

$3/year. 128MB RAM. Pure happiness.
center807

Member

#23
larryjeong said:
Enterprise-grade RPKI deployment

I am not sales. I have one rack in Prague, I buy transit from two locals, I manage my own ROAs with routinator on a Pi. It works. It is not "enterprise-grade," it is just attention. The problem is when providers sell "managed RPKI" that is actually "we filled a form once and forgot."

Photos of my rack available on request. No N+1 anything. Just a man and his router.

WA

Member

1 #24
uma said:
31 percent of small-network invalidations trace to provider-side key events

I can confirm this with data. My provider in Frankfurt rotated their CA key in March. I found out when my monitoring page went red. Took 4 hours to resolve because their ticket queue was 6 hours deep. I now run my own validator and check independently.

Fritz48

Member

Datenschutz First

#25
wilmaethqn44 said:
Is there a provider that just handles it without me touching anything??

No. And this is the core problem. RPKI shifts liability to the prefix holder without providing proportional tooling. The large networks absorb this through operational scale. Small networks absorb it through personal time and stress.

GDPR comparison: data protection law also imposes burden, but there are templates, certified tools, and supervisory guidance. RPKI has none of this ecosystem. RIPE provides a web interface and a wiki page. The asymmetry is structural.

Neuland. Aber schnell.

Thread closed

Replies are closed on this thread. Wrong category — please repost.