183 pointsby emot12 hours ago7 comments
  • phatfish2 hours ago
    I love wading through LLM prose!

    I know its a tired point, but why not publish the bullet points that were the source for this text as well. I'd rather read those.

    Getting another LLM to summarise back to something concise just seems wrong.

    • N_Lens22 minutes ago
      The bar is in hell.
  • cowlevel12 hours ago
    My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database.
    • gizmo68611 hours ago
      Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.

      Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).

      This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.

      • ronsor7 hours ago
        > should they choose to exercise it

        Until other networks choose to exorcise them and their control with it. If you play unfairly often enough, you get depeered.

    • bojan6 hours ago
      The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future, but the actual reason is that the Russian influence found a fertile ground in the NL, with about a third of the votes going to pro-Russian parties and with the destruction of MH17 basically gone from the public discourse.
      • c166 hours ago
        > The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future

        Would you stand by this statement if we did s/Netherlands/United States/g ?

        It's not about the governments of today, but those of the future.

        • bojan6 hours ago
          Yes.

          There is imho very little to gain from such a move, and potentially a lot to lose. Disconnecting a whole society in such a way would make the total government control even easier.

          Edit: typo

          • cowlevel4 hours ago
            The USA has gone ahead and done it anyway. We shouldn't trust any government with that much power.
      • f6v5 hours ago
        > but the actual reason is that the Russian influence found a fertile ground in the NL

        Are they stupid and can't think for themselves? The Netherlands have strong democratic tradition and great public education system. Why would they be influenced by a foreign government? I always find it amusing.

        • cowlevel4 hours ago
          Social media
          • f6v3 hours ago
            Definitely not an answer to my question.
            • rbn33 hours ago
              most definitely the answer to your question. look at the role media played in the cold war and all the efforts both sides took to influence and sway people on the enemy's side of the iron curtain. now multiply that by 10 and you have today's media environment.
            • graemep3 hours ago
              Social media enables greater foreign influence.

              It also enables the spreading of fears of greater foreign influence and much else.

              It generally gives you a very distorted view of the world.

              • f6v2 hours ago
                It's a bunch of statements that need good evidence behind them. I'm not sure why you're ignoring what I said before: the Netherlands have great public education system and strong democratic tradition. The effectiveness of any foreign influence on political life should be studied. AFAIK, it's still a matter of debate.

                Idk why you think knee-jerking "social media" adds any substance.

                • graemepan hour ago
                  > I'm not sure why you're ignoring what I said before: the Netherlands have great public education system and strong democratic tradition.

                  I am not ignoring it, I am agreeing with it.

                  > The effectiveness of any foreign influence on political life should be studied. AFAIK, it's still a matter of debate.

                  Agreed it needs more studying, but social media does does have influence, and its a reasonable assumption that that influence can be manipulated. It does definitely influence people who spend a lot of time on social media - they are very prone to believe conspiracy theories for example.

                  How effectively such manipulation can be varies and itself becomes a political issue. The PM of the UK recently implied that the Brexit vote was swayed by the Russians but was swiftly shot down (by members his own cabinet and the head of the internal intelligence service among others.).

                  > It's a bunch of statements that need good evidence behind them.

                  Not every opinion needs a set of citations.

        • mschuster912 hours ago
          > The Netherlands have strong democratic tradition and great public education system.

          Unfortunately, for the same reason that Russian influence found fertile ground in the US (MAGA), France (both le Pen and Melenchon), Germany (AfD and BSW), Italy (Berlusconi, Salvini), Hungary (Orban/Fidesz), Poland (PiS), Slovakia (Fico), the UK (UKIP, Reform, and relating to Brexit, the Tories)...

          Unchecked globalization has led to serious economic devastation, and Russian propaganda picked that up and blamed it all on immigrants, and added a bunch of LGBT hate on top because that serves as a decent wedge issue for a group of the population that the anti-immigrant stuff doesn't catch that much. And on top of that, they made the immigration issue so much worse - Libya, Syria, Afghanistan and Iran all have Russia's bloody fingerprints all over them.

          And as we're seeing, even the best democratic tradition doesn't stand a chance against economic misfortune.

          • BoxOfRainan hour ago
            > And as we're seeing, even the best democratic tradition doesn't stand a chance against economic misfortune.

            This fact is why I think regardless of governing ideology, it's in the interests of any government to not write off wide-spread destitution and inequality as merely the cost of participating in a global economy. Even the Romans two thousand years before us understood all regimes require their bread and circuses, and the first one is the more important of the two.

            As a Briton it's a particularly frustrating time to live here. We have wasted the 'peace dividend' on luxury policies like giving incumbent homeowners massive regulatory power to constrain the housing supply with lots of harmful knock-on effects, putting economic stupidity like Brexit to a constitution-breaking and divisive referendum, and harmfully constraining the energy supply by letting every self-interested QUANGO and NIMBY block renewable/nuclear power and the associated infrastructure. We spent more on the paperwork before a single shovel entered the ground on a tunnel under the Thames than Norway did building the longest road tunnel in the world. We cannot continue enacting nonsense policies like this and expecting everyone to muddle through as things get bleaker and bleaker, it'll come to a head one day and when it does it'll be destabilising.

            Economic prosperity, or at the very least not having lost decade after lost decade, is necessary to avoid more authoritarian forms of politics coming to power.

            • graemepan hour ago
              You just demonstrated a big problem with our politics. People lining up with their side on every issue. I think most of what you say is reasonable (although you are missing nuance on some things) but then you call Brexit it stupid and "constitution-breaking". Obviously the majority who voted for it disagreed, and being in the EU without having had a referendum (unlike most countries - France, Ireland and others did, Iceland just did too) was itself divisive. There is not rational reason to call it stupid. The predictions of economic disaster (e.g. the pre Brexit treasury forecast) did not materialise and the economy is doing about as well as comparable EU economies.
            • RobotToaster39 minutes ago
              > constitution-breaking and divisive referendum

              What part of the constitution does a referrendum break? One of the main principles of British constitutional law is that Parliament is supreme.

          • bojan2 hours ago
            While I agree with your point, I don't agree that the unchecked globalisation is to blame, rather unchecked capitalism. Even without globalisation unchecked capitalism would lead to the same result, only per country.

            And the countries that did the work to rein capitalism in, in a proper way, are doing well, also in the circumstances of globalisation.

            • RobotToaster35 minutes ago
              Arguably they are inseperable.

              Unchecked globalism leads to unchecked capitalism as it creates a race to the bottom. Unchecked capitalism leads to unchecked globalism as it continuously seeks to lower wages.

          • lormayna2 hours ago
            > Italy (Berlusconi, Salvini)

            As Italian, I would say that the most pro Russia party are M5S (Conte even invited Russian soldiers to help us against COVID) and Futuro Nazionale (Vannacci). Even AVS and part of the PD are "pro-peace", AKA pro-Russia.

            Salvini said that he is pro Putin, but Legal voted to send weapons to Ukraine.

      • asdfsa326 hours ago
        Could this be that having to buy Russia oil from US isn't good for the people of Netherlands for example?
        • bojan6 hours ago
          The fact that you're mentioning oil and not gas tells me you are not really familiar with the situation.

          But no, getting yourself in a situation where you're dependent on cowboy regimes for critical resources is not good for the people.

    • gucci-on-fleek7 hours ago
      If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this.

      Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this couldn't be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia or AWS.

      [0]: https://blog.cloudflare.com/de-tld-outage-dnssec/

      • cowlevel4 hours ago
        And Russia's peers and the rest of the wider internet? It doesn't matter what rostelekom does if Comcast feels that all routes originating from rostelekom are invalid, and doesn't propagate them. And that's not even a tier 1.
        • gucci-on-fleek3 hours ago
          If Comcast's customers (big corporate ones, they don't care about regular people) complain, then Comcast would probably override the RPKI validation too. Well, unless they're somehow legally precluded from doing so, but in that case RPKI hardly matters since they couldn't peer with them even if their routes were valid.
          • cowlevelan hour ago
            They'd be connected to a non-sanctioned network that was connected directly or indirectly to rostelekom. For instance maybe Arelion, which is Swedish. The internet isn't yet in the situation of the financial system where the whole world obeys US rules out of fear.
    • maxclark11 hours ago
      RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.
    • mzajc11 hours ago
      I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.
      • esseph8 hours ago
        > would achieve nothing outside of creating a splinternet.

        With the growing threat profiles and potential damage, I wonder the cost calculations being made behind closed doors right now of both governments and companies about that very possibility.

        A lot of companies already block traffic by country of origin and have since they existed on the internet.

        • alightsoul7 hours ago
          >A lot of companies already block traffic by country of origin and have since they existed on the internet.

          Is this an American thing? For example the home Depot and velera do it.

          • esseph16 minutes ago
            I've seen network operators talk about it from all over the world.

            If Sarah owns a gardening center and sells stuff locally, why does her business need to accept connections to her website or network from a foreign country? For her given the attack risk, it makes much more sense to block non-local traffic.

      • avazhi7 hours ago
        If it’s so simple to do I’m not sure why the west hasn’t already done it vis a vis Russia and China. Spam and scams would drop precipitously instantly.
    • sandeepkd6 hours ago
      I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.
    • ggm11 hours ago
      So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.

      Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?

      The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.

      • adastra2211 hours ago
        The internet is supposed to be a decentralized network.
        • yndoendo11 hours ago
          When ISPs have so much control, I don't see it as decentralized.

          It is designed for fallbacks or ability to reroute when connections become congested or get cut.

          Real world decentralized communication would not require an ISP and could operate by proxy with multi modes of communication. This way you can circumvent Government restrictions.

          Sneaker net is decentralized and how North Koreans circumvent their government.

          • cowlevel4 hours ago
            It is already like you say it should be.
      • daishi5511 hours ago
        I don’t think that one country should get to unilaterally decide whether another country gets internet, no.
      • asdf889909 hours ago
        You do understand that the hypothetical threat actor here is one who openly disregards international law?

        https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be...

        https://www.reuters.com/world/us-imposes-sanctions-internati...

      • kortilla11 hours ago
        >Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?

        Yes. It was the vision of the internet to continue on outside of the whatever political whims some tiny slice of western governments.

        It’s just too ripe for abuse.

        You can make whatever “whatabout” arguments on DNS, etc but none of those are required to get connectivity (DHT, p2p hosts, tor names, etc).

        Any centralization around the narrow middle IP layer of the internet should be treated with extreme skepticism and pushback.

      • yipinwong11 hours ago
        This is what happens when someone wants to regulate the crap outta everything. what a dumb ass take.
        • jeremyjh10 hours ago
          Regulate the crap out of invading a peaceful neighboring country ? I’m down for it.
          • cowlevelan hour ago
            You want the USA to be sanctioned and banned from the internet?
          • 8 hours ago
            undefined
          • yipinwong8 hours ago
            track @jeremyjh
    • greyface-9 hours ago
      There's no reason an independent entity couldn't spin up a new trust anchor, as long as they get RPs to follow it. If a government started meddling with an RIR's RPKI database, that would provide a pretty good set of incentives for an AltDB-but-for-RPKI TA to gain adoption. Even in the absence of meddling, this would be useful for legacy IPv4 holders, who currently don't have a way to participate in RPKI.
    • bawolff7 hours ago
      Well if that happens, operators will be forced to make a choice - comply with it, or stop using rpki.

      Having a system like this is like signing an agreement. Its only worth anything so long as people decide to respect it. If operators overplay their hand, people might stop respecting it.

      • cowlevel4 hours ago
        Why would western operators turn off rpki validation of this happened?
    • aftbit11 hours ago
      Certificate revocation as an act of war... the 2030s are gonna be wild.
      • teraflop10 hours ago
        I'm reminded of Vernor Vinge's novel Rainbows End, which is set in 2025. It features a cyberattack against a rogue AI, which involves revoking a root CA certificate belonging to Credit Suisse, causing massive collateral damage to the European economy and infrastructure.

        Vinge didn't quite get to see his rogue AI prediction become (sort of) reality, right on schedule, but he did at least outlive Credit Suisse.

      • usrnm8 hours ago
        It's already happening, you cannot access the websites of many sanctioned Russian entities without trusting a Russia-issued root CA. The fragmentation of the Internet is already in motion
    • 9 hours ago
      undefined
    • gigatexal7 hours ago
      Swap Russia for any other country and …

      But … cutting off Russia wouldn’t be such a bad thing.

      • cowlevelan hour ago
        Russia is one of the only remaining places you can host things banned in the US.
    • stouset11 hours ago
      I get your broader point, but making it potentially easier to cut Russia specifically off from the Internet might not be the worst thing in the world.
    • avazhi7 hours ago
      > By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access

      And nothing of value would be lost. Quite the opposite in fact.

    • emot4 hours ago
      [dead]
  • 1473-bytes10 hours ago
    A couple years ago our org made a big push to have our routes and our downstream customer routes RPKI valid. It's good to see the high adoption rate. It looks like ASPA is now available for ASN path validation. Probably should look at adopting ASPA at some point here.
    • emot4 hours ago
      Agreed, the post has a section on it: networks publishing ASPA records went from 131 to 3,272 in a year, mostly as each registry shipped signing tools. Still early, though. So far published records can verify about 3.5% of observed routing.
  • est10 hours ago
    so is there a public service that can verify some IP block belongs to which country/cert?

    whois is so deprecated.

  • 3 hours ago
    undefined
  • 0xbadcafebee9 hours ago
    > Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses.

    Interesting. China may have predicted cyber attacks in the near future. Or perhaps are readying for retaliation. It's possible their military or intelligence branches didn't anticipate this getting published. (Unless somebody knows if this year just happened to be when they decided to implement cyber reforms?)

    Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.

    • cowlevelan hour ago
      Or they just issued some order that ISPs must use RPKI the way USA has one for IPv6
    • jurgenburgen7 hours ago
      > Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.

      Why are you allowing your LLM to consume instructions controlled by a third party? Sounds like a recipe for disaster.

  • innovayse8 hours ago
    Does the data show how RPKI adoption varies across countries in the Caucasus and former Soviet Union? I’d be curious to see how Armenia and its neighboring countries compare.
    • emot4 hours ago
      [dead]