8 ms·

US Government Sets Out to Improve Internet Routing Security

41 points by marsh_mellow 2y ago

postepowanieadm 2y ago
[flagged]
diggan 2y ago
How hard/cumbersome is it for a individual/small group to implement RPKI for their ASN? I'm guessing it would involve some sort of collaboration with your LIR?
- zajio1am 2y ago
  in Europe, it is like few clicks in RIPE web portal. (I mean to generate and publish own RPKI records.)
majke 2y ago
https://blog.cloudflare.com/white-house-routing-security/ https://blog.cloudflare.com/white-house-routing-security/ > Unfortunately, the US is lagging behind: Only 39% of IP prefixes originated by US networks have a valid ROA
- icedchai 2y ago
  It would be helpful if ROAs were allowed for legacy prefixes, without having to sign an RSA or other agreement w/ARIN. I have a /24 ("class C" from the 90's) that I route. I have hesitant to start pay for something I got for free. I think many organizations that were on the early Internet are also in a similar position.
  - voidwtf 2y ago
    We're in the same boat. We have two /24 (/23) that we advertise through our ISP(s) and we've been hesitant to sign an LSA/RSA because it seems to put us in a position where we may be held to standard and fees that we weren't previously held to. If there was an easy and straightforward path to onboarding that would go a long way, but every time we look into it the process seems convoluted and unclear with too many options and potential foot guns.
    - icedchai 2y ago
      Yep, I have also looked into it and agree it is confusing. I own this /24 as an individual and use it for hobbyist purposes, so try to keep expenses to a minimum. I got my ASN through a RIPE LIR, so it is separate from my ARIN legacy account. My understanding is I could transfer the /24 to RIPE but haven't looked into that much.
zokier 2y ago
Previously: https://news.ycombinator.com/item?id=40487419 https://news.ycombinator.com/item?id=40487419 Is regulated BGP security coming? (apnic.net) 123 points by superkuh 3 months ago | hide | past | favorite | 118 comments
ChrisArchitect 2y ago
Official WH release: https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/press-release-white-house-office-of-the-national-cyber-director-releases-roadmap-to-enhance-internet-routing-security/ https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/pre...

41 points by marsh_mellow 2y ago

[flagged]

How hard/cumbersome is it for a individual/small group to implement RPKI for their ASN? I'm guessing it would involve some sort of collaboration with your LIR?

zajio1am 2y ago
in Europe, it is like few clicks in RIPE web portal. (I mean to generate and publish own RPKI records.)

majke 2y ago

https://blog.cloudflare.com/white-house-routing-security/ https://blog.cloudflare.com/white-house-routing-security/ > Unfortunately, the US is lagging behind: Only 39% of IP prefixes originated by US networks have a valid ROA

icedchai 2y ago
It would be helpful if ROAs were allowed for legacy prefixes, without having to sign an RSA or other agreement w/ARIN. I have a /24 ("class C" from the 90's) that I route. I have hesitant to start pay for something I got for free. I think many organizations that were on the early Internet are also in a similar position.
- voidwtf 2y ago
  We're in the same boat. We have two /24 (/23) that we advertise through our ISP(s) and we've been hesitant to sign an LSA/RSA because it seems to put us in a position where we may be held to standard and fees that we weren't previously held to. If there was an easy and straightforward path to onboarding that would go a long way, but every time we look into it the process seems convoluted and unclear with too many options and potential foot guns.
  - icedchai 2y ago
    Yep, I have also looked into it and agree it is confusing. I own this /24 as an individual and use it for hobbyist purposes, so try to keep expenses to a minimum. I got my ASN through a RIPE LIR, so it is separate from my ARIN legacy account. My understanding is I could transfer the /24 to RIPE but haven't looked into that much.

zokier 2y ago

Previously: https://news.ycombinator.com/item?id=40487419 https://news.ycombinator.com/item?id=40487419 Is regulated BGP security coming? (apnic.net) 123 points by superkuh 3 months ago | hide | past | favorite | 118 comments

ChrisArchitect 2y ago

Official WH release: https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/press-release-white-house-office-of-the-national-cyber-director-releases-roadmap-to-enhance-internet-routing-security/ https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/pre...