<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><blockquote type="cite" class=""><div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">"Roland Dobbins" <<a href="mailto:rdobbins@arbor.net" class="">rdobbins@arbor.net</a>><br class=""></span></div><div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class=""><b class="">Re: [AusNOG] MANRS Project - Fixing the Internet's routing security is urgent and requires collaboration</b><br class=""></span></div><div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">29 February 2016 4:40:20 pm AEDT<br class=""></span></div><div style="margin: 0px;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">"<a href="mailto:ausnog@ausnog.net" class="">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net" class="">ausnog@lists.ausnog.net</a>><br class=""></span></div><br class=""><br class="">On 29 Feb 2016, at 12:33, Mark Andrews wrote:<br class=""><br class=""><blockquote type="cite" class="">So 16 years is not enough time for them to do the right thing?<br class=""></blockquote><br class="">Ignorance and apathy are the key reasons we don't have near-universal source-address validation. I'm not apologizing for anyone - you know very well that I advocate for implementing source-address validation, as you've seen/heard me talk about it many times before.<br class=""><br class="">My point is that we're in the situation we're in, and not in some idealized situation, and it's important to understand that we can't wave a magic wand and make this happen overnight. Access networks are the logical places to implement source-address validation by default, as they're the points in the network where it's least likely to cause operational problems and where the requisite features are available on most major hardware platforms.<br class=""><br class="">-----------------------------------<br class="">Roland Dobbins <<a href="mailto:rdobbins@arbor.net" class="">rdobbins@arbor.net</a>><br class=""><br class=""></blockquote><div class=""><br class=""></div>While it may have taken some time for the equipment to support source-address-validation, at least from the statistics quoted, the situation is getting better<div class="">(more providers implementing checks). </div><div class=""><br class=""></div><div class="">I wonder what could be said of the number of ISP’s using a registry to validate their customer’s (not peers) routing announcements? Ignorance and apathy</div><div class="">have played an even larger role in route-hijacks (intentional or otherwise). We’ve had the solution forever (validate your customer’s announcements) but </div><div class="">it would seem that few ISP’s implement it anymore.</div><div class=""><br class=""></div><div class="">I haven’t yet read the MANRS docs (I will) but it would seem that a system that ranks the accuracy of routing announcements per ISP based on their method</div><div class="">of accepting and propagating updates would be really useful. If you run a completely clean system, keep your customers from announcing garbage, you get</div><div class="">a good rating and everyone trusts your updates. If your customers are prone to announcing portions of the YouTube address space and you blithely pass it to</div><div class="">the world, not so much.</div><div class=""><br class=""></div><div class="">All we’d need is a knob to turn based on that measure of accuracy… Dampening is too big a stick, and to implement it in this way might be catastrophic, number </div><div class="">of prefixes to accept over time, smaller stick, maybe less consequences… correlation? </div><div class=""><br class=""></div><div class="">If I think your routes are suspect perhaps I don’t accept an announcement from you until I hear it from someplace else? or from some ISP I trust? </div><div class=""><br class=""></div><div class="">just a thought (after hearing people complain about route hijacks during Apricot — took me way back)</div></body></html>