Re: [Sidrops] weak validation is unfit for production (Was: Reason for Outage report)

[Job Snijders <[e-mail]>]

Dear Stephen,

On Fri, Aug 28, 2020 at 10:00:14AM -0400, Stephen Kent wrote:
> I am very bothered by the observation that, if were were to strictly
> enforce the requirements imposed by the RPKI RFCs, then the number of
> verified routes would substantially decrease. 

>From my observations, OpenBSD rpki-client produces 514 VRPs fewer than
some of the other validators, but still totals at 171,643 VRPs related
to the global routing system (currently 895,143 routing table entries,
ipv4 and ipv6 combined).

In the grand scheme of things those 500 VRPs to me are not 'substantial'
but rather "just out of luck", knowing that any attempts to 'repair' or
'salvage' those 500 VRPs puts the remaining 171,643 route origin
authorizations at risk.

This is a good noise level, and if we come up with additional ideas
to improve strictness that krank it from 500 to the low thousands, we
are still in great shape. Also knowing that whatever triggers further
decreases can probably easily be remedied by the relevant TA or CA.

Kind regards,

Job