Re: [Sidrops] weak validation is unfit for production (Was: Reason for Outage report)

[Stephen Kent <[e-mail]>]

Tim,
> ...
>
> @b: the robustness principle and security

Jon Postel's robustness principle is appropriate for promoting 
interoperability, but it is not a good principle for security. Security 
requires discipline. In my experience, people are not very disciplined, 
and thus we have recurring security problems. Experience shows that 
without feedback, people are not motivated to become more disciplined, 
and security problems become worse. Thus I feel is is critical for the 
community to reject RPKI repository data that does not conform to the 
RFCs, as a way of providing feedback and improving discipline.

The revisions we have made to the manifest RFC are intended to remove 
ambiguity and to impose strict standards for how CAs manage the data at 
a pub point. We all seemed to agree that removing ambiguity is desirable 
and necessary, but not everyone seems to believe that strict standards 
are desirable. I defer to the WG chairs to decide what the consensus 
position is in this respect. However, at this time, suggesting that the 
manifest RFC needs to specify how new objects can be incrementally be 
introduced into the repository system is a distraction. I can envision 
one way to do that, as noted in a prior message, but that would entail 
changes to several other RFCs, and will delay, substantially, progress 
on revisions to the manifest RFC.

I am very bothered by the observation that, if were were to strictly 
enforce the requirements imposed by the RPKI RFCs, then the number of 
verified routes would substantially decrease. This seems to suggest that 
it is more important to be able to cite big numbers of verified routes, 
to convey a sense of RPKI deployment success,  than to "encourage" CAs 
to get their act together and follow the standards. That, I believe, is 
a mistake.

Steve