Re: [Sidrops] 6486bis: Failed Fetches

[Jay Borkenhagen <[e-mail]>]

Steve,

Stephen Kent writes:
 > The crux of the issue is whether it is preferable to reject all objects 
 > at a pub point if an error is detected (until the error is rectified), 
 > and thus potentially treat many more routes as having an unknown 
 > verification status, or to accept bits and pieces of data from a pub 
 > point with the potential that some routes will be treated as valid, even 
 > if they are invalid. To me, that is a value judgement to be made by 
 > network operators, not by developers of RP software. [...]

No, there is a bit more to it than that.

I want my network's routers and those of all other networks to be fed
with VRPs that represent all the verified and legitimate published
origin-ASN intentions of verified, legitimate IP number resource
holders.

Clearly the challenge there is in determining "verified" and
"legitimate."  In creating the rules (to be documented in
standards-track RFCs) for those determinations, I would like the input
of all SIDROPS participants to be valued, including the input of the
RPKI designers, the CA- and RP-implementers, the RIRs, and the network
operators.

To my point: if RP-implementers feel that the "bits and pieces of
data" (to use your words) should be considered to best make those
determinations, such input should be welcomed; conversely, if
RP-implementers feel that strict publication rules and accompanying
strict handling of retrieved records together create the best way to
make those determinations, we all should listen to what they have to
say.

 > Experience with X.509 cert extensions suggests that the approach I noted 
 > is preferable. Saying that older RPs can ignore objects they don't 
 > understand introduces ambiguity in RP behavior, which is precisely the 
 > concern that motivated the effort to generate 6486bis.

Ambiguity is bad in any technical endeavor where precision is needed.
And we're here discussing this now because there was ambiguity in
rfc6486 (not assigning blame -- I missed it, too).  But I don't see
how it follows that if/when ASPA (for example) is standardized, that
older RPs should be required to throw away all records retrieved from
PPs whose MFTs now cite ASPA records.

Thanks.

						Jay B.