Re: [Sidrops] weak validation is unfit for production (Was: Reason for Outage report)

[Lukas Tribus <[e-mail]>]

Hello,


On Fri, 28 Aug 2020 at 16:00, Stephen Kent
<stkent=[e-mail]> wrote:
> I am very bothered by the observation that, if were were to strictly
> enforce the requirements imposed by the RPKI RFCs, then the number of
> verified routes would substantially decrease.

This I believe is at the core of the disagreement.

There is a faction that argues with points that sound a lot like "if
in doubt, consider the ROA valid, because we NEED to emit a VRP",
"CA's are too big to fail" and equivalents of "but if HTTPS fails,
people will just use HTTP so we end up being less secure" (as in
"better have a stale VRP than no VRP at all"). This is a mindset thing
and goes beyond the specific issue about manifest invalidation. For
example some RP's accept stale objects by default.

Err'ing on the side of caution seems to mean "consider the ROA valid,
so we emit the VRP" for some, which as a network operator I find
deeply troubling.

Let's be honest: there are not a lot of incentives for the CA's to fix
underlying issues if the 3 major RP's accept those ROA's.

Yes, sure, all of this is an oversimplification and the devil is in
the details, which do need clarification.


But we cannot be guided by a fear of decreasing VRP numbers when
improving validation. Immaggine if browsers would do that with WebPKI
(and that is actually causing direct outages for users, as opposed to
ROV where outages are more likely caused by the *presence* of VRPs
than by its absence).


-- lukas