Re: [Sidrops] weak validation is unfit for production (Was: Reason for Outage report)

[Stephen Kent <[e-mail]>]

Job,
> Dear Stephen,
>
> On Fri, Aug 28, 2020 at 10:00:14AM -0400, Stephen Kent wrote:
>> I am very bothered by the observation that, if were were to strictly
>> enforce the requirements imposed by the RPKI RFCs, then the number of
>> verified routes would substantially decrease.
You didn't copy the rest of my message, in which I indicated that I felt 
we were worrying too much about the bad PR associated with having fewer 
routes verified, as a side effect of adopting stricter rules wrt 
manifest processing.
> >From my observations, OpenBSD rpki-client produces 514 VRPs fewer than
> some of the other validators, but still totals at 171,643 VRPs related
> to the global routing system (currently 895,143 routing table entries,
> ipv4 and ipv6 combined).
>
> In the grand scheme of things those 500 VRPs to me are not 'substantial'
> but rather "just out of luck", knowing that any attempts to 'repair' or
> 'salvage' those 500 VRPs puts the remaining 171,643 route origin
> authorizations at risk.
>
> This is a good noise level, and if we come up with additional ideas
> to improve strictness that krank it from 500 to the low thousands, we
> are still in great shape. Also knowing that whatever triggers further
> decreases can probably easily be remedied by the relevant TA or CA.

I agree with your point.

Steve