Re: [Sidrops] what to do when the CRL is hosed?

[Christopher Morrow <[e-mail]>]

On Tue, Feb 25, 2020 at 7:24 PM George Michaelson <[e-mail]> wrote:

> If you cannot see a CRL which you are told should exist, to assume the

This wasn't missing CRL, but an invalid one, right?
Does that change your mind on how you'd manage this sort of problem from
the (network) operations side of things?

> CRL doesn't matter feels extremely unwise. I may have mistakenly
> published entirely cryptographically valid things which do not now
> inform my intent, and I have tried to repudiate, and you cannot see
> that repudiation and now interpret states of routing in ways which do
> not reflect my true intent.

So, to bypass the CRL (in all cases) seems bad, sure.
To bypass it (or enable a bypass) in cases like this (clearly some mistake
let us get to this discussion) in order to keep routing packets 'properly' (ha!)
doesn't seem like a total disgrace.

If the CRL mistake is a the RIR publication point/top-of-tree it certainly
seems a bunch more important to fix the problem 'quickly', however, I'm
not sure 'quickly' is much more than the experienced 8hrs this time given
some default numbers in validator code bases, right?