My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database.
Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.
Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).
This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.
If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this.
Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this couldn't be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia or AWS.
And Russia's peers and the rest of the wider internet? It doesn't matter what rostelekom does if Comcast feels that all routes originating from rostelekom are invalid, and doesn't propagate them. And that's not even a tier 1.
The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future, but the actual reason is that the Russian influence found a fertile ground in the NL, with about a third of the votes going to pro-Russian parties and with the destruction of MH17 basically gone from the public discourse.
> but the actual reason is that the Russian influence found a fertile ground in the NL
Are they stupid and can't think for themselves? The Netherlands have strong democratic tradition and great public education system. Why would they be influenced by a foreign government? I always find it amusing.
RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.
I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.
> would achieve nothing outside of creating a splinternet.
With the growing threat profiles and potential damage, I wonder the cost calculations being made behind closed doors right now of both governments and companies about that very possibility.
A lot of companies already block traffic by country of origin and have since they existed on the internet.
If it’s so simple to do I’m not sure why the west hasn’t already done it vis a vis Russia and China. Spam and scams would drop precipitously instantly.
So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.
Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?
The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.
>Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?
Yes. It was the vision of the internet to continue on outside of the whatever political whims some tiny slice of western governments.
It’s just too ripe for abuse.
You can make whatever “whatabout” arguments on DNS, etc but none of those are required to get connectivity (DHT, p2p hosts, tor names, etc).
Any centralization around the narrow middle IP layer of the internet should be treated with extreme skepticism and pushback.
IP address space and the domain name system are centralized with defined roots, and IANA/RIPE could have removed russia from the internet a long time ago. A primary reason why they have not done this is what happen after the war is over, at which point the west would have Internet with root A, and Russia would have Internet with root B, and recombining A and B would be a very difficult and likely to last longer than transitioning completely from IPv4 to IPv6.
If there is a central and core theme with the Internet and all the organizations that manage the core infrastructure is the effort to avoid splitting the root.
I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.
I'm reminded of Vernor Vinge's novel Rainbows End, which is set in 2025. It features a cyberattack against a rogue AI, which involves revoking a root CA certificate belonging to Credit Suisse, causing massive collateral damage to the European economy and infrastructure.
Vinge didn't quite get to see his rogue AI prediction become (sort of) reality, right on schedule, but he did at least outlive Credit Suisse.
It's already happening, you cannot access the websites of many sanctioned Russian entities without trusting a Russia-issued root CA. The fragmentation of the Internet is already in motion
There's no reason an independent entity couldn't spin up a new trust anchor, as long as they get RPs to follow it. If a government started meddling with an RIR's RPKI database, that would provide a pretty good set of incentives for an AltDB-but-for-RPKI TA to gain adoption. Even in the absence of meddling, this would be useful for legacy IPv4 holders, who currently don't have a way to participate in RPKI.
Well if that happens, operators will be forced to make a choice - comply with it, or stop using rpki.
Having a system like this is like signing an agreement. Its only worth anything so long as people decide to respect it. If operators overplay their hand, people might stop respecting it.
> By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access
Yes, and? This would be a boon for the rest of the world.
I work for IPinfo but my colleague is the author. It is very interesting challenge to "translate" vast amounts of data we have into stories that are insightful.
So, what we have been doing recently is publishing a blog and a companion dashboard. Check it out here:
Now, that is a good approach for high-impact data to build a dashboard and have a companion piece that only provides surface-level information, so it keeps things interesting and invites you to explore.
But building the dashboards is not an easy task, as you have to deal with data pipelines and work with engineering teams to bring them online.
I am absolutely not being demeaning at all, but just look at the graphics and diagram and skip the text. I think the graphics are a pretty solid explainer of what the article is about. The text dives more into granular information that you may not find useful if you want skimmable content.
A couple years ago our org made a big push to have our routes and our downstream customer routes RPKI valid. It's good to see the high adoption rate. It looks like ASPA is now available for ASN path validation. Probably should look at adopting ASPA at some point here.
Agreed, the post has a section on it: networks publishing ASPA records went from 131 to 3,272 in a year, mostly as each registry shipped signing tools. Still early, though. So far published records can verify about 3.5% of observed routing.
I ”blame” <https://internet.nl/>. At some point a few years back, they started only giving 100% to an address if it also had RPKI. A shareable link with large clear text, with a numerical score that is lower than your competitors? And your competitors are sharing this link to your customers, trying to win them over? This stuff works wonders for executives; suddenly there is no higher priority than fixing RPKI.
> Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses.
Interesting. China may have predicted cyber attacks in the near future. Or perhaps are readying for retaliation. It's possible their military or intelligence branches didn't anticipate this getting published. (Unless somebody knows if this year just happened to be when they decided to implement cyber reforms?)
Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.
We could have done something similar here as well. It is really challenging to balance the stats and explainers. So, the approach we sometimes take with high-impact topics is to provide companion blogs and dashboards for users to explore the data themselves.
> Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.
Why are you allowing your LLM to consume instructions controlled by a third party? Sounds like a recipe for disaster.
We have the data. How would you like us to present it? (Bonus point if you can tell me why that will be helpful because that will help me to make a better pitch to engineering!)
I'm always fascinated by how the internet keeps getting better, step by step. RPKI is a good example ! I wonder what "RPKI" would be needed for the AI-agent-gone-rogue age
I work for IPinfo. We really would appreciate more constructive feedback on how to present data driven stories that is approachable to everyone.
> I stopped reading after the first graphic.
Now, let's see what we had before the first graphic.
1st Paragraph: Explains what BGP is.
2nd Paragraph: Tells a story about the Pakistani ASN accidental BGP hijack. A story which is known in the network engineering community, but not by most people.
3rd Paragraph: Introduces RPKI.
4th Paragraph: Summary states that builds the foundation of the article.
Then the first graphic shows the RPKI validation. That is all.
How would you structure the blog post about RPKI adoption, which is a data-driven technical story? I am not absolutely trying to be demeaning, but would you rather start from what BGP, RPKI, and those things are?
Then we have a series of community post around them:
Why do people feel the need to announce that they stopped reading?
Hey guys! I know there are many comments on this forum. Stopped reading this particular comment four words in. I knew the rest sucked & just wanted you to know that
Does the data show how RPKI adoption varies across countries in the Caucasus and former Soviet Union? I’d be curious to see how Armenia and its neighboring countries compare.
My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database.
Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.
Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).
This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.
> should they choose to exercise it
Until other networks choose to exorcise them and their control with it. If you play unfairly often enough, you get depeered.
If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this.
Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this couldn't be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia or AWS.
[0]: https://blog.cloudflare.com/de-tld-outage-dnssec/
And Russia's peers and the rest of the wider internet? It doesn't matter what rostelekom does if Comcast feels that all routes originating from rostelekom are invalid, and doesn't propagate them. And that's not even a tier 1.
2 replies →
The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future, but the actual reason is that the Russian influence found a fertile ground in the NL, with about a third of the votes going to pro-Russian parties and with the destruction of MH17 basically gone from the public discourse.
> but the actual reason is that the Russian influence found a fertile ground in the NL
Are they stupid and can't think for themselves? The Netherlands have strong democratic tradition and great public education system. Why would they be influenced by a foreign government? I always find it amusing.
17 replies →
> The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future
Would you stand by this statement if we did s/Netherlands/United States/g ?
It's not about the governments of today, but those of the future.
2 replies →
Could this be that having to buy Russia oil from US isn't good for the people of Netherlands for example?
5 replies →
RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.
I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.
> would achieve nothing outside of creating a splinternet.
With the growing threat profiles and potential damage, I wonder the cost calculations being made behind closed doors right now of both governments and companies about that very possibility.
A lot of companies already block traffic by country of origin and have since they existed on the internet.
8 replies →
If it’s so simple to do I’m not sure why the west hasn’t already done it vis a vis Russia and China. Spam and scams would drop precipitously instantly.
4 replies →
So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.
Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?
The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.
The internet is supposed to be a decentralized network.
5 replies →
I don’t think that one country should get to unilaterally decide whether another country gets internet, no.
3 replies →
You do understand that the hypothetical threat actor here is one who openly disregards international law?
https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be...
https://www.reuters.com/world/us-imposes-sanctions-internati...
>Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?
Yes. It was the vision of the internet to continue on outside of the whatever political whims some tiny slice of western governments.
It’s just too ripe for abuse.
You can make whatever “whatabout” arguments on DNS, etc but none of those are required to get connectivity (DHT, p2p hosts, tor names, etc).
Any centralization around the narrow middle IP layer of the internet should be treated with extreme skepticism and pushback.
This is what happens when someone wants to regulate the crap outta everything. what a dumb ass take.
5 replies →
IP address space and the domain name system are centralized with defined roots, and IANA/RIPE could have removed russia from the internet a long time ago. A primary reason why they have not done this is what happen after the war is over, at which point the west would have Internet with root A, and Russia would have Internet with root B, and recombining A and B would be a very difficult and likely to last longer than transitioning completely from IPv4 to IPv6.
If there is a central and core theme with the Internet and all the organizations that manage the core infrastructure is the effort to avoid splitting the root.
I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.
Swap Russia for any other country and …
But … cutting off Russia wouldn’t be such a bad thing.
Russia is one of the only remaining places you can host things banned in the US.
2 replies →
Certificate revocation as an act of war... the 2030s are gonna be wild.
I'm reminded of Vernor Vinge's novel Rainbows End, which is set in 2025. It features a cyberattack against a rogue AI, which involves revoking a root CA certificate belonging to Credit Suisse, causing massive collateral damage to the European economy and infrastructure.
Vinge didn't quite get to see his rogue AI prediction become (sort of) reality, right on schedule, but he did at least outlive Credit Suisse.
It's already happening, you cannot access the websites of many sanctioned Russian entities without trusting a Russia-issued root CA. The fragmentation of the Internet is already in motion
There's no reason an independent entity couldn't spin up a new trust anchor, as long as they get RPs to follow it. If a government started meddling with an RIR's RPKI database, that would provide a pretty good set of incentives for an AltDB-but-for-RPKI TA to gain adoption. Even in the absence of meddling, this would be useful for legacy IPv4 holders, who currently don't have a way to participate in RPKI.
As a legacy IPv4 holder for over 30 years, I realize I'm going to be forced to pay ARIN at some point. It's been a good run though.
2 replies →
Well if that happens, operators will be forced to make a choice - comply with it, or stop using rpki.
Having a system like this is like signing an agreement. Its only worth anything so long as people decide to respect it. If operators overplay their hand, people might stop respecting it.
Why would western operators turn off rpki validation of this happened?
1 reply →
Or they could order Western telecoms to depeer with Russian ones. That would be even more effective.
I get your broader point, but making it potentially easier to cut Russia specifically off from the Internet might not be the worst thing in the world.
> By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access
Yes, and? This would be a boon for the rest of the world.
[dead]
[flagged]
I love wading through LLM prose!
I know its a tired point, but why not publish the bullet points that were the source for this text as well. I'd rather read those.
Getting another LLM to summarise back to something concise just seems wrong.
I work for IPinfo but my colleague is the author. It is very interesting challenge to "translate" vast amounts of data we have into stories that are insightful.
So, what we have been doing recently is publishing a blog and a companion dashboard. Check it out here:
Now, that is a good approach for high-impact data to build a dashboard and have a companion piece that only provides surface-level information, so it keeps things interesting and invites you to explore.
But building the dashboards is not an easy task, as you have to deal with data pipelines and work with engineering teams to bring them online.
I am absolutely not being demeaning at all, but just look at the graphics and diagram and skip the text. I think the graphics are a pretty solid explainer of what the article is about. The text dives more into granular information that you may not find useful if you want skimmable content.
The bar is in hell.
A couple years ago our org made a big push to have our routes and our downstream customer routes RPKI valid. It's good to see the high adoption rate. It looks like ASPA is now available for ASN path validation. Probably should look at adopting ASPA at some point here.
Agreed, the post has a section on it: networks publishing ASPA records went from 131 to 3,272 in a year, mostly as each registry shipped signing tools. Still early, though. So far published records can verify about 3.5% of observed routing.
I ”blame” <https://internet.nl/>. At some point a few years back, they started only giving 100% to an address if it also had RPKI. A shareable link with large clear text, with a numerical score that is lower than your competitors? And your competitors are sharing this link to your customers, trying to win them over? This stuff works wonders for executives; suddenly there is no higher priority than fixing RPKI.
> At some point a few years back
Turns out it was on January 28, 2025 – 20 months ago: <https://internet.nl/article/release-1.9/>
> Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses.
Interesting. China may have predicted cyber attacks in the near future. Or perhaps are readying for retaliation. It's possible their military or intelligence branches didn't anticipate this getting published. (Unless somebody knows if this year just happened to be when they decided to implement cyber reforms?)
Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.
I work for IPinfo (but not the author here). We really appreciate the feedback!
So, what we have been doing is we publish a blog and we publish an interactive dashboard as well
We could have done something similar here as well. It is really challenging to balance the stats and explainers. So, the approach we sometimes take with high-impact topics is to provide companion blogs and dashboards for users to explore the data themselves.
Or they just issued some order that ISPs must use RPKI the way USA has one for IPv6
> Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.
Why are you allowing your LLM to consume instructions controlled by a third party? Sounds like a recipe for disaster.
so is there a public service that can verify some IP block belongs to which country/cert?
whois is so deprecated.
We have country level breakdown for ASNs.
We have some IP range breakdown as well:
We have the data. How would you like us to present it? (Bonus point if you can tell me why that will be helpful because that will help me to make a better pitch to engineering!)
https://ipinfo.io/ips/1.1.1.0/24
How do you deal with anycast?
1 reply →
WHOIS has been replaced by RDAP which offers the same information through a different protocol. Each RIR also has its own lookup tool.
While I suspect it's not quite what you meant, yes, whois is deprecated and is on its way out:
https://news.ycombinator.com/item?id=43384069
I'm always fascinated by how the internet keeps getting better, step by step. RPKI is a good example ! I wonder what "RPKI" would be needed for the AI-agent-gone-rogue age
More annoying trash slop. I stopped reading after the first graphic.
I work for IPinfo. We really would appreciate more constructive feedback on how to present data driven stories that is approachable to everyone.
> I stopped reading after the first graphic.
Now, let's see what we had before the first graphic.
1st Paragraph: Explains what BGP is.
2nd Paragraph: Tells a story about the Pakistani ASN accidental BGP hijack. A story which is known in the network engineering community, but not by most people.
3rd Paragraph: Introduces RPKI.
4th Paragraph: Summary states that builds the foundation of the article.
Then the first graphic shows the RPKI validation. That is all.
How would you structure the blog post about RPKI adoption, which is a data-driven technical story? I am not absolutely trying to be demeaning, but would you rather start from what BGP, RPKI, and those things are?
Then we have a series of community post around them:
- https://shubhamjain.neocities.org/bgp-explainer (HIGHLY RECOMMENDED)
- https://community.ipinfo.io/t/internet-from-scratch-in-10-sl...
- https://community.ipinfo.io/t/how-your-internet-traffic-actu...
- https://community.ipinfo.io/t/understanding-an-asn-page-peer...
Why do people feel the need to announce that they stopped reading?
Hey guys! I know there are many comments on this forum. Stopped reading this particular comment four words in. I knew the rest sucked & just wanted you to know that
It's a feedback for whoever was responsible for publishing this article.
Explicit and vocal pushback of unwanted practices is surprisingly effective.
1 reply →
Does the data show how RPKI adoption varies across countries in the Caucasus and former Soviet Union? I’d be curious to see how Armenia and its neighboring countries compare.
Please take a look: https://x.com/reincdr/status/2111245089125339538
Thank you very much.
[dead]