My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands <i>and automatically enforcing it</i>, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database.
Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.<p>Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).<p>This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.
If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this.<p>Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this <i>couldn't</i> be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia <i>or</i> AWS.<p>[0]: <a href="https://blog.cloudflare.com/de-tld-outage-dnssec/" rel="nofollow">https://blog.cloudflare.com/de-tld-outage-dnssec/</a>
Or they could order Western telecoms to depeer with Russian ones. That would be even more effective.
The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future, but the actual reason is that the Russian influence found a fertile ground in the NL, with about a third of the votes going to pro-Russian parties and with the destruction of MH17 basically gone from the public discourse.
> The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future<p>Would you stand by this statement if we did s/Netherlands/United States/g ?<p>It's not about the governments of today, but those of the future.
> but the actual reason is that the Russian influence found a fertile ground in the NL<p>Are they stupid and can't think for themselves? The Netherlands have strong democratic tradition and great public education system. Why would they be influenced by a foreign government? I always find it amusing.
Social media
> The Netherlands have strong democratic tradition and great public education system.<p>Unfortunately, for the same reason that Russian influence found fertile ground in the US (MAGA), France (both le Pen and Melenchon), Germany (AfD and BSW), Italy (Berlusconi, Salvini), Hungary (Orban/Fidesz), Poland (PiS), Slovakia (Fico), the UK (UKIP, Reform, and relating to Brexit, the Tories)...<p>Unchecked globalization has led to serious economic devastation, and Russian propaganda picked that up and blamed it all on immigrants, and added a bunch of LGBT hate on top because that serves as a decent wedge issue for a group of the population that the anti-immigrant stuff doesn't catch that much. And on top of that, they made the immigration issue so much worse - Libya, Syria, Afghanistan and Iran all have Russia's bloody fingerprints all over them.<p>And as we're seeing, even the best democratic tradition doesn't stand a chance against economic misfortune.
> And as we're seeing, even the best democratic tradition doesn't stand a chance against economic misfortune.<p>This fact is why I think regardless of governing ideology, it's in the interests of any government to not write off wide-spread destitution and inequality as merely the cost of participating in a global economy. Even the Romans two thousand years before us understood all regimes require their bread and circuses, and the first one is the more important of the two.<p>As a Briton it's a particularly frustrating time to live here. We have wasted the 'peace dividend' on luxury policies like giving incumbent homeowners massive regulatory power to constrain the housing supply with lots of harmful knock-on effects, putting economic stupidity like Brexit to a constitution-breaking and divisive referendum, and harmfully constraining the energy supply by letting every self-interested QUANGO and NIMBY block renewable/nuclear power and the associated infrastructure. We spent more on the <i>paperwork</i> before a single shovel entered the ground on a tunnel under the Thames than Norway did building the longest road tunnel in the world. We cannot continue enacting nonsense policies like this and expecting everyone to muddle through as things get bleaker and bleaker, it'll come to a head one day and when it does it'll be destabilising.<p>Economic prosperity, or at the very least not having lost decade after lost decade, is necessary to avoid more authoritarian forms of politics coming to power.
You just demonstrated a big problem with our politics. People lining up with their side on every issue. I think most of what you say is reasonable (although you are missing nuance on some things) but then you call Brexit it stupid and "constitution-breaking". Obviously the majority who voted for it disagreed, and being in the EU without having had a referendum (unlike most countries - France, Ireland and others did, Iceland just did too) was itself divisive. There is not rational reason to call it stupid. The predictions of economic disaster (e.g. the pre Brexit treasury forecast) did not materialise and the economy is doing about as well as comparable EU economies.
Cameron's policy of offering a referendum in 2015 as an electoral tactic <i>was</i> a stupid political move in my opinion, he learned the wrong lesson from the Scottish independence referendum in 2014 and gambled the future of the country not out of any democratic principle, but for short-term domestic expediency. The referendum was a fundamentally ill-conceived thing, it was a knee-jerk reaction on the part of the Conservative Party who feared a) that Cameron could not maintain discipline over the right of the party and b) that the Conservatives would bleed voters to Nigel Farage's then-party UKIP to the right.<p>I'm not opposed to voting on EU membership in general, but the way the actual referendum was conducted was poor and it's increasingly clear that Russia attempted to interfere with it as well. Compare it to the Scottish referendum which was pretty well-conceived, the Brexit referendum looks amateurish in comparison. The reason is because it had very little to do with the government suddenly sprouting a love of participatory democracy, and everything to do with Cameron thinking that because he had won one referendum and ostensibly stopped the Scottish nationalists for a generation he could do the same to UKIP and the right of his own party.<p>In my view the vote should have been held, a democracy is only a democracy if it's allowed to make potentially harmful decisions for itself. However it should not have been rushed into being with zero regard for how it might test the constitution or what a leave vote actually meant, in my view the consequences of a leave vote should have been characterised and defined well in advance; all the debate between 'hard Brexit' or 'soft Brexit' should have happened before the date of the vote was set. It also should have been more credibly secured against Russian influence in light of the threats to democratic integrity that were new at the time, the government appears to have been genuinely lax on this front. They couldn't have carried it out in a more division-generating way if they'd been trying in my opinion, and it's because they rushed it for risky party-political reasons.
> constitution-breaking and divisive referendum<p>What part of the constitution does a referrendum break? One of the main principles of British constitutional law is that Parliament is supreme.
That's kind of my point. Constitutionally speaking, the Brexit referendum was advisory and could have been ignored. That would have been completely unconscionable from a legitimacy point of view though, so whatever the constitution has to say on the subject on paper an iron-clad democratic mandate to carry out Brexit was forced to coexist with Parliament's iron-clad supremacy.<p>This is why I think it was constitution-breaking, the constitution simply isn't set up to gracefully deal with a conflict between 'Brexit must happen' and 'Parliament cannot agree on how to carry out Brexit'. All of this against the ticking clock of Article 50 as well. Instead Boris Johnson ended up brute-forcing his way through the issue with the 2019 election and the purge of his non-Brexiteer MPs. The system did ultimately hold up (even in the face of Johnson's prorogation crisis), but I think Cameron was very irresponsible. Not for holding the referendum, but for not figuring out all the potential complexities of a leave vote before calling the referendum. The constitution got an uncontrolled stress test that didn't need to happen the way it did.<p>Also to add to that, the limits of Parliamentary sovereignty really were tested with respect to things like the Northern Ireland peace agreement during the Brexit negotiations.
While I agree with your point, I don't agree that the unchecked globalisation is to blame, rather unchecked capitalism. Even without globalisation unchecked capitalism would lead to the same result, only per country.<p>And the countries that did the work to rein capitalism in, in a proper way, are doing well, also in the circumstances of globalisation.
> Italy (Berlusconi, Salvini)<p>As Italian, I would say that the most pro Russia party are M5S (Conte even invited Russian soldiers to help us against COVID) and Futuro Nazionale (Vannacci). Even AVS and part of the PD are "pro-peace", AKA pro-Russia.<p>Salvini said that he is pro Putin, but Legal voted to send weapons to Ukraine.
Could this be that having to buy Russia oil from US isn't good for the people of Netherlands for example?
RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.
I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.
> would achieve nothing outside of creating a splinternet.<p>With the growing threat profiles and potential damage, I wonder the cost calculations being made behind closed doors right now of both governments and companies about that very possibility.<p>A lot of companies already block traffic by country of origin and have since they existed on the internet.
If it’s so simple to do I’m not sure why the west hasn’t already done it vis a vis Russia and China. Spam and scams would drop precipitously instantly.
I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.
So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.<p>Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?<p>The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.
The internet is supposed to be a decentralized network.
When ISPs have so much control, I don't see it as decentralized.<p>It is designed for fallbacks or ability to reroute when connections become congested or get cut.<p>Real world decentralized communication would not require an ISP and could operate by proxy with multi modes of communication. This way you can circumvent Government restrictions.<p>Sneaker net is decentralized and how North Koreans circumvent their government.
An RFC for data transport over balloon attached USB flash would not appear on 1 April, with or without quality of service.
It is already like you say it should be.
I don’t think that one country should get to unilaterally decide whether another country gets internet, no.
You do understand that the hypothetical threat actor here is one who openly disregards international law?<p><a href="https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-becomes-law" rel="nofollow">https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-be...</a><p><a href="https://www.reuters.com/world/us-imposes-sanctions-international-criminal-court-hours-after-former-judge-wins-2026-10-09/" rel="nofollow">https://www.reuters.com/world/us-imposes-sanctions-internati...</a>
>Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?<p>Yes. It was the vision of the internet to continue on outside of the whatever political whims some tiny slice of western governments.<p>It’s just too ripe for abuse.<p>You can make whatever “whatabout” arguments on DNS, etc but none of those are required to get connectivity (DHT, p2p hosts, tor names, etc).<p>Any centralization around the narrow middle IP layer of the internet should be treated with extreme skepticism and pushback.
This is what happens when someone wants to regulate the crap outta everything. what a dumb ass take.
There's no reason an independent entity couldn't spin up a new trust anchor, as long as they get RPs to follow it. If a government started meddling with an RIR's RPKI database, that would provide a pretty good set of incentives for an AltDB-but-for-RPKI TA to gain adoption. Even in the absence of meddling, this would be useful for legacy IPv4 holders, who currently don't have a way to participate in RPKI.
Certificate revocation as an act of war... the 2030s are gonna be wild.
I'm reminded of Vernor Vinge's novel <i>Rainbows End</i>, which is set in 2025. It features a cyberattack against a rogue AI, which involves revoking a root CA certificate belonging to Credit Suisse, causing massive collateral damage to the European economy and infrastructure.<p>Vinge didn't quite get to see his rogue AI prediction become (sort of) reality, right on schedule, but he did at least outlive Credit Suisse.
It's already happening, you cannot access the websites of many sanctioned Russian entities without trusting a Russia-issued root CA. The fragmentation of the Internet is already in motion
Well if that happens, operators will be forced to make a choice - comply with it, or stop using rpki.<p>Having a system like this is like signing an agreement. Its only worth anything so long as people decide to respect it. If operators overplay their hand, people might stop respecting it.
Swap Russia for any other country and …<p>But … cutting off Russia wouldn’t be such a bad thing.
I get your broader point, but making it potentially easier to cut Russia specifically off from the Internet might not be the worst thing in the world.
> By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access<p>And nothing of value would be lost. Quite the opposite in fact.
[dead]