Re: AltDB?

[Jon Lewis <jlewis () lewis org>]

Getting back to the original topic...sort of:

Looking at the data from altdb, it's not as widely used as I'd have 
guessed.  There are 461 mntner objects.  Of these, 268 use MAIL-FROM 
authentication.  192 use CRYPT-PW.  At least those are the split if you 
look at just the first auth: for each mntner object...plenty of objects 
have multiple auth:'s and some even have multiple types like MAIL-FROM and 
PGP.  In such a case, does a change request have to satisfy both auth's or 
just either one?

This makes me ask two questions.

1) Why did ARIN even bother setting up rr.arin.net with no 
authentication other than MAIL-FROM?  Even CRYPT-PW, while weak 
would be far stronger and preferable to effectively no authentication.

2) Why does altdb (and presumably other RR's that support CRYPT-PW) only 
support DES and not MD5-crypt?  It's not 1990 anymore.  RFC 2622 says that 
CRYPT-PW uses the UNIX crypt format...but today, UNIX crypt supports a 
variety of formats, including MD5, which is popular at least with Linux.

I don't mean to whine that altdb doesn't support MD5...it'd be nice if it 
did, but at the price I'm paying for service ($0), I can't complain.

AFAIK, few networks base their BGP filters on the RR data, so I don't care 
too much about RPKI[1].  Who cares if ARIN certifies that my entries are 
legit if only a fraction of the net uses that data and there will always 
be portions of the net where anything goes and resource certification is 
ignored?  What I do care about is that my peers or transits that use RR 
data to build filters use the data I put there, and that that data isn't 
tampered with by anyone with the minimal level of clue required to forge 
the from address on an email and construct an RPSL update email.  Sure, 
we'd get email notification of the change...but if they time it right or 
the email doesn't get acted on quickly enough, filters might be built 
improperly.

[1] Don't care is probably too strong.  At this point in time, I don't 
think it makes sense to get hung up on it and refuse to do any 
authentication if we're not doing RPKI, but not implement RPKI, because we 
haven't worked out all the details on how it'll be done.  As it is, 
rr.arin.net is pretty much worthless.

----------------------------------------------------------------------
 Jon Lewis, MCP :)           |  I route
 Senior Network Engineer     |  therefore you are
 Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________