> For a protocol that was produced on two napkins in 1989 [...]
I'm not sure I'd want to deal with a protocol that can't be explained on a napkin or two. UTF-8 was design on a diner placemat:
Playing Battleships over BGP (2018)
11–20 of 25 posts
Re: Playing Battleships over BGP (2018)
#12Earlier quoted context omitted.
Considering Events yesterday - how do you test non-live ?
Who said I tested non-live? The actual beta builds/sanity checks were done just with two VMs peered with each other, but the live internet one was done in one take (and never again, at least by me)
So how should these problems be mitigated? Have separate infrastructure for critical services or staging BGP or what?
Re: Playing Battleships over BGP (2018)
#13Author of the post here, Ask me almost anything I guess(?)
If you could replace BGP globally instantly with no problems. What would you replace it with?
Re: Playing Battleships over BGP (2018)
#14Re: Playing Battleships over BGP (2018)
#15Re: Playing Battleships over BGP (2018)
#16Earlier quoted context omitted.
Who said I tested non-live? The actual beta builds/sanity checks were done just with two VMs peered with each other, but the live internet one was done in one take (and never again, at least by me)
To add on, BGP has a very much "meme" status of being scary and dangerous, and any touching will break youtube etc. [Mostly perpetuated by infosec circles] It's really not the 2000's anymore, BGP is mostly safe and filtered. There are still improvements to be made (I've even written on the blog about them), but one persons immense fuck ups are far less likely to cause issues now that IRR filters and prefix limits exi…
> It's really not the 2000's anymore, BGP is mostly safe and filtered. There are still improvements to be made (I've even written on the blog about them), but one persons immense fuck ups are far less likely to cause issues now that IRR filters and prefix limits exist.
Any non-maliciously designed protocol probably can be used safely, but surely yesterday's events show that it is still eminently possible to use BGP dangerously?
Re: Playing Battleships over BGP (2018)
#17Author of the post here, Ask me almost anything I guess(?)
If you could replace BGP globally instantly with no problems. What would you replace it with?
(Keeping in mind that replacing BGP is similar hard-ness as replacing SMTP, and thus, might not be worth it)
Honestly, the issue that exists with BGP is not the protocol. The issue is attached to trust, and there is not a instantly fixable problem with a different protocol.
One issue with the internet as a whole is that seemingly simple questions are actually hard, The one is slowly being fixed with RPKI is "Who actually owns this IP address", knowing this we can build better filters against direct (origin AS != owner AS) hijacks.
However the next question that has no solution for is "Who is allowed to carry this route/transit this data?" -- This is going to be unbelievably hard to solve with certainty, There is question that maybe a PKI solution could be deployed (BGPSEC). However you also will hit the next issue.
The bgp table is massive. 1M+ routes that is stored on machines with reasonably long lifetimes. It does not help that in terms of computing power these machines are in general very slow. A multi TBit/s router may only have a 2014 era laptop CPU powering it. So computing anything 1M times quickly is a massive ask, and when links go down, it is reasonable have fast recompute/reconvergance times.
Fixing bgp is not a easy issue. Anyone who is telling you so is either fraudulent or does not understand the sheer scale/scope of the issues attached to the protocol.
Re: Playing Battleships over BGP (2018)
#18Earlier quoted context omitted.
To add on, BGP has a very much "meme" status of being scary and dangerous, and any touching will break youtube etc. [Mostly perpetuated by infosec circles] It's really not the 2000's anymore, BGP is mostly safe and filtered. There are still improvements to be made (I've even written on the blog about them), but one persons immense fuck ups are far less likely to cause issues now that IRR filters and prefix limits exi…
> It's really not the 2000's anymore, BGP is mostly safe and filtered. There are still improvements to be made (I've even written on the blog about them), but one persons immense fuck ups are far less likely to cause issues now that IRR filters and prefix limits exist. Any non-maliciously designed protocol probably can be used safely, but surely yesterday's events show that it is still eminently possible to use BGP d…
What part of yesterday was showing that it was possible to use BGP dangerously?
If you are certain in this argument, then you master electric switch is dangerous because you could switch off the power to your house.
Re: Playing Battleships over BGP (2018)
#19Earlier quoted context omitted.
If you could replace BGP globally instantly with no problems. What would you replace it with?
(Keeping in mind that replacing BGP is similar hard-ness as replacing SMTP, and thus, might not be worth it) Honestly, the issue that exists with BGP is not the protocol. The issue is attached to trust, and there is not a instantly fixable problem with a different protocol. One issue with the internet as a whole is that seemingly simple questions are actually hard, The one is slowly being fixed with RPKI is "Who actu…
it is if you relax the constraint that the providers keep the legacy allocations and can advertise whatever the hell they want
Steve Deering had a really nice proposal on geographic addressing that would make pki sufficiently performant by using hierarchical assignments
Re: Playing Battleships over BGP (2018)
#20Earlier quoted context omitted.
If you could replace BGP globally instantly with no problems. What would you replace it with?
(Keeping in mind that replacing BGP is similar hard-ness as replacing SMTP, and thus, might not be worth it) Honestly, the issue that exists with BGP is not the protocol. The issue is attached to trust, and there is not a instantly fixable problem with a different protocol. One issue with the internet as a whole is that seemingly simple questions are actually hard, The one is slowly being fixed with RPKI is "Who actu…
Have you seen Yggdrasil? It provides an alternate routing idea, among other things.