RPKI now protects 70% of internet routes

So a highly specific problem couched in terms of the legal obligations of the registry. But,you ignore the other dimension of WHY a legal authority might require a registry to act.

Do you honestly think the world would be better if there was no international law, or legal constraints on ISPs? Do you think BGP operators are somehow supra legal?

The registry system we live in has operated for almost 3 decades now, an inheritance of a prior informal arrangement. It's a mutuality. If you want to change it, get involved in it's policy process.

I get your broader point, but making it potentially easier to cut Russia specifically off from the Internet might not be the worst thing in the world.

I'm sure there's several ways in which ICANN and RIPE could screw Russia over. I'm also sure (or at least hopeful) they understand this would achieve nothing outside of creating a splinternet.

Certificate revocation as an act of war... the 2030s are gonna be wild.

RPKI isn't necessary for this hypothetical to happen, and there's a lot easier ways for various governments to put pressure on network providers to do their bidding.

Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack.

Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc).

This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision.

There's no reason an independent entity couldn't spin up a new trust anchor, as long as they get RPs to follow it. If a government started meddling with an RIR's RPKI database, that would provide a pretty good set of incentives for an AltDB-but-for-RPKI TA to gain adoption. Even in the absence of meddling, this would be useful for legacy IPv4 holders, who currently don't have a way to participate in RPKI.

If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this.

Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this couldn't be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia or AWS.

[0]: https://blog.cloudflare.com/de-tld-outage-dnssec/

Well if that happens, operators will be forced to make a choice - comply with it, or stop using rpki.

Having a system like this is like signing an agreement. Its only worth anything so long as people decide to respect it. If operators overplay their hand, people might stop respecting it.

> By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access

And nothing of value would be lost. Quite the opposite in fact.

Swap Russia for any other country and …

But … cutting off Russia wouldn’t be such a bad thing.

The Netherlands won't do it. Personally I think it shouldn't, as it'd set a sort of precedent that would be easy to abuse in the future, but the actual reason is that the Russian influence found a fertile ground in the NL, with about a third of the votes going to pro-Russian parties and with the destruction of MH17 basically gone from the public discourse.

I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.

We have country level breakdown for ASNs.

  - https://ipinfo.io/AS214822#geolocation

We have some IP range breakdown as well:

  - https://ipinfo.io/AS214822/45.8.228.0/24
  - https://ipinfo.io/ips/45.8.228.0/24

We have the data. How would you like us to present it? (Bonus point if you can tell me why that will be helpful because that will help me to make a better pitch to engineering!)

> Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns.

Why are you allowing your LLM to consume instructions controlled by a third party? Sounds like a recipe for disaster.