[routing-wg] [anti-abuse-wg] AS43890

In message <BE0B5059-0051-46B5-8349-039D37F3151A at steffann.nl>, 
Sander Steffann <sander at steffann.nl> wrote:

>> It now seems certain to me that the absence of anything even remotely
>> approximating proper validation of RIPE route objects is not, in fact,
>> a problem which is limited to just inter-RiR situations.  Apparently,
>> RIPE member LIRs can just as easily hijack the IP blocks of other
>> RIPE members as they can in the case of IP blocks belonging to parties
>> in other regions.
>
>I don't think so...

You're right, and I apologize to everyone for the false alarm.

I made a mistake.  It's that simple.  I looked at the wrong changed:
field and concluded that the Iranians had had the containing block
(188.229.0.0/17) since 20120905.  But now I see that that was incorrect,
and the Iranians had most probably only been assigned this block very
very recently, e.g. 20141028.

Obviously, that changes the analysis completely.  There was no hijacking
here.  None at all.  I apologize that I misspoke.

That having been said, the fact that all of those 61 now-clearly-stale
route objects remain in the data base is, I would say, rather obviously
un-good.  I understand that it was, it the first instance, the responsibility
of netserv.ro to have removed those, but clearly, they didn't.

Perhaps we could (or should) talk about some automated procedures that
might automagically remove such bogus/stale cruft, even in the absence
of prompt action by the parties who created the object in the first place.


Regards,
rfg