Conversation

Notices

Embed this notice
Patrick C Miller :donor: (patrickcmiller@infosec.exchange)'s status on Monday, 07-Oct-2024 20:12:07 JST Patrick C Miller :donor:

Fix for BGP routing insecurity 'plagued by software vulnerabilities' of its own, researchers find https://www.networkworld.com/article/3544447/fix-for-bgp-routing-insecurity-plagued-by-software-vulnerabilities-of-its-own-researchers-find.html
In conversation about 8 months ago from infosec.exchange permalink
Attachments
1. Domain not in remote thumbnail source whitelist: www.networkworld.com
  
  Fix for BGP routing insecurity 'plagued by software vulnerabilities' of its own, researchers find
  
  Despite White House encouragement to implement RPKI, the protocol is not yet stable or secure enough, according to a team of German researchers.
- Embed this notice
  Royce Williams (tychotithonus@infosec.exchange)'s status on Monday, 07-Oct-2024 22:13:21 JST Royce Williams
  in reply to
  
  @patrickcmiller Counterpoint:
  https://infosec.exchange/@tychotithonus/113251427429978042
  In conversation about 8 months ago permalink
  Attachments
  1. No result found on File_thumbnail lookup.
    
    Royce Williams (@tychotithonus@infosec.exchange)
    
    from Royce Williams
    
    I'm ambivalent about the article title and intro (**not** the research) here: https://www.theregister.com/2024/10/02/rpki_immaturity_study/ The scare words initially imply a "moving from no BGP security to some BGP security is problematic because BGP security implementations have bugs" position. No one is making a "moving from HTTP to HTTPS is problematic because HTTPS implementations have bugs" argument. Only in the last paragraph do we get to what the authors actually say: "Did the White House push for the adoption of an immature technology, potentially doing more harm than good?" ... ["probably not" statements] ... "The roadmap of the White House is a huge leap for RPKI, and therefore also for internet routing, to truly mature and meet the expectations of security, reliability, and scalability for production-level deployments across the global internet." Was it a good question to ask? Yes. Did El Reg frame it that way? No. Was this probably for clicks? Yeah. Did it make a bunch of people temporarily confused about RPKI? Probably. 😐

Public

Conversation

Notices

Feeds