<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 14 Nov 2014, at 10:26, Nigel Titley <<a href="mailto:nigel@titley.com">nigel@titley.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">I'm sorry, I don't understand what you mean with less "secure" routing<br>table in this context. Can you elaborate? Or maybe give an<br>(hypothetical) example?<br><br></blockquote><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">I'm not sure but this sounds like Kaveh thinks that ISPs perform negative filtering whereas, at least in my experience they perform positive filtering, which will be made *more* secure.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote></div><br><div>Hello,</div><div><br></div><div>Sorry for not being clear. </div><div><br></div><div>To my understanding, these are the three scenarios where most operators make their routing decision:</div><div><br></div><div>1- Route is seen and is in the IRR: Provider accepts it.</div><div>2- Route is seen but differs from IRR: Except if the received route is a subset of IRR object, it is rejected.</div><div>3- Route is seen and is absent in IRR: Provider rejects if the route is coming from a downstream provider, accepts it otherwise.</div><div><br></div><div>So, if we change the RIPE Database default behaviour to return "%ERROR:101: no entries found� when they run their trustworthy scripts, they will get less route objects, which will in practice downgrade some of the cases which would have caught by strategy (2) and rejected to the category (3) and accepted. This is where if we only make this change on the server side, we have made the system less useful.</div><div><br></div><div>As I have written to routing-wg, I just wanted to point out that these kinds of changes should accompany provider behaviour and toolset changes as well. </div><div>Without them, they will have no effect, if not negative. If we have the commitment in the operator space and toolset provider space, this can be a very positive change towards better data quality.</div><div><br></div><div>All the best,</div><div>Kaveh.</div><div><br></div><div><br></div><div><br></div><div><br></div></body></html>