<story><title>Is regulated BGP security coming?</title><url>https://blog.apnic.net/2024/05/23/is-regulated-bgp-security-coming/</url></story><parent_chain><item><author>ozr</author><text>BGP operators _have_ self-organized sufficient security measures.  Compared to just about any other attack vector on the internet, BGP hijacking is among the least likely to impact most people.</text></item><item><author>zokier</author><text>Internet community has had plenty of time and opportunity to self-organize sufficient security measures. The need for security has been long recognized, and it&amp;#x27;s understandable that powers that be are getting impatient. While obviously it would be preferable that industry would voluntarily do stuff, if they don&amp;#x27;t then I guess it is justifiable that they get regulated.</text></item></parent_chain><comment><author>rabite</author><text>Given that accidents involving BGP within the past several years have led to worldwide outages in the world&amp;#x27;s most used websites this is just not true. Also thousands of known bad announcements occur every year, which are usually used in a very small window to send large volumes of abusive advertisements.&lt;p&gt;There&amp;#x27;s no reason not to force the industry to hold people accountable for false announcements. The privilege of announcement should be acquired by posting a significant amount of capital as a bond, from which damages can be removed when a system makes a false announcement. The vast majority of damages are a result of network operators on the subcontinent -- it is high time we figure out how to make them take the issue seriously, and pay out the nose until they do.</text></comment>
<story><title>Is regulated BGP security coming?</title><url>https://blog.apnic.net/2024/05/23/is-regulated-bgp-security-coming/</url></story><parent_chain><item><author>ozr</author><text>BGP operators _have_ self-organized sufficient security measures.  Compared to just about any other attack vector on the internet, BGP hijacking is among the least likely to impact most people.</text></item><item><author>zokier</author><text>Internet community has had plenty of time and opportunity to self-organize sufficient security measures. The need for security has been long recognized, and it&amp;#x27;s understandable that powers that be are getting impatient. While obviously it would be preferable that industry would voluntarily do stuff, if they don&amp;#x27;t then I guess it is justifiable that they get regulated.</text></item></parent_chain><comment><author>awaythrow999</author><text>Threat models matter. If you&amp;#x27;re defending against nation state actors in a military&amp;#x2F;cyber context it is an essential part of the overall defense strategy. Ignoring BGP on the grounds that &amp;quot;it was always insecure&amp;quot; is then just weird, if not reckless.&lt;p&gt;The SCION project (Iirc from ZTH) solved all of this and also has been extensively tried in the field.</text></comment>