Hi Denis, On Thu, Apr 08, 2021 at 12:55:32AM +0200, denis walker via db-wg wrote:
I don't see the issue of what, if anything, should be validated as a show stopper for introducing the "geofeed:" attribute. This is my idea of utilising the RIRs to improve the value of services with increased validation. That's why I changed the subject line and started it as a different thread. We can come back to this later. Apologies for taking you down a side road, but at least I got some initial feelings from you on this more general issue.
I recognize value in your suggestions on RIR-driven validation, and definitely agree on the desired outcomes, but I'm not convinced its the RIRs that should take on (as permanent task) to do outreach about 'broken geofeeds'. While keeping in mind that 'geofeed:' is a new utility for this industry and we (as collective of producers & consumers) have yet to see how things will work out exactly. One thing stood out to me in what Denis wrote: "This geofeed attribute will delegate this information process out to thousands of organisations." (src: https://www.ripe.net/ripe/mail/archives/db-wg/2021-April/006893.html) While indeed globally thousands of organizations are now being guided and enabled towards populating geofeeds, this in itself is not an indicator that a decentralized approach will 'overtake' the current market for "GeoIP information". It doesn't strike me as unfeasible that the likes of MaxMind, IPinfo.info, or any other GeoIP aggregators will take on the role of 'patrolling' the feeds and providing tools/notifications to those who appear to publish broken information. The (commercial) 'GeoIP market' is far more advanced than a mere IP Address <> Geographical location mapping. Another layer of advancement that exists: customers of GeoIP information oftentimes will correlate the purchased GeoIP information with their own internal records on fraud and other activities of interest, and also acquire GeoIP from multiple (possibly even non-database) sources. Some companies measure latency to help approximate geography. To me it seems unlikely the 'geofeed' mechanism will 'wipe out' the existing market, but rather geofeeds might be a (significant!) enhancement for existing practises. I do think that 'geofeed:' in some ways democratizes the market in the sense that an industry standard publication mechanism and easier access to this type of access means that more people can cheaply acquire GeoIP information which means that existing GeoIP providers will have to step up their game .... which is a positive! :) I think we should only ask the RIRs 'to do something' when it has become clear the industry itself is unable to organize it themselves. RIPE Atlas probably is a great example of someting only an RIR could've pulled off. Kind regards, Job ps. An example where data quality urgently needed to increase were RPKI ROAs in the 2019-2020 time frame. To help the BGP Default-Free Zone get rid of 'RPKI Invalid' BGP announcements, it was not the RIRs that 'did the cleanup', it was the efforts of individuals such as 'nusenu_', Anurag Bhatia, Massimo Candela's BGPAlerter, and hundreds of network operators actually deploying RPKI ROV that resulted in significant industry-wide cleanup. RIPE NCC indeed does have a 'wrong-ROA' alerting mechanism but it only applied to RIPE managed space, and (imho) is too crude of an alerting mechanism to be useful in most corporate contexts. pps. Another example of global cleanup led by an individuals is Jared Mauch's "Open Resolver Project" for which he was awarded the M3AAWG J.D. Falk Award.