On Fri, Jun 06, 2025 at 01:29:14PM +0100, Tom Strickx via routing-wg wrote:
Happy to see this proposal! Fully in agreement with Nick that bogging down the policy with implementation details is a bad idea.
Thanks!
It might be relevant to operators to tie down the "unable to discover" component. What is considered "reasonable efforts" in this context?
Speaking as RPKI operator I'd expect RIPE NCC to make reasonable efforts to discover new Manifests, for example, by corroborating information from multiple vantage points. The NCC could run a handful of validator instances (produced by different vendors) in different geographical regions behind different providers, then when a 100% of those instances report the CA was non-functional for 100% of all indidividual measurements for a 3+ month period, conclude the Delegated CA is kaput. 5 instances times 4 runs per hour times 3 months = 44,640 measurements. If the NCC makes more than 44,000 attempts to discover+validate a CA's Manifest from more than 4 countries, I'd say that is more than reasonable. Should this policy proposal advance, RIPE NCC themselves can probably shed more light on how they'd approach measuring whether a CA is non-functional or not. Kind regards, Job