At today’s IEPG I presented on a new way of distributing RPKI data globally iepg.org/2025-11-02-i...

APNIC now supports "signing with resources". This is an RPKI-based mechanism to verify control over IPs and ASes. Useful for BYOIP! I helped develop this as an open standard & software implementation. Nice to see it finally reach the production environment :-) orbit.apnic.net/hyperkitty/l...

OpenBSD 7.8 is out! This release includes the result of a fantastic engineering effort: a multi-threaded version of rpki-client. man.openbsd.org/rpki-client

OpenBSD 7.8 is out! This release includes a little project of mine, a new implementation of the "watch" utility! This one has a real time display, can pause on error, highlight words & lines. man.openbsd.org/watch

In both the APNIC and RIPE region policy proposals to prune persistently nonfunctional RPKI delegations reached consensus. Important step in maintaining a healthy scalable ecosystem. www.ripe.net/publications... www.apnic.net/community/po...

OpenSSH 10.2 has just been released. This release contains only non-security bugfixes, most notably for a bad regression that made interactive that used ControlPersist basically unusable Full release notes at openssh.com/releasenotes...

OpenSSH 10.1 has been released! \o/ I contributed changes to the DSCP marking mechanism: if a SSH connection contains ONLY interactive sessions, ssh/sshd will automagically classify the packets for Expedited Forwarding (DSCP EF). lists.mindrot.org/pipermail/op...

Animation of an aspect of the Internet's routing system: RPKI manifest issuances throughout the day, a re-issuance makes the thingies ploink rightwards

wow wow wow - rpki-client 9.6 has been released! This amazing release includes support for multi-threaded object validation, the new versatile CCR data interchange format (datatracker.ietf.org/doc/html/dra...), and many other improvements. Release notes here: www.rssf.nl/post/rpki-cl...

Super happy to see this move forward! mailman.ripe.net/archives/lis...

I wrote a new new Policy Proposal: "Revocation of Persistently Non-functional Delegated RPKI CAs" Policy proposal itself: www.ripe.net/community/po... Discussion: mailman.ripe.net/archives/lis... Consider chiming in!

Yay! OpenBSD 7.7 has been released! openbsd.org/77.html

In this post for @kentik.bsky.social, @jobsnijders.bsky.social and I dig into the problem of excessively large AS-SETs — out of control route objects which can render IRR-based route filtering useless. Includes data analysis from @benjojo.bsky.social founder of bgp.tools.

RPKI Views: The archive of RPKI state PING podcast @jobsnijders.bsky.social discusses RPKIViews, his long term project to collect the "views" of RPKI state every day, and maintain an archive of BGP route validation states.

@job again dropping some knowledge and insight with current #rpki operations. Worth a read: https://mailman.nanog.org/pipermail/nanog/2025-January/227206.html

Spent the last 6 days hiking the gorgeous StauSeeSteig trail

rpki-client 9.4 has been released! This release imposes restrictions on Trust Anchor certificate validity periods, includes ASPA support for BIRD2, protection against AS0 TALs, and various reliability improvements. Read the release notes here: cdn.openbsd.org/pub/OpenBSD/...

rpki-client stricter aging policy for Trust Anchor certificates commited to -current www.undeadly.org/cgi?action=a... #openbsd #rpki-client #rpki #routing #certificates #trustanchor #ta #networking #bgp #freesoftware #libresoftware

@eldomador.bsky.social’s 2024 in review: BGP, RPKI adoption, submarine cable cuts, major outages, and the role of geopolitics in shaping the internet. 🌐 Check out the year’s biggest highlights: kentik.com/blog/a-year-... #InternetAnalysis #BGP #RPKI #SubmarineCables #Kentik

New (short) RFC: Detecting RPKI Repository Delta Protocol (RRDP) Session Desynchronization www.rfc-editor.org/rfc/rfc9697.... Rpki-client was the first to implement Ties’s clever concept

Today marks the day: 1 month nicotine free!

Today my latest RFC was published. It fixes a security issue in the RPKI distribution protocol: in the original RRDP specification it was possible for one repository operator to impose load on another repository operator. rfc-editor.org/rfc/rfc9674....

insightful thread about SCION

There are a lot more of these unheralded success stories than people think. Problematic BGP routes are regularly being filtered without human intervention.

War story: RPKI, working as intended. On how Fastly’s IP space was BGP hijacked, but nobody noticed www.fastly.com/blog/war-sto...

Our favorite Internet routing protocol - BGP - just got an update! The mechanism in this RFC should help a bit against zombie routes and other problems rfc-editor.org/rfc/rfc9687.... hat tip to @benjojo.bsky.social and Yingzhen Qu for sticking it out with me