[apwg-chairs] Re: [ca-tf] Certification-Policy Proposal - next steps?

On Fri, 2010-03-26 at 11:15 +0100, Sander Steffann wrote:
> Hi,
> 
> > I must observe that none of the secure routing drafts say "you must reject an invalid signed route" -- they only affect the preferences in best path selection. That is a big difference, as revoking a certificate does _not_ tell anyone they should drop that announcement, merely that it's not as attractive as others may be.
> > 
> > And even that only applies to direct path selection in the routers themselves, they have got nothing to do with filter constructions, where the choice is 100% up to the individual ISPs.
> 
> This is what the community needs to hear. If everybody understands this there will be a lot less resistance.

I think that this has always been understood by anyone that actually
takes the trouble. However, for those ISPs who *don't* understand,
rather like those people who apply RBL filters without understanding
them, there is always the good chance that unsigned/invalidly signed
prefixes will be dropped.

However, I think if we take the action to generate BCP documents to aid
the, err..., more technically challenged ISPs out there, as and when the
secure routing stuff starts to appear then we will sooth fears greatly,
as Sander says.

Nigel