[address-policy-wg] RIPE Access Policy Change Request to allowallocations to critical infrastructure

On Wed, 7 Jan 2004, Andre Oppermann wrote:
> Pekka Savola wrote:
> > On Wed, 7 Jan 2004, Gert Doering wrote:
> > > I would be happy to sacrifice one routing table entry per ccTLD, though,
> > > if it increases reliability of the whole DNS system.  Speaking for my
> > > network only, of course.
> > 
> > .. until someone figures out that, hey, each ccTLD actually requires
> > more entries (e.g., 3), because having just one prefix for all the
> > servers increases the danger/threat of a routing system hiccup for a
> > prefix..
> 
> I don't think so.  The same prefix is announced in many places.  If
> one of them is going down no problem.  It is very unlikely that all
> go down because there is no single instance.

No, this is not the problem.  The problem is that someone announces
the prefix, but the packets get blackholed for whatever reason (badly
configured access lists, forwarding bugs, etc.).  Something like this
has happened multiple times...
 
This is a real threat, I think, especially if you are putting all the
eggs in one basket.  Note that the root nameservers aren't.  Even if
one anycasted root server address was hosed, the others would still be
OK.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings