Bryton Herdes

Let’s talk malformed AS_PATHs. Unless you’re enforcing the “First AS” of received routes, you’re vulnerable to hijacks that not even ASPA validation can prevent. Read more here, and enforce the First AS in BGP. https://blog.cloudflare.com/enforce-first-as-bgp/

ASPA object typo? Saw this in a path w/ @mingwei@infosec.exchange 🇨🇭AS8298 ↔️ 🇨🇭AS58299 ↔️ 🇺🇸AS13335 AS relationship is inferred as peer-peer between 8298 and 58299. ASPA object for AS8298 defines AS52899 as a provider, thinking that's meant to be AS58299 🙂 https://radar.cloudflare.com/routing/rpki/as8298#rpki-aspa-providers

Our research suggests Internet routing would be better off without influence by the ORIGIN attribute. In modern BGP, it doesn’t really make sense to have. Read more in our post https://blog.cloudflare.com/bgp-origin-attribute/