One of the things Cloudflare describes is their CT log for the RPKI, Cirrus.
I can see why they did that, CT was a huge benefit for the Web PKI and many of the things we did to the Web PKI are things they'd like to see happen for RPKI - more people using it, better technical compliance by issuers, more eyeballs on the problems, CT probably helped with some of those.
But the Web PKI is a vast sprawling mess. CT was necessary _because_ of that mess, we know we can't stop it being a mess, so we needed technology that could cope. The RPKI is neither vast, nor sprawling, nor especially messy.
A big part of what drove improvements to the Web PKI was the effort by people with the power to get things changed. In the case of the Web PKI that's Mozilla, the Mozilla community (since Mozilla is a charity) and to a lesser extent the big commercial vendors, Microsoft, Apple, Google, Oracle. CT was a _tool_ these players could use as part of that work, but on its own it didn't get the job done.
But in RPKI there isn't really an equivalent. Companies like Cloudflare don't have anywhere near the clout to get this done. Even the backbone providers don't. And if we're to expect the RIRs to fix it, they don't need any help getting insight on issuers when they themselves are the issuers.
So, Cirrus isn't hurting anything, but I hope its creators had very limited expectations and expended minimal resources getting it up, because I doubt it's a major part of the solution to our problems either.
I can see why they did that, CT was a huge benefit for the Web PKI and many of the things we did to the Web PKI are things they'd like to see happen for RPKI - more people using it, better technical compliance by issuers, more eyeballs on the problems, CT probably helped with some of those.
But the Web PKI is a vast sprawling mess. CT was necessary _because_ of that mess, we know we can't stop it being a mess, so we needed technology that could cope. The RPKI is neither vast, nor sprawling, nor especially messy.
A big part of what drove improvements to the Web PKI was the effort by people with the power to get things changed. In the case of the Web PKI that's Mozilla, the Mozilla community (since Mozilla is a charity) and to a lesser extent the big commercial vendors, Microsoft, Apple, Google, Oracle. CT was a _tool_ these players could use as part of that work, but on its own it didn't get the job done.
But in RPKI there isn't really an equivalent. Companies like Cloudflare don't have anywhere near the clout to get this done. Even the backbone providers don't. And if we're to expect the RIRs to fix it, they don't need any help getting insight on issuers when they themselves are the issuers.
So, Cirrus isn't hurting anything, but I hope its creators had very limited expectations and expended minimal resources getting it up, because I doubt it's a major part of the solution to our problems either.