<div dir="ltr">Just to spice things up:<br>I think it's worth mentioning a positive side effect of LACNIC's hosted mode.<br><br>After a long time as the only RIR without an authoritative IRR database, it was RPKI and hosted mode that enabled the creation of LACNIC's IRR database.<br>Today, it's one of the few IRR bases with few data inconsistencies.<br><br>IRR objects are created automatically only if RPKI ROAs exist.<br>That's beautiful!<br>I thank and congratulate whoever did this!</div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Em ter., 23 de set. de 2025 às 12:53, Carlos Martinez-Cagnazzo <<a href="mailto:carlos@lacnic.net">carlos@lacnic.net</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<p>Hey, </p>
<div>On 23/9/25 12:48 PM, Job Snijders
wrote:<br>
</div>
<blockquote type="cite">
<div dir="auto"><span>On Tue, 23 Sep 2025 at 17:41, Carlos
Martinez-Cagnazzo <<a href="mailto:carlos@lacnic.net" target="_blank">carlos@lacnic.net</a>>
wrote:</span><br>
</div>
<div dir="auto">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" dir="auto">Thanks Job,<br>
<br>
I believe there is a sweet spot somewhere. If you run a
really large <br>
org, I believe operationally it make sense to run your own
CA. You may <br>
run into things like the need to run transfers, move space
from one <br>
service to the other and you will feel more at home running
something <br>
you can deeply integrate with your automation platforms.<br>
<br>
If you run a small org, you are definitely better off on
hosted.</blockquote>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">I disagree with some of what you say, having
worked for several large orgs, I contend that
the RIR-provided APIs work just as fine as poking APIs of an
internal CA; RIR probably better.</div>
</div>
</div>
</blockquote>
<p>There is a risk-management side of things that we cannot ignore.
But I disgress.</p>
<p>I think this is one point where we can agree to disagree :-)</p>
<blockquote type="cite">
<div dir="auto">
<div class="gmail_quote">
<div dir="auto"><br>
</div>
<div dir="auto">The observable experience with “a really large
org running their own CA”, so far has only demonstrated that
the large org repeated all the mistakes that the RIRs made
in the beginning.</div>
<div dir="auto"><br>
</div>
<div dir="auto">“Large” just doesn’t equate “good execution”.</div>
<div dir="auto"><br>
</div>
</div>
</div>
</blockquote>
<p>IMO that's a separate discussion. I agree with you, but I believe
that should be taken care "out of band" if you will. Be it
policies, MANRS or whatnot. </p>
<p>One thing I believe we would all benefit from is some form of
"RPKI Etiquette" that of course involves proper running delegated
CAs.</p>
<blockquote type="cite">
<div dir="auto">
<div class="gmail_quote">
<div dir="auto">Kind regards,</div>
<div dir="auto"><br>
</div>
<div dir="auto">Job</div>
</div>
</div>
</blockquote>
/Carlos
<blockquote type="cite">
<br>
<fieldset></fieldset>
<pre>_______________________________________________
LACNOG mailing list
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
LACNOG mailing list<br>
<a href="mailto:LACNOG@lacnic.net" target="_blank">LACNOG@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/listinfo/lacnog</a><br>
Cancelar suscripcion: <a href="https://mail.lacnic.net/mailman/options/lacnog" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailman/options/lacnog</a><br>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Douglas Fernando Fischer<br>Engº de Controle e Automação<br><div style="padding:0px;margin-left:0px;margin-top:0px;overflow:hidden;color:black;text-align:left;line-height:130%;font-family:"courier new",monospace"></div></div></div>