BGP Origin Validation and Best Path Selection Are Two Distinct Network Decisions

·1 views

A technical explainer from the Protocol in Code series highlights a common misconception among network engineers: that a route winning BGP's best path selection also means it is authorized. BGP best path selection evaluates preferences such as local preference, AS_PATH length, and MED to pick a winning route, while origin validation separately checks whether the originating AS is actually permitted to announce that prefix. RPKI origin validation addresses this second question by comparing a BGP route against Validated ROA Payloads, which cryptographically assert which AS is allowed to originate a given prefix range. A route can emerge as the best path and still constitute a hijack if no valid ROA authorizes its origin AS. The article walks through a minimal Python implementation to illustrate how the two decisions rely on entirely separate data structures and logic.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer cuts Claude Design sync cost from 665k tokens to near zero with custom CLI

A developer reverse-engineered the undocumented API behind Claude.ai/design after finding that syncing project files through an AI agent consumed roughly 665,000 tokens — because all file bytes had to pass through the model's context. Since the endpoint is an undocumented MCP server, the developer mapped its behavior through direct observation rather than relying on any official specification. The process exposed three incorrect assumptions about the protocol, including how write results are structured, how access errors are surfaced, and how binary files are detected. To prevent untested assumptions from hiding real bugs, every documented protocol claim was paired with a live integration test that hits the actual server. The resulting CLI tool syncs files like a version-control system, keeping file bytes out of the model context entirely and using atomic writes to prevent data loss from interrupted operations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Distributed Locks Can Expire Correctly and Still Corrupt Data Without Fencing Tokens

A distributed lock expiring on schedule does not prevent data corruption if a paused worker resumes and overwrites a newer update after its lease has already been claimed by another process. This is because distributed locks are effectively leases — they communicate ownership for a time window but cannot cancel in-flight writes or recall delayed network packets. A real-world parallel is the 2012 GitHub outage, where a ~90-second network disruption caused multiple file-server pairs to simultaneously believe they were the active owner of the same resource, requiring over five hours of recovery. The reliable fix is a fencing token: a strictly increasing integer issued by the lock coordinator on each acquisition, which the protected resource uses to reject any write carrying an older generation number. Unlike a random UUID — which only prevents an expired holder from releasing another's lock — a fencing token enforced at the storage layer ensures stale writes are rejected regardless of network or process delays.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Experienced AI Engineers Focus on Systems, Not Just Models

A machine learning practitioner has shared a key insight from their experience: building better AI models alone does not guarantee a successful AI product. In real-world production environments, the model is just one component surrounded by data pipelines, monitoring, logging, feedback loops, and deployment infrastructure. The author illustrates this with a comparison of two companies, where the one investing in robust system design consistently outperforms the one chasing marginal accuracy gains. This perspective shifts the focus from chasing the latest research benchmarks to mastering disciplines like MLOps, system design, and data engineering. The core takeaway is that users experience the entire system, not the model itself, making reliable system architecture the true foundation of useful AI products.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Practitioner Earned the Google Associate Data Practitioner Certification

A data analytics professional has shared their experience earning the Google Associate Data Practitioner certification through Google Cloud's structured Data Analytics Certificate program, which spans five courses. The candidate completed the program over several months, covering topics such as BigQuery, data lakehouse architecture, data governance, and cloud-native visualization. Preparation focused on applying concepts to real-world scenarios rather than rote memorization, since the exam consists entirely of multiple-choice questions testing practical skills. Hands-on labs, video lectures from Google instructors, and practice quizzes helped the candidate consistently meet the required 80% passing threshold on graded assessments. The writer describes the certification as a strong entry point into Google Cloud's data ecosystem and recommends full participation in all available lab work for those starting out.

0 comments Read more at DEV Community