IRR has data issues. RIRs put some control around this (tying prefix to org), but plenty of trash in the other IRRs (people claiming they own /12s they don't, etc). Also the chain of people using as-sets to mark who their customers are is busted. People are being way too broad by putting peers in their set for networks that aren't their transit customers - and prefixes get permitted.

The BCP38 war is lost. Credit to those who try to do better but it's the hosting shops who are the biggest offenders. Most broadband and cloud providers do this proper. I chase down tcp syn reflection attacks and they always come from the same types of hosters.