4 ms·

> No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Mic

> No, not everyone runs behind a NAT system. Ever been to a university where everyone gets an non-RFC1918 IPv4 address? That's how IPv6 is. When I worked at Microsoft, everyone had a routed address on their workstations, too. Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. > As you just admitted, NAT breaks things. And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. When I run a server I already have to assume that clients are NATed and as such I design my system to work that way. IPV6 only is a non existing part of the internet and as such not really something to optimize for. I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it.

dasil003 11y ago
So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future?
- the_mitsuhiko 11y ago
  > So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future? My position is irrelevant in this discussion. I answered the following question based on my own experience in the field: > why pretty much anyone except google and facebook isn't?
pixl97 11y ago
>For many of us, a NAT is considered a feature not a bug in fact. What? Nat is always a bug with a hack piled upon hack upon hack. The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. Protocols like uPNP have produced a plethora of critical exploits allowing an attacker full access to the NAT'ed network. Firewall controlled IPv4 with a 1:1 ratio of ip to host is always much easier to control the security risks with. Everyone else simply uses NAT because they have no other choice, there simply isn't IPs in the 4 address space to do whats needed. So yet again we have a implementation tragedy where everyone would be better off with it working, but no one will do it, leaving us with a hulking crapsack we are used to in every aspect of our life. Further reading: http://slatestarcodex.com/2014/07/30/meditations-on-moloch/ http://slatestarcodex.com/2014/07/30/meditations-on-moloch/
- the_mitsuhiko 11y ago
  > The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.
  - gwright 11y ago
    This doesn't sound right to me. There is no need to do address translation in IPv6 networks. It may be that there is still a firewall in place with rules about incoming and outgoing connections, though. In the IPv4 realm the term NAT is often interpreted to mean connection rules in addition to network address translation. It is the address translation that is the source and focus of much criticism of IPv4 "NAT" and it is exactly that feature that is unneeded in the IPv6 realm. So while network address translation is superfluous in IPv6, there is still an argument to be made for network access rules. I would be interested to here what technical arguments were being made for true network address translation in an IPv6 network.
    - the_mitsuhiko 11y ago
      > There is no need to do address translation in IPv6 networks. There is no need, but typically desire. Which company is comfortable leaking out individual employees IP addresses if they can avoid it? There are more downsides from a security point of view than upsides.
      - gwright 11y ago
        That can be done with randomized assignment of addresses to hosts rather than dynamic address translation. Everyday you come to work you get a different address. No need to do that dynamically at the network border or on a per connection basis. But thank you for pointing out explicitly one of the 'reasons' that is given for IPv6 NAT.
forgottenpass 11y ago
And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. Sounds like Stockholm syndrome. Are there any desirable properties of NAT that can't be duplicated with a firewall?
- the_mitsuhiko 11y ago
  > Sounds like Stockholm syndrome. Are there any desirable properties of NAT that can't be duplicated with a firewall? That they are widely deployed, reasonably predictable and quite transparent to the user. Which means that in the default configuration a user has a secure setup that apps however can partially circumvent to enable incoming traffic on UDP ports. Many computer games or P2P systems exploit this setup quite successfully to set up P2P networks without any user interaction.
  - lmm 11y ago
    Many computer games or P2P systems work around the pain that is NAT. But with IPv6 you just... remove the workaround. That's always going to be better. If you like the "game requests a firewall exception by making a uPnP call to the router" model, there's no reason at all you can't do exactly the same thing under IPv6. The only difference is that games that don't have all the hacky workarounds will also work.
kuschku 11y ago
> Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. WHAT? I am at a tiny German ISP, got a new contract one year ago, and have a publicly routable IP. I’ve never seen an ISP that doesn’t provide at least one publicly routable IP per customer, some, like mine, even provide additional ones for a few euros each.
- scurvy 11y ago
  > I’ve never seen an ISP that doesn’t provide at least one publicly routable IP per customer, some, like mine, even provide additional ones for a few euros each. There are a few ISP's in APNIC and LACNIC regions that hand out RFC1918 addresses to end users. I've seen a few NANOG posts of people trying to greenfield such setups in the US, too. Mostly in the RF/radio space.
- the_mitsuhiko 11y ago
  >I am at a tiny German ISP, got a new contract one year ago, and have a publicly routable IP. You have one IP, not one per computer. Thus your router becomes a NAT for the devices you have internally.
  - kuschku 11y ago
    I can, if I want to, as I said, order multiple IPs, for multiple devices. Currently I only have one, as I don’t need more, but I can easily get one per computer. Just like I can get one phone number per room.
    - the_mitsuhiko 11y ago
      > I can, if I want to, as I said, order multiple IPs, for multiple devices. Very few ISPs let you do that and if they do, continuous blocks are really expensive these days, even for servers. For end user networks it's even less likely that you get them. Maybe in the states, but not in Europe. In Germany especially there are many ISPs that do not give you any IP address any more but have a carrier side NAT unless you call phone support or switch it in a panel somewhere and then you get exactly one dynamic IP that rotates every 24 hours. If you have an ISP that gives you anything larger than /24 I would really like to hear which one that is.
scurvy 11y ago
> I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it. You know you can dual stack right? It's not a binary option. You can run IPv4 and IPv6 addresses side by side, offering the best connectivity to all clients. You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much? It's coming, it's not going away. Over 25% of US residences have routed IPv6 addresses. Adoption is higher in other parts of the world.
- the_mitsuhiko 11y ago
  > You know you can dual stack right? I know, but why should I? When the time comes I will enable IPv6 but right now it's more hassle than it's worth. > You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much? I'm not against IPv6, I just don't gain anything from it. Which means that effectively it just complicates the general setup for me, more things that can break etc. > Adoption is higher in other parts of the world. It would appear those parts of the world are not customers to me, users of my software or they are fine with IPv4. And again, that's what is the thinking process for many, many people that have small web services or websites.
  - scurvy 11y ago
    > It would appear those parts of the world are not customers to me, users of my software or they are fine with IPv4 How do you know if you don't have IPv6 endpoints? > that's what is the thinking process for many, many people that have small web services or websites. And those sites will continue to be small with that kind of thinking. > When the time comes I will enable IPv6 The user stats show that the time is now. What kind of signal are you waiting for?
    - the_mitsuhiko 11y ago
      > How do you know if you don't have IPv6 endpoints? For my open source projects I do not care. For the business side of things at any company I worked for the bulk of the revenue came from a handful of countries where invoicing was set up, the interface was translated to, everybody spoke English in support etc. If I would ever have to grow a business into an area where there is no IPv4 connectivity or problematic one, there would be plenty of other issues before. > And those sites will continue to be small with that kind of thinking. One has nothing to do with the other. Sites grow because they grow their consumer base and that has pretty much nothing to do with IPv6 connectivity (at the moment). The future is irrelevant in this discussion as the thread was about why few people care currently. > The user stats show that the time is now. What kind of signal are you waiting for? Not the stats I am looking at, but I'm willing to be shown different statistics. For all companies I worked for IPv6 has been not even a topic worth discussing so irrelevant was it for the the operations.

dasil003 11y ago

So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future?

the_mitsuhiko 11y ago
> So your position is that we should just keep piling hacks upon hacks even though there is viable alternative that will drastically simplify a great many things for the foreseeable future? My position is irrelevant in this discussion. I answered the following question based on my own experience in the field: > why pretty much anyone except google and facebook isn't?

pixl97 11y ago

>For many of us, a NAT is considered a feature not a bug in fact. What? Nat is always a bug with a hack piled upon hack upon hack. The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. Protocols like uPNP have produced a plethora of critical exploits allowing an attacker full access to the NAT'ed network. Firewall controlled IPv4 with a 1:1 ratio of ip to host is always much easier to control the security risks with. Everyone else simply uses NAT because they have no other choice, there simply isn't IPs in the 4 address space to do whats needed. So yet again we have a implementation tragedy where everyone would be better off with it working, but no one will do it, leaving us with a hulking crapsack we are used to in every aspect of our life. Further reading: http://slatestarcodex.com/2014/07/30/meditations-on-moloch/ http://slatestarcodex.com/2014/07/30/meditations-on-moloch/

the_mitsuhiko 11y ago
> The amount of crap that needs done to get ip2ip communications working and other multiport protocols is stupid and introduces piles of security risks. I'm sorry, but you are naive if you think that NATs will go away with IPv6 or that the absence of NATs would make it safer. In fact, NATs have found a way back to IPv6 and any deployment I have seen with IPv6 that was not done by a university actually goes through a NAT.
- gwright 11y ago
  This doesn't sound right to me. There is no need to do address translation in IPv6 networks. It may be that there is still a firewall in place with rules about incoming and outgoing connections, though. In the IPv4 realm the term NAT is often interpreted to mean connection rules in addition to network address translation. It is the address translation that is the source and focus of much criticism of IPv4 "NAT" and it is exactly that feature that is unneeded in the IPv6 realm. So while network address translation is superfluous in IPv6, there is still an argument to be made for network access rules. I would be interested to here what technical arguments were being made for true network address translation in an IPv6 network.
  - the_mitsuhiko 11y ago
    > There is no need to do address translation in IPv6 networks. There is no need, but typically desire. Which company is comfortable leaking out individual employees IP addresses if they can avoid it? There are more downsides from a security point of view than upsides.
    - gwright 11y ago
      That can be done with randomized assignment of addresses to hosts rather than dynamic address translation. Everyday you come to work you get a different address. No need to do that dynamically at the network border or on a per connection basis. But thank you for pointing out explicitly one of the 'reasons' that is given for IPv6 NAT.

forgottenpass 11y ago

And we learned to deal with it for many, many years. For many of us, a NAT is considered a feature not a bug in fact. Sounds like Stockholm syndrome. Are there any desirable properties of NAT that can't be duplicated with a firewall?

the_mitsuhiko 11y ago
> Sounds like Stockholm syndrome. Are there any desirable properties of NAT that can't be duplicated with a firewall? That they are widely deployed, reasonably predictable and quite transparent to the user. Which means that in the default configuration a user has a secure setup that apps however can partially circumvent to enable incoming traffic on UDP ports. Many computer games or P2P systems exploit this setup quite successfully to set up P2P networks without any user interaction.
- lmm 11y ago
  Many computer games or P2P systems work around the pain that is NAT. But with IPv6 you just... remove the workaround. That's always going to be better. If you like the "game requests a firewall exception by making a uPnP call to the router" model, there's no reason at all you can't do exactly the same thing under IPv6. The only difference is that games that don't have all the hacky workarounds will also work.

kuschku 11y ago

> Every normal customer is, every normal business is. Old institutions do not count because they are in a privileged position nobody else on the web is. WHAT? I am at a tiny German ISP, got a new contract one year ago, and have a publicly routable IP. I’ve never seen an ISP that doesn’t provide at least one publicly routable IP per customer, some, like mine, even provide additional ones for a few euros each.

scurvy 11y ago
> I’ve never seen an ISP that doesn’t provide at least one publicly routable IP per customer, some, like mine, even provide additional ones for a few euros each. There are a few ISP's in APNIC and LACNIC regions that hand out RFC1918 addresses to end users. I've seen a few NANOG posts of people trying to greenfield such setups in the US, too. Mostly in the RF/radio space.
the_mitsuhiko 11y ago
>I am at a tiny German ISP, got a new contract one year ago, and have a publicly routable IP. You have one IP, not one per computer. Thus your router becomes a NAT for the devices you have internally.
- kuschku 11y ago
  I can, if I want to, as I said, order multiple IPs, for multiple devices. Currently I only have one, as I don’t need more, but I can easily get one per computer. Just like I can get one phone number per room.
  - the_mitsuhiko 11y ago
    > I can, if I want to, as I said, order multiple IPs, for multiple devices. Very few ISPs let you do that and if they do, continuous blocks are really expensive these days, even for servers. For end user networks it's even less likely that you get them. Maybe in the states, but not in Europe. In Germany especially there are many ISPs that do not give you any IP address any more but have a carrier side NAT unless you call phone support or switch it in a panel somewhere and then you get exactly one dynamic IP that rotates every 24 hours. If you have an ISP that gives you anything larger than /24 I would really like to hear which one that is.

scurvy 11y ago

> I get absolutely nothing currently by enabling IPV6 on my server because I cannot depend on it. You know you can dual stack right? It's not a binary option. You can run IPv4 and IPv6 addresses side by side, offering the best connectivity to all clients. You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much? It's coming, it's not going away. Over 25% of US residences have routed IPv6 addresses. Adoption is higher in other parts of the world.

the_mitsuhiko 11y ago
> You know you can dual stack right? I know, but why should I? When the time comes I will enable IPv6 but right now it's more hassle than it's worth. > You gain a lot by enabling IPv6, and not much to lose. Out of curiosity, why are you against IPv6 so much? I'm not against IPv6, I just don't gain anything from it. Which means that effectively it just complicates the general setup for me, more things that can break etc. > Adoption is higher in other parts of the world. It would appear those parts of the world are not customers to me, users of my software or they are fine with IPv4. And again, that's what is the thinking process for many, many people that have small web services or websites.
- scurvy 11y ago
  > It would appear those parts of the world are not customers to me, users of my software or they are fine with IPv4 How do you know if you don't have IPv6 endpoints? > that's what is the thinking process for many, many people that have small web services or websites. And those sites will continue to be small with that kind of thinking. > When the time comes I will enable IPv6 The user stats show that the time is now. What kind of signal are you waiting for?
  - the_mitsuhiko 11y ago
    > How do you know if you don't have IPv6 endpoints? For my open source projects I do not care. For the business side of things at any company I worked for the bulk of the revenue came from a handful of countries where invoicing was set up, the interface was translated to, everybody spoke English in support etc. If I would ever have to grow a business into an area where there is no IPv4 connectivity or problematic one, there would be plenty of other issues before. > And those sites will continue to be small with that kind of thinking. One has nothing to do with the other. Sites grow because they grow their consumer base and that has pretty much nothing to do with IPv6 connectivity (at the moment). The future is irrelevant in this discussion as the thread was about why few people care currently. > The user stats show that the time is now. What kind of signal are you waiting for? Not the stats I am looking at, but I'm willing to be shown different statistics. For all companies I worked for IPv6 has been not even a topic worth discussing so irrelevant was it for the the operations.