4 ms·

And once IPV6 gets up to steam, welcome to a world of people with millions of "addresses" to attack from. One advantage of IPV4 is that it was accidentally pret

And once IPV6 gets up to steam, welcome to a world of people with millions of "addresses" to attack from. One advantage of IPV4 is that it was accidentally pretty granular. That'll be a while, of course, but already we see attackers with access to a tremendous number of unique IP addresses in the IPV4 space.. they'll have many orders of magnitude more soon.

dspillett 11y ago
> welcome to a world of people with millions of "addresses" ... in the same /64 range for the most part, so as easy to block/filter/limit as one IPv4 address. You risk inconveniencing people who are assigned just a few addresses because you potentially end up blocking many of them due to the actions of a few on the same subnet, but you can't be held responsible for hosts/ISPs doing IPv6 wrong.
- Ao7bei3s 11y ago
  > ... in the same /64 range for the most part, so as easy to block/filter/limit as one IPv4 address. Possibly even easier, because of IPv4 deaggregation. (Because of IPv4 address scarcity, many providers have discontinous IPv4 address space. This is mostly a problem for the core, because it leads to much larger BGP routing tables.)
- icebraining 11y ago
  You risk inconveniencing people who are assigned just a few addresses because you potentially end up blocking many of them due to the actions of a few on the same subnet, but you can't be held responsible for hosts/ISPs doing IPv6 wrong. Not to mention that some ISPs do carrier-grade NAT specifically due to the limitations of IPv4, so blocking a single IP(v4) might affect multiple people as well.
- faded242 11y ago
  CoughDigitalOceanCough
Arnt 11y ago
Lots of people say so, but that doesn't make it a useful model of IPv6. When you think about IPv6, start with /64 networks. That's the basic unit. What a DSL customer gets from the ISP is a /64 network, not some number of individual addresses. The customer may two, ten or 2047 of then, it doesn't matter. The point is "one owned DSL subscriber = one /64 network". Just like with IPv4, some people have larger allocations. But the basic allocation unit is a /64 network.

dspillett 11y ago

> welcome to a world of people with millions of "addresses" ... in the same /64 range for the most part, so as easy to block/filter/limit as one IPv4 address. You risk inconveniencing people who are assigned just a few addresses because you potentially end up blocking many of them due to the actions of a few on the same subnet, but you can't be held responsible for hosts/ISPs doing IPv6 wrong.

Ao7bei3s 11y ago
> ... in the same /64 range for the most part, so as easy to block/filter/limit as one IPv4 address. Possibly even easier, because of IPv4 deaggregation. (Because of IPv4 address scarcity, many providers have discontinous IPv4 address space. This is mostly a problem for the core, because it leads to much larger BGP routing tables.)
icebraining 11y ago
You risk inconveniencing people who are assigned just a few addresses because you potentially end up blocking many of them due to the actions of a few on the same subnet, but you can't be held responsible for hosts/ISPs doing IPv6 wrong. Not to mention that some ISPs do carrier-grade NAT specifically due to the limitations of IPv4, so blocking a single IP(v4) might affect multiple people as well.
faded242 11y ago
CoughDigitalOceanCough

Arnt 11y ago

Lots of people say so, but that doesn't make it a useful model of IPv6. When you think about IPv6, start with /64 networks. That's the basic unit. What a DSL customer gets from the ISP is a /64 network, not some number of individual addresses. The customer may two, ten or 2047 of then, it doesn't matter. The point is "one owned DSL subscriber = one /64 network". Just like with IPv4, some people have larger allocations. But the basic allocation unit is a /64 network.