7 ms·

This is in no way criticism against LE, where I work _nothing_ is IPv6 and we do not even have it on any agenda. But when an "we are going to change the future

• scrollaway 10y ago
  AWS still has no native IPv6 support. It's sad really. It's pointless for a project like LE to make IPv6 a first-priority feature when massive providers running the backbone of the internet don't support IPv6 without a ton of fiddling-around.
  • mordocai 10y ago
    This is 100% why my site is not ipv6
  • chatmasta 10y ago
    It's not in AWS business interest to support IPv6. As long as they only support IPv4, they need to own an address for every VM in their cloud. As they grow, they purchase more addresses, shrinking the pool of available IPv4 on the secondary market, increasing the price for their competitors. This makes it more expensive to compete with AWS on a large scale if you want to support IPv4.
    • IgorPartola 10y ago
      Sorry, but I don't see it. While they are busy buying up IPv4 addresses, I'll just be over here moving everything to IPv6 only and not have to care about any of that.
      • api 10y ago
        Until almost the entire Internet has IPv6 at the endpoint, you're making your stuff unreachable to most people. You will still need an IPv4 gateway. I have IPv6 at home now but still don't have it at our tech-oriented co-working space, and I've never seen an IPv6 address get handed out at a coffee shop, airport, restaurant, etc.
        • IgorPartola 10y ago
          An IPv4 endpoint is fine and for some situations way cheaper than having every single host be assigned a public IPv4 address. I am not saying that we are there yet, but I can't see a situation where Amazon putting pressure on the market by buying every available IPv4 address resulting in a response of "Let's give all our money to AWS" and not "let's finally make IPv6 happen."
          • chatmasta 10y ago
            Good point, but the problem is that the companies responsible for "making IPv6 happen" are not necessarily the same companies who want to compete with Amazon. There's very little incentive for ISPs to roll out IPv6, especially when the biggest cloud providers don't support it. It's a bit of a catch 22.
      • chatmasta 10y ago
        Yeah, what about the hundreds of carriers that don't yet support IPv6?
        • drdaeman 10y ago
          Don't we have, for example, a Teredo client baked in into every relatively recent Microsoft OS? My ISP doesn't support IPv6, but I've just checked and a Windows 10 machine was able to do `curl -6 https://ipv6.google.com/` https://ipv6.google.com/` just fine. And I think I've heard OS X has something as well... not sure, don't have OS X or iOS devices at hand to try it out. (On GNU/Linux and BSD machines there's a lot of choices, Miredo, 6to4, AICCU from SixXS - whatever one fancies. As usual on *nix systems, setup is manual, though.)
          • deathanatos 10y ago
            And it works out of the box? Doesn't Teredo necessitate using a relay (someone to translate to native IPv6) – does MS just have one set up somewhere, and preconfigured?
            • drdaeman 10y ago
              Yes, out-of-box. Haven't ever did anything IPv6-related by myself on that machine.
          • mabcat 10y ago
            That curl command doesn't connect on my OSX El Capitan.
        • mgbmtl 10y ago
          > Yeah, what about the hundreds of carriers that don't yet support IPv6? That's like focusing on supporting Internet Explorer 8. At some point IPv4 will become the legacy protocol and supporting it will be annoying and expensive. That day maybe not be today, but switching protocols is not always trivial, and you should start yesterday.
  • api 10y ago
    Nearly all the "second tier" clouds support IPv6: Digital Ocean, Vultr, Linode, SoftLayer, etc. AWS's services are great but many people just need compute. I don't understand why people who just need compute use AWS, since for compute only Digital Ocean and Vultr destroy it in virtually every way: ease of use, performance, cost, IPv6, etc. Digital Ocean now has block storage too, which plugs one hole. Of course they don't have things like RedShift or S3, but like I said not everyone needs that.
    • DanielDent 10y ago
      DO's v6 needs work. They block port 25, and they don't even assign an entire /64 to a machine, which breaks SLAAC and whole bunch of useful ways of using v6.
  • tomjen3 10y ago
    My ISP doesn't even seem to give me one, which is kind of annoying since I would love to be able to have direct access (through something secure) to all my computers, especially my NAS, no matter where I am. Without a lot of customers on ipv6, why would they support ipv6 on the servers?
    • kalleboo 10y ago
      My ISP offers it, but you have to buy a special $100 IPv6 PPPoE device and stick it between your IPv4 NAT router and your WiFi router...
• mholt 10y ago
  I'm glad their Prio-1 feature was free, automated TLS certificates, not IPv6.
  • jo909 10y ago
    Of course, so am I. But pretty much the same reasons we can bring up why IPv6 was not super important for LE are the reasons everybody else has to procrastinate on that. It's just a statement of overall sadness that accompanies my personal ~15 year wait for IPv6 adoption.
    • tomjen3 10y ago
      We would have had it a long time ago if it had been backwards compatible, so that a server with an ipv6 address could talk with a server with an ipv4 address and vice versa. Then it would only have required software upgrades, but since ipv6 is more than twenty years old, most software that used it would have supported it by now, if only because it would have been written a long time after ipv6.
      • deathanatos 10y ago
        I've heard this argument before … but how could that have possibly worked? An IPv4 client is only going to be able to address 2 ^ 32 addresses, and it seems like the pigeonhole principle implies that the client can't possibly address the entire IPv6 space with that address format. How would an IPv4 client, with this hypothetical backwards-compatible IPv6, connect to an IPv6 server?
        • tomjen3 10y ago
          A special flag in the ip packet that indicates which type of address it should be interpreted as, really that should be all, the rest of the work is drivers for software and routers.
          • deleted 10y ago
            [deleted]
• spacehunt 10y ago
  It was more of an ops issue (lack of IPv6 connectivity at the DC) rather than a software issue: https://github.com/letsencrypt/boulder/issues/593 https://github.com/letsencrypt/boulder/issues/593
• geofft 10y ago
  It's getting to be time for us to admit what the holdup is—IPv6 hasn't been deployed because IPv6 NAT ("NAT66") isn't a thing. There are a million reasons NATs are terrible for the internet. But they're used on IPv4, and IPv6's technical goal of increasing the address space is tied up into the technical goal of killing NAT, immediately, and changing the way a lot of people think about networking. For instance, end-user ISPs are expected to give you a /64 or more instead of a single IPv6 address so that you don't need to NAT, but many of them don't, because that's not how people think about addressing. If you have a NAT-using site and you want to switch to IPv6, you have to pursue the political goal of convincing your ISP to think differently about addressing. Meanwhile, IPv4 and IPv4 NAT works. I'm typing this from behind a NAT, you're probably reading it from behind a NAT. It's not ideal, but, rough consensus and running code. As soon as we all put our collective feet down and insist on IPv6 NAT implementations, such that IPv4 sites can move without rearchitecting their environment (whether or not that rearchitecting would be a good thing), IPv6 will get deployed quickly.
  • kstrauser 10y ago
    > For instance, end-user ISPs are expected to give you a /64 or more instead of a single IPv6 address so that you don't need to NAT, but many of them don't Name one? I've been on Comcast and Sonic, and both natively provide /64 networks. I've never heard of an ISP providing a /128. > Meanwhile, IPv4 and IPv4 NAT works. No, it doesn't. It breaks a million things more than it solves and it makes the Internet worse (and vastly more asymmetric, but that's repeating myself). NAT needs to die in a fire, and there is zero political or technical motivation to inflict its brokenness on a new protocol that absolutely does not need it. Evidence: that many ISPs are providing native, un-NATed IPv6 to their customers. Perhaps some don't, but someone will manage to screw up any given feature. They need to fix their shit, not coerce the rest of the Internet to break itself for their convenience.
    • roblabla 10y ago
      OVH's cheap dedicated servers, Kimsufi, only provides a single /126 IPv6 address, instead of the recommended /64 block :(.
• deftnerd 10y ago
  I have several back end servers that are IPv6 only. Since they are just used by our front-end servers it doesn't matter that much. It is nice to see 0 random port scans and SSH brute-force attacks. IPv6 space is so big it helps give some security through obscurity.
  • schoen 10y ago
    Eventually people might be able to infer things that help them reduce the space to scan a lot: https://arxiv.org/abs/1606.04327 https://arxiv.org/abs/1606.04327 (may not apply to every allocation strategy)
• mhurron 10y ago
  Why should they have waited if they got it to work over ipv4, which is where the majority of their requests right now were going to come from. Release early, release often and all that. They probably have other features in mind that haven't been released yet, does that mean that whatever those features are obviously are not important on the internet?
• dingaling 10y ago
  We slowly edged IPv6 into ${COMPANY} by a concerted effort to refer to IPv4 as 'deprecated protocol',unilaterally adding IPv6 support questions to our RFP questionnaires, boldly printing DOES NOT SUPPORT CURRENT IP PROCOTOL across design documents. All basically long-term psychological conditioning to raise awareness at the Director+= level. Still took nearly a decade before the first internal servers began supporting IPv6 but what a cheer went up when that first IPv6-only e-mail arrived. The amazing thing was that most network kit supported IPv6 out of the box, thanks to mainly to Government purchasing requirements that had hammered the big vendors into submission.
• nnethercote 10y ago
  And yet LE added IPv6 support a mere 2.5 months after it left Beta. It's not that bad!
• rmoriz 10y ago
  Just a note on IPv6 adoption: A couple of weeks ago people made fun of axle counter limitations of swiss railway SBB, however they are running IPv6 already for some months… ;; ANSWER SECTION: www.sbb.ch. 14400 IN AAAA 2a00:4bc0:ffff:ffff::c296:f58e reply
• treve 10y ago
  As soon as an IPv4 address becomes expensive and IPv6 is not, all of that will change.