14 ms·
By installing NAT, MIT stifles innovation
- imjustapie 9y agokudos to this well-researched post. As a student with a server in a dorm room, I really hope they don't take away my public IP address.
- smoyer 9y agoThere are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.
- plange 9y agoNAT is not security at all.
- Symbiote 9y agoNAT is not an additional layer of security. I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc. > It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world Port 80, please. With NAT, you can't offer that to more than one computer.
- imjustapie 9y agoYou nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.
- shif 9y agoBut you can, a simple reverse proxy can let the same port be used for multiple servers and pick based on hostname or query (for http). reverse proxies like nginx also have plain tcp support so it allows you to easily run several services
- srj 9y agoYou have to scale the reverse proxy, and you've added another point of failure. Not to mention - who runs it? It needs to be trusted to terminate TLS or do 5-tuple proxying based on the SNI destination (not all clients send SNI). Also if the MIT student is doing something akin to protocol level development it's possible a middle proxy will prevent them from doing their work. There is also the hassle factor. You may stop people from ever trying something because of the added hoops they must go through.
- Symbiote 9y agoSo, now I have to run a reverse proxy -- another point of failure, another thing to debug when something's not working. That's a hack to work around a shortage of IP addresses. Why would I use one, when I don't have that shortage?
- compuguy 9y agoWell, you can have tons of static IP addresses, or funding to support MIT and future IT upgrades.
- compuguy 9y agoThat's great and all, but the majority of us have lived in a IPv4 NAT world for most of our lives. A previous poster even mentioned that a student group runs a cloud hosting service on campus, making some of this moot: "SIPB (MIT's volunteer student computing group) offers free "cloud hosting" to anyone with an Athena account. http://xvm.mit.edu/" http://xvm.mit.edu/"
- api 9y agoDoes MIT have IPv6? If so just use that.
- imjustapie 9y agoI think MIT is in the process of rolling out IPv6 officially. They only got an allocation early last year, and I think right now it is being used on the VPN network.
- achernya 9y agoAuthor here -- MIT does not currently have IPv6. Although MIT did receive a /24 IPv6 allocation, https://whois.arin.net/rest/net/NET6-2603-4000-1 https://whois.arin.net/rest/net/NET6-2603-4000-1, it's not routable everywhere on campus yet. Unfortunately, IPv6 deployment is still below 20% (as measured by Google, https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html) so a publically-accessible IPv6 address is not yet sufficient.
- astrodust 9y ago20% is starting to reach critical mass.
- dom0 9y agoThose are the fast moving and the new parts of the internet. I bet that in a few years IPv6 deployment will slow down as the remaining systems become older, less maintained or even opinionated (like me). For many years to come some kind of IPv4 connectivity will remain a requirement to access all of the internet/web.
- rocqua 9y agoI'm not switching my private network. This has nothing to do with wider adoption, nor do I have issues with IPv6 as a protocol. What's blocking me is router firmware. It can do IPv6, but only as an afterthought. Sadly, no level of adoption is going to fix that, until I buy a new router.
- robertch 9y agoProjects have broken over this, with no real gain for implementing it. You would expect more rationality from MIT, of all places.
- bitexploder 9y agoI wonder if they felt like IPv4 addresses were a depreciating commodity and selling them in 5 years would not have brought in as much cash?
- curiousgal 9y ago>You would expect more rationality from MIT, of all places Tell that to Aaron Schwartz.
- KGIII 9y agoNo, no I would not expect more rationality. I am an alum. I am long since out of academia and have no idea what is behind this. However, if I had to guess, I bet there is some inner politics. Just 'cause it is MIT doesn't mean it is is free from human nature. And, truthfully, I've seen some petty things get all sorts of dramatic. We are humans. We're not rational beings, we're rationalizing beings. We like to pretend we are better but there is a valid reason that they say science progresses one death at a time.
- ocschwar 9y agoMIT's faculty and students are MIT faculty and MIT students/ MIT's admins are just admins. Same mentality you find in all the rest of academia, and they're actively hostile to everything that distinguishes MIT.
- betaby 9y agoAuthor got it wrong. MIT wants you to use IPv6.
- imjustapie 9y agoHow can MIT people use IPv6 when it hasn't been rolled out on campus yet? How does it make any sense to put the campus (Ethernet) network behind a NAT, when MIT still has 18.0.0.0/9, half of what MIT has before but more than plenty to go around?
- Reason077 9y agoNAT will make future sales of IPv4 blocks easier? As you say, MIT doesn't need all those 8 million IP addresses, and eventually will adopt IPv6 anyway. Might as well sell surplus v4 space while it's still valuable.
- imjustapie 9y agoBut why is MIT making money on those addresses more valuable than giving its students an opportunity to experiment and innovate? Why would selling those "unused" spaces to Amazon further the cause of IPv6? Also MIT hasn't even rolled out IPv6 yet...
- new299 9y agoWould the logic not be that the money will be spent on more useful things for students?
- imjustapie 9y agoPerhaps. I haven't seen public discussion on the plans to use the fund though, other than vague promise that it will be used on Internet things.
- rovr138 9y ago
- amq 9y agoI'm all for supporting innovation and community services, but I think author is not mentioning other possible causes, like DMCAs, malware and spam (including unintended), which could have damaged the reputation. I just wonder why MIT didn't give more time to move and why it doesn't provide a replacement in eg cloud credits.
- hawkling 9y agoGood question indeed. Why didn't MIT give more time to move, and in fact gave absolutely no notice, such that WMBR, the campus radio station, had to scramble to get their online radio back online again?
- mc42 9y agoJust reading the story now, but I can confirm that college radio stations (and in general radio stations) are build to run and then be forgotten. My campus still uses a rather old copy of Simian which relies not only on IPv4, but filepaths shorter than 255 characters.
- 0xdeadbeefbabe 9y agoIsn't innovation worth more than the cost of malware, spam, and DMCAs? Edit: In the late 80s the morris worm was launched from MIT, but the network admins of the 80s didn't overreact like this. I wonder why.
- fragmede 9y ago
- znpy 9y agoA lot of fuss, but if you look at the presentation slide in the middle of the page (https://4.bp.blogspot.com/-PyyPpTv1p7g/WU7hMEBnm4I/AAAAAAAAEZ0/IZSBv4d5G1kV2rCkpA-DziMB_4o2ri0RQCLcBGAs/s640/MITNAT-Slide.png https://4.bp.blogspot.com/-PyyPpTv1p7g/WU7hMEBnm4I/AAAAAAAAE... for reference) it is clear that MIT is not stifling anything or shutting anyone's mouth. MIT is just moving to IPv6. Actually... MIT forcing an entire generation of future engineers to deal with IPv6... That will literally push innovation.
- deleted 9y ago[deleted]
- hawkling 9y agoMoving IPv4 to NAT and moving to IPv6 seems orthogonal.
- deleted 9y ago[deleted]
- jccooper 9y agoNot if you're selling your IPv4.
- sargun 9y agoWhy do you say that? They're converging with the way the rest of the world* does things. *Consumer, and Enterprises in the US
- p1mrx 9y agoIPv6 is the standard way to preserve end-to-end connectivity when IPv4 NAT breaks it. You're free to see these as orthogonal problems, but if enough people think as you do (moving IPv4 to NAT without first deploying IPv6), then the Internet as we know it is dead.
- cma 9y agoOn the other hand, selling its IP4 blocks may do more to slow down the move to IPv6.
- gocolts23 9y agoWhy does this blog require javascript?
- microcolonel 9y agoUnfortunately because of Google. Dunno why they did that, it doesn't make it any better; but it's not really the author's fault either.
- jwilk 9y agoHere's an archived copy that doesn't require JS: https://archive.is/d30Rm https://archive.is/d30Rm
- gocolts23 9y agothank you
- shif 9y agoThat's the blogger platform
- unsignedint 9y agoPerhaps doing it over .onion? Actually I have been experimenting this for my pet projects. Downside is that it's relatively slow but getting "global" address is click (well a few lines of config) away...
- imjustapie 9y agoBut that would just be ridiculous, considering that experimenting with Tor relays is like a favorite student passtime...
- unsignedint 9y agoYou don't need to run a Tor relay in order to run a hidden service. I have thrown in this idea as it's a dead simple (cheap/free, and you don't have to coordinate with anyone) to get your stuff publicly, let alone for experimental purpose.
- imjustapie 9y agoSure, but I'm just pointing out an example where MIT students get to be actors as well as playwrights, whereas now one must follow the prescribed lines and mustn't be too naughty.
- kodablah 9y ago> You don't need to run a Tor relay in order to run a hidden service In fact, you shouldn't run them both [0] 0 - https://riseup.net/en/security/network-security/tor/onionservices-best-practices#dont-run-a-relay-at-the-same-time https://riseup.net/en/security/network-security/tor/onionser...
- lucb1e 9y agoAnd hosting websites is? I don't see the average student doing that either. I do, but then I also hosted hidden services, relays and exit nodes...
- 9y ago
- ghshephard 9y agoWow - 2603:4000::/24. That's the largest block of IPv6 addresses I'm aware of being handed out to a single entity. Normally, ISPs get a /32, from which, they hand out /48s to their customer. And, with pretty much zero paper work, and ISP can get a second /32 (usually adjacent with their first /32 so they can summarize as a /31). So - an ISP might get 2001:1868::/32 and then hand off 2001:1868:0209::/48 to a customer. Because a /48 allows 2^16 or 65k networks, each network containing (effectively) an infinite number of hosts, pretty much every single geographic region company can be effectively served with a single /48. The /32 allows the ISP to have 65K customer (each of which has 65K networks). What on earth is MIT going to do with a 2603:4000::/24? I'd love to hear the story behind why they got such a large block. edit: according to https://www.arin.net/fees/fee_schedule.html https://www.arin.net/fees/fee_schedule.html this is considered a "medium" (WTF?) allocation with a cost of $4k/year.
- throwaway2048 9y agoIt has nothing to do with amounts of addresses, and everything to do with making dividing stuff up for routing easier. A large ISP entity like comcast or AT&T can now have say a single /16 or /24 allocation and pretty much no matter how much they subdivide up their regional routing, routing to AT&T can easily be coalesced and summarized , and every end customer can still get a /64 till pretty much the end of time.
- ghshephard 9y agoI totally understand why Comcast, AT&T, Verizon and other service providers would want /16s. They are continent wide providers with millions of customs (millions of sites). I'm trying to grok why MIT went for a /24 instead of a /32. Because they could?
- jedberg 9y agoBecause they are replacing their /8. They want to make sure they are never constrained.
- Dryken 9y agoWish I had access to such resources during my education ! Too bad they are breaking their own system.
- jpace121 9y agoI wonder if any of this is related to the new NIST Standards[1], which have to be followed by research labs who receive government funding. I could see MIT, already having to retrofit a lot of their research networks, also changing around the network architecture in other places aswell. [1]:http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP...
- hawkling 9y agoNah, NAT doesn't provide the security; firewalling does. Besides, what kind of controlled unclassified information could possibly be residing on dormitory networks?
- russellbeattie 9y agoSorry, but NAT provides practical security for all but the most pedantic use cases. I'm terrified of IPv6 for this exact reason - it assumes every device will have direct access to the Internet. As we've seen with security cameras and other IoT devices, they just aren't designed to protect themselves and are easily hackable, so making them accessible to the wider Internet is crazy. Firewall options for IPv6 for most home routers are limited at best at the moment... I for one am quite happy to have all my local devices happily running behind an IPv4 NAT (in addition to a firewall), knowing they can't be targeted directly without some sort of concerted effort.
- cr0sh 9y agoIPv6 supports NAT...
- giobox 9y agoTrue, but I think its fair to say the crazy wide proliferation of IPv4 NAT in consumer routers wouldn't have been nearly as large if IPv4 address exhaustion hadn't been a very real thing forcing hands. IPv6, at least for the foreseeable future, doesn't have this motivating factor for using NAT. I completely agree in principle with the old adage "NAT is not a firewall", but in reality it often effectively works as one for many consumers, many of whom probably don't have the technical knowledge to understand the protection it has indirectly afforded them for the past however many years.
- AndyMcConachie 9y agoMIT is selling its IPv4 space to fund its transition to IPv6. Didn't see this link anywhere in the article. https://gist.github.com/simonster/e22e50cd52b7dffcf5a4db2b8ea4cce0 https://gist.github.com/simonster/e22e50cd52b7dffcf5a4db2b8e...
- yuhong 9y ago"The Library has the entire Net 18 address space registered at many hundreds of publishers of licensed e-resources. With no prior notice, we have been forced into non-compliance with our licenses with every such provider." I wonder what if the publishers actually sued MIT and Amazon, with maybe a injunction preventing Amazon from using the space.
- inopinatus 9y agoThat kind of statement is simply an institutional prelude to internal negotiations for an increased departmental budget.
- revelation 9y agoOh no, they have to tell the publishers their new subnet. The drama.
- kalleboo 9y agoI moved to student housing in Sweden in 2004 when they had aging network infrastructure (all 100 MBit but that also applied to the shared links to the housing areas[0]), and by the next year they just ditched the school-sponsored network and moved to making students pay for third party internet (distribution to rooms was still Ethernet-based but now with a citywide fiber backhaul run by the municipal power company shared by regular apartment buildings). We got faster service with fewer restrictions (no P2P service filters) for like $10/mo with student pricing, and still with fixed IPs. I'm not sure why what innovative service a university can provide in this space in 2017? [0]which meant about 1000 rooms sharing 100MBit internet access. This was somewhat mitigated by local DC++ networks in each housing area to keep piracy downloads off the shared link.
- juniorpatcher 9y agoIt's not about what innovate service a university can provide: it is about what kind of innovation the university can help empower its students to make.
- acrefoot 9y agoDo you have to pay $10 per server you set up? Also, by acting as the ISP, it also gets to be more protective of its log data than an outside provider might be. It's not that an outside ISP couldn't provide the same level of service and speed at the same or less cost, while protecting the interests of the MIT community, it's just that I don't expect it's as likely.
- kalleboo 9y agoI don't recall the pricing for extra IPs but it was probably something like that. I just had a stack of servers built out of donated parts in my dorm room hosting different services on VHosts. At one point I was pushing 3 TB/mo in outgoing bandwidth on that $10/mo plan.
- SadWebDeveloper 9y agoMy college didn't have internet campus wise, you had access to a limited, firewalled internet "protected" by Fortinet so i can't feel empathy for the MIT alumni since you can perfectly work without those tools.
- juniorpatcher 9y agoSorry that your college doesn't see Internet access the same way MIT does. But don't you think that by making its campus network more unnecessarily restrictive, MIT is setting a bad example?
- akhilcacharya 9y agoNot OP, but not really. In the age of AWS, maybe it's time the elites see how the other half lives?
- manquer 9y agoNo op , i am happy my uni does not see the internet as MIT does and acts far more responsibly. MIT by holding one to class A address block for so long have sets a bad example. Much of the 16million address owned by them are never really used. How many other universities have access to this kind of wasted luxury ? Standford returned theirs back ages years ago. Sure IPv6 was inevitable but if ford, MIT and rest had not been so greedy the rest of the world would have not grown up beind a NATed internet. I share an ip with 1000's of others, every third google search throws up a captcha..
- rasz 9y agosounds like UC Berkeley
- akhilcacharya 9y agoI might be weird but I always think it's funny to hear what the elites complain about. It's like hearing Yalies complain about their CS department or someone at Harvard complain about the food - completely divorced from the rest of us.
- jonbarker 9y agoWho sold the IP addresses to amazon? That part was not clear to me.
- compuguy 9y agoMIT did. They owned that ip block.
- VT_Drew 9y agoMIT wasn't running NAT before now? WTF? Talk about a security nightmare.
- ersina 9y agoI iz agree. NAT no gud. Iz komplain.
- ersina 9y agoIz no gud. Iz agree. Nat no gud. Must komplen.
- ChuckMcM 9y agoFrom the article: NAT deployment doesn't benefit the Institute in any way,... I have often had changes foisted upon me that when I looked at them I could see no benefit. In every instance the 'benefit' I didn't see was one that I typically didn't approve of and so hadn't listed in my set of 'possible benefits'. From reading the article though it sounds like MIT has had a very open and loosely (if at all) documented set of features around network access. And in today's world network access is many things more than it was 10 years ago. But perhaps the process of going through and documenting all of the things they do was 'too expensive' compared to setting it up the way the institution wanted it to work and then dealing with any fallout as it arose. Another in a series of signs that the Internet is moving from science project to critical infrastructure.
- mintplant 9y agoAt UCSD we not only got a public IPv4 address for each device but also an automatic *.dynamic.ucsd.edu subdomain assignment based on the device hostname. Came in handy for my Raspberry Pi.
- mschuster91 9y agoGood luck with name collisions.
- imjustapie 9y agoYep, that's the way it's traditionally been at MIT as well. The DHCP hosts get things like DHCP-ipaddressspelledoutinenglish.mit.edu. The fear is that it's all going away.
- hagakure0c 9y agoIts called progression, long time since the Trojan room coffee pot.
- jancsika 9y ago> Instead of being renumbered into publicly-accessible IP ranges, IS&T is moving all of campus into RFC-1918 10/8 addresses, and enforcing the campus firewall, which will be made up of Palo Alto 7050 devices, which are best known for their deep-packet inspection feature, App-ID. Then later in the article: > NAT deployment doesn't benefit the Institute in any way, other than to make things more difficult. Possibly ignorant question-- could this choice be influenced by the inescapable rise of cheap IoT devices flowing in from China? I mean if a freshman arrives with a desktop rig they bought purposely to use as an experimental server, and they explicitly register the software using a web form, you can imagine a very loosy-goosy relationship among students and IT built on good faith. But if a freshman unloads their luggage and a few dozen random internet-connected baubles drop out and start joining the network, what is IT supposed to do? Especially considering MIT probably does a lot of research for DoD...
- nly 9y agoMaybe they'll offer 1:1 NAT on-request?
- gumby 9y agoWhen I was at the Institute (80s) the IT services were a barrier to computation. They had their big 390/VM system used for accounting and some course 15 stuff. One intern digitized the Mens et Manus logo and IT excited trumpeted that they had done so -- jeez it had been in a font on the Xerox XGP at the AI lab for what, 15 years at that point? All of course 6 ignored them, and I don't believe they had any impact with Athena. Certainly they would have been upset by faculty writing the root password on all the whiteboards. In fact they had nothing to do with IP allocation (I doubt they knew what TCP was). I wonder what bureaucratic maneuvering gave them control of that!
- cxseven 9y agoFor everyone talking about this being merely a question of technical updates, it might help to see this in the bigger picture of a pattern of changes going on at MIT. MIT had a very non-authoritarian, egalitarian culture, as Richard Stallman described it: "I went to a school [Harvard] with a computer science department that was probably like most of them. There were some professors that were in charge of what was supposed to be done, and there were people who decided who could use what. There was a shortage of terminals for most people, but a lot of the professors had terminals of their own in their offices, which was wasteful, but typical of their attitude. When I visited the Artificial Intelligence lab at MIT I found a spirit that was refreshingly different from that. For example: there, the terminals was thought of as belonging to everyone, and professors locked them up in their offices on pain of finding their doors broken down. I was actually shown a cart with a big block of iron on it, that had been used to break down the door of one professors office, when he had the gall to lock up a terminal." (https://www.gnu.org/philosophy/stallman-kth.html https://www.gnu.org/philosophy/stallman-kth.html) In 2004, the MIT AI Lab was "upgraded" to the new Stata Center building, an unwieldy, Frank Gehry-designed monument to a recent MIT president's ego, and the antithesis of what it replaced, Building 20. Building 20 was a utilitarian construction from WW2 with no pretenses of becoming a prized or permanent spot on campus. Instead, its residents helped it organically acquired a character of its own as Wikipedia describes well: 'Due to Building 20's origins as a temporary structure, researchers and other occupants felt free to modify their environment at will. As described by MIT professor Paul Penfield, "Its 'temporary nature' permitted its occupants to abuse it in ways that would not be tolerated in a permanent building. If you wanted to run a wire from one lab to another, you didn't ask anybody's permission — you just got out a screwdriver and poked a hole through the wall." [...] MIT professor Jerome Y. Lettvin once quipped, "You might regard it as the womb of the Institute. It is kind of messy, but by God it is procreative!" [...] Because of its various inconveniences, Building 20 was never considered to be prime space, in spite of its location in the central campus. As a result, Building 20 served as an "incubator" for all sorts of start-up or experimental research, teaching, or student groups. [...] Building 20 was the home of the Tech Model Railroad Club, where many aspects of what later became the hacker culture developed [not to mention pranksters and lock pickers, as well].' Sadly, the TMRC's elaborate railroad, which exhibited interesting pre-miniaturization computation, didn't survive the dismantling of Building 20 and was eventually replaced with modern components. I also hear the Stata Center has two spires, one maddeningly named after Bill Gates, separating the two fiefdoms of computer science at MIT in glass-paneled offices meant to flatter status-conscious administrative types. Since Frank Gehry's architecture is proprietary and depends on strict tolerances, there's scant building modification going on. That's why I think you can see these network changes as a tragic continuation of a destruction of the historical character of MIT, even though they may also be necessary. More info about Building 20: http://web.archive.org/web/20011215020413/http://rleweb.mit.edu/Publications/undercurrents/under9-2/bld20rem.htm http://web.archive.org/web/20011215020413/http://rleweb.mit.... http://web.archive.org/web/20060912140051/http://www.eecs.mit.edu/building/20/ http://web.archive.org/web/20060912140051/http://www.eecs.mi... http://tech.mit.edu/V123/N40/40stata.40n.html http://tech.mit.edu/V123/N40/40stata.40n.html