5 ms·

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing. > And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only address they actually have. And that's a great thing, if you care about privacy (and I do). And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends, and if you want a public IPV4 address, the going rate wherever I look is about $1/month. > IPv6 is the only way we're ever going to create working peer-to-peer infrastructure We practically have less-than-perfectly-but-still working peer to peer; the lack of immediately direct connection is not, I believe, what's stopping "working peer to peer" from happening -- the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25, and for good reasons - most users cannot be trusted to run an addressable peer. So with IPv6 it would be technically easier to p2p, but practically the same as it will be firewalled by the ISPs. And the price for this improvement will be utter complete tracability of your actions among every website -- right now, google and facebook can only (easily) exchange info about you if you gave enough of it to them, or if they decide to share cookies (which you can see and stop). On IPV6, it would be enough for them (and wikipedia, and ISPs and everyone else) to just trade access logs.

Dagger2 9y ago
v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way. Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?
- beagle3 9y ago
  > v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids. I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries. edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).
  - vertex-four 9y ago
    > I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?
    - beagle3 9y ago
      I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; <<>> DiG 9.7.1-P2 <<>> www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxxxx ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.amazon.com. IN AAAA ;; ANSWER SECTION: www.amazon.com. 1208 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 55 IN CNAME opf-www.amazon.com. ;; AUTHORITY SECTION: opf-www.amazon.com. 895 IN SOA ns-191.awsdns-23.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60 ;; Query time: 70 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; MSG SIZE rcvd: 147 Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.
      - jgrahamc 9y ago
        > Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address. We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4). https://blog.cloudflare.com/98-percent-ipv6/ https://blog.cloudflare.com/98-percent-ipv6/
        beagle3 9y ago
        Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off. I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement). Can you share what percentage of customers have IPv6 turned off explicitly? Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?
vertex-four 9y ago
> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken. > And that's a great thing, if you care about privacy (and I do). It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Again, if you want to be anonymous on the internet, use Tor. It accomplishes what you're looking for in a NAT to a much better degree. If you want to keep other users' privacy, encourage the use of onion routing in new protocols, and encourage the use of Tor to access the legacy internet. > And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system. > the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25 And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented. FTR, they block incoming port 80 because they want to maintain an artificial differential between "consumer" and "business", not any security rationale - most of the rest of the world doesn't do that, they just have a firewall blocking everything incoming on the ISP-provided router by default, and you can unfirewall port 80 if you want to. Blocking outgoing port 25, otoh, is done because SMTP is a terrible protocol that by default assumes every node on the internet is trustworthy, and ISPs were roped in to ensure nobody ever had to change it.
- beagle3 9y ago
  > It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs for different aspects of my works and life, none with access to hardware acceleration, by using proper web filtering at both the browser and gateway level). They have it easy with the vast majority of the population, no doubt, but for now my actions gets mixed with everyone elses in such a way that Facebook would actually have to assign a person to deanonymize me. Similarly Google. My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request (I'd be surprised if they actually demand a warrant). Switching to IPv6 would effectively deanonymize me constantly. > And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented. That's a great ideal. No, they don't allow all other ports, but what they allow or block varies a lot by service class, area and ISP, and you'd know for sure only after you tried (it used to also change often, but I heard it's converged; I'm not living in the US anymore) > Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system. Supernodes were retired because they do not work well anymore (haven't in a few years). I do not find "pay $1/month to provide service" too onerous; there are also public ICE/STUN/TURN. I find it disingenuous that you completely dismiss the societal cost (privacy), and the engineering costs (the reason IPv6 is still not dominant despite being "in the works" for 20 years now), because some future protocol which had not been shown useful over those 20 years ("research papers waiting to be implemented"). There is enough IPv6 to make the case for the need, and the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago.

Dagger2 9y ago

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way. Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

beagle3 9y ago
> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids. I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries. edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).
- vertex-four 9y ago
  > I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?
  - beagle3 9y ago
    I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; <<>> DiG 9.7.1-P2 <<>> www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxxxx ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.amazon.com. IN AAAA ;; ANSWER SECTION: www.amazon.com. 1208 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 55 IN CNAME opf-www.amazon.com. ;; AUTHORITY SECTION: opf-www.amazon.com. 895 IN SOA ns-191.awsdns-23.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60 ;; Query time: 70 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; MSG SIZE rcvd: 147 Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.
    - jgrahamc 9y ago
      > Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address. We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4). https://blog.cloudflare.com/98-percent-ipv6/ https://blog.cloudflare.com/98-percent-ipv6/
      - beagle3 9y ago
        Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off. I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement). Can you share what percentage of customers have IPv6 turned off explicitly? Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?

vertex-four 9y ago

> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken. > And that's a great thing, if you care about privacy (and I do). It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Again, if you want to be anonymous on the internet, use Tor. It accomplishes what you're looking for in a NAT to a much better degree. If you want to keep other users' privacy, encourage the use of onion routing in new protocols, and encourage the use of Tor to access the legacy internet. > And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system. > the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25 And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented. FTR, they block incoming port 80 because they want to maintain an artificial differential between "consumer" and "business", not any security rationale - most of the rest of the world doesn't do that, they just have a firewall blocking everything incoming on the ISP-provided router by default, and you can unfirewall port 80 if you want to. Blocking outgoing port 25, otoh, is done because SMTP is a terrible protocol that by default assumes every node on the internet is trustworthy, and ISPs were roped in to ensure nobody ever had to change it.

beagle3 9y ago
> It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs for different aspects of my works and life, none with access to hardware acceleration, by using proper web filtering at both the browser and gateway level). They have it easy with the vast majority of the population, no doubt, but for now my actions gets mixed with everyone elses in such a way that Facebook would actually have to assign a person to deanonymize me. Similarly Google. My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request (I'd be surprised if they actually demand a warrant). Switching to IPv6 would effectively deanonymize me constantly. > And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented. That's a great ideal. No, they don't allow all other ports, but what they allow or block varies a lot by service class, area and ISP, and you'd know for sure only after you tried (it used to also change often, but I heard it's converged; I'm not living in the US anymore) > Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system. Supernodes were retired because they do not work well anymore (haven't in a few years). I do not find "pay $1/month to provide service" too onerous; there are also public ICE/STUN/TURN. I find it disingenuous that you completely dismiss the societal cost (privacy), and the engineering costs (the reason IPv6 is still not dominant despite being "in the works" for 20 years now), because some future protocol which had not been shown useful over those 20 years ("research papers waiting to be implemented"). There is enough IPv6 to make the case for the need, and the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago.