4 ms·

Like what specifically?

dcow 9y ago
A) Scopes aren't a hack they're part of the protocol. B) Scopes are exactly: "the global internet and the home". Considering those things why should it be absurd if I want to secure my home scope at the application layer too? IPv6 is literally designed to allow for this. Browsers are the things that are being stubborn. If IPv6 is just a terrible collection of hacks then we need a new version and fast before everyone get stuck on v6 for the next 50 years....
- zAy0LfpBZLC8mAC 9y ago
  What scopes specifically would you suggest are "the global internet and the home" in the sense that is applicable here?
  - dcow 9y ago
    In IPv6 one interface has many addresses. Each one can have: 1. global addresses, 2. rotating temporary global addresses, 3. universal local addresses (one for each site), and 4. a link-local address (required). The first 3 now technically reside in the global scope. ULAs used to be called site-local and had their own scope, but they were restructured to basically be fancy UUIDs and their scope abolished and merged with the global scope. Link-local is still its own scope. Although both are globally scoped, there's a difference between a global IPv6 address and a ULA. The global is globally routeable and prefixes are organized regionally and delegated to allow hierarchical routing while ULAs have arbitrary prefixes (not suitable for global routing) and are not supposed to be forwarded to interfaces outside their subnet. So to answer your question, for local communications in your home that you didn't want leaving your network, you would use ULAs. You could use link-local addresses if your home was all on the same l2 link, but the generally preferred solution is to use ULAs so you don't leak protocol details upwards and so you can leverage l3 tunnels. Local DNS is allowed to respond with ULAs, just not servers participating in the global authoritative DNS. If you want DNS on your home site you simply run a local DNS server that resolves your local names and is configured to forward unknown names to the global DNS. IPv6 kills NAT, so "scoped" addresses step in to fill the void and are overall a much better solution.
    - zAy0LfpBZLC8mAC 9y ago
      > 2. rotating temporary global addresses, Well, not disagreeing that you can have those, but why are you mentioning that specifically for "global addresses", but not for ULA? > while ULAs have arbitrary prefixes (not suitable for global routing) How are ULA prefixes different from PI allocations as far as suitability for global routing is concerned? > and are not supposed to be forwarded to interfaces outside their subnet. Would you mind pointing to the normative source for this forwarding policy? > Local DNS is allowed to respond with ULAs, just not servers participating in the global authoritative DNS. Would you mind pointing to the normative source for this? > IPv6 kills NAT, so "scoped" addresses step in to fill the void and are overall a much better solution. But you said that ULA are global scope (which they are, I agree), so what does this have to do with scoped addresses? Also, which void exactly does killing NAT leave that needs filling (and that then supposedly is filled by ULA)?
      - dcow 9y ago
        It's all in the RFCs. Start here: https://tools.ietf.org/html/rfc4007 https://tools.ietf.org/html/rfc4007
        zAy0LfpBZLC8mAC 9y ago
        ULA isn't even mentioned in that RFC? (Presumably because ULA was standardized half a year later?)
        dcow 9y ago
        Yes ULA is a different RFC.
        zAy0LfpBZLC8mAC 9y ago
        OK, so? Where exactly do you think are those things specified? Or do you expect me to re-read all IPv6 RFCs only to then repeat those questions because I still don't know where they are specified?

dcow 9y ago

A) Scopes aren't a hack they're part of the protocol. B) Scopes are exactly: "the global internet and the home". Considering those things why should it be absurd if I want to secure my home scope at the application layer too? IPv6 is literally designed to allow for this. Browsers are the things that are being stubborn. If IPv6 is just a terrible collection of hacks then we need a new version and fast before everyone get stuck on v6 for the next 50 years....

zAy0LfpBZLC8mAC 9y ago
What scopes specifically would you suggest are "the global internet and the home" in the sense that is applicable here?
- dcow 9y ago
  In IPv6 one interface has many addresses. Each one can have: 1. global addresses, 2. rotating temporary global addresses, 3. universal local addresses (one for each site), and 4. a link-local address (required). The first 3 now technically reside in the global scope. ULAs used to be called site-local and had their own scope, but they were restructured to basically be fancy UUIDs and their scope abolished and merged with the global scope. Link-local is still its own scope. Although both are globally scoped, there's a difference between a global IPv6 address and a ULA. The global is globally routeable and prefixes are organized regionally and delegated to allow hierarchical routing while ULAs have arbitrary prefixes (not suitable for global routing) and are not supposed to be forwarded to interfaces outside their subnet. So to answer your question, for local communications in your home that you didn't want leaving your network, you would use ULAs. You could use link-local addresses if your home was all on the same l2 link, but the generally preferred solution is to use ULAs so you don't leak protocol details upwards and so you can leverage l3 tunnels. Local DNS is allowed to respond with ULAs, just not servers participating in the global authoritative DNS. If you want DNS on your home site you simply run a local DNS server that resolves your local names and is configured to forward unknown names to the global DNS. IPv6 kills NAT, so "scoped" addresses step in to fill the void and are overall a much better solution.
  - zAy0LfpBZLC8mAC 9y ago
    > 2. rotating temporary global addresses, Well, not disagreeing that you can have those, but why are you mentioning that specifically for "global addresses", but not for ULA? > while ULAs have arbitrary prefixes (not suitable for global routing) How are ULA prefixes different from PI allocations as far as suitability for global routing is concerned? > and are not supposed to be forwarded to interfaces outside their subnet. Would you mind pointing to the normative source for this forwarding policy? > Local DNS is allowed to respond with ULAs, just not servers participating in the global authoritative DNS. Would you mind pointing to the normative source for this? > IPv6 kills NAT, so "scoped" addresses step in to fill the void and are overall a much better solution. But you said that ULA are global scope (which they are, I agree), so what does this have to do with scoped addresses? Also, which void exactly does killing NAT leave that needs filling (and that then supposedly is filled by ULA)?
    - dcow 9y ago
      It's all in the RFCs. Start here: https://tools.ietf.org/html/rfc4007 https://tools.ietf.org/html/rfc4007
      - zAy0LfpBZLC8mAC 9y ago
        ULA isn't even mentioned in that RFC? (Presumably because ULA was standardized half a year later?)
        dcow 9y ago
        Yes ULA is a different RFC.
        zAy0LfpBZLC8mAC 9y ago
        OK, so? Where exactly do you think are those things specified? Or do you expect me to re-read all IPv6 RFCs only to then repeat those questions because I still don't know where they are specified?