3 ms·

Nice analysis. And locator-ID split idea in (3) is fun. However, (3) is tricky in itself - you still need the routing info to come from somewhere. And, would no

by ay 16y ago

Nice analysis. And locator-ID split idea in (3) is fun. However, (3) is tricky in itself - you still need the routing info to come from somewhere. And, would not matter too much whether it is IPv6 or another layer of IPv4 that are used as locators - or did I miss something in the argument ? Peering for the IPv6 should be roughly the same as now for IPv4. The scarsity dynamics and the cost of v4 vs. v6 is something I totally agree with. And with the fact that NATs are not evil per se. They're a tool just like IPv* is.

loup-vaillant 16y ago
> NATs are not evil per se. They're a tool just like IPv is* "Nukes are not evil per se. They're a tool just like knives are." Please avoid this kind of sentence. They're void of content, and therefore can't be contradicted, but at the same time they convey wrong ideas. Here for instance, I can't think of any direct usage of nukes that isn't evil. Because nuke explosions automatically kill people and ruin the environment. Likewise, I can't think of any usage of NATs on behalf of other people which isn't evil (though much less so). Because, you automatically end up closing all receiving ports, and they can't re-open them.
- ay 16y ago
  "They're void of content" - no, they are just a restatement that any technology is only as evil as its use. Think P2P. One can argue it is evil because its predominant use is to distribute pirated content. But it is not. Similarly, nukes were seriously considered for plugging the oil leak - to name one recent example. If you can't think of any usage of NAT that is not harmful - it does not mean there isn't one. To start, what you mention - the stateful nature of the NATs (one of the reasons why people fight so hard to have them) - is a useful security property and is very frequently sought after by the people who want to put the NATs in IPv6. Check my vid on xtranormal that I mentioned in another message. What is harmful in NATs is that they destroy the end-to-end referrals (and when they remap the numeric ports to different ones, too). Another example of NATs that is useful and is widely used is the load balancer. It is exactly NAT, but put inside-out. Sometimes even doing SSL decapsulation. And you can use round-robin destination NAT as a poor man's loadbalancer technique (how useful it is today, is another story). To summarize: NATs are like recreational drugs. Pleasant in small dozes, lethal when uncontrolled. And people can not control themselves in using them.
  - loup-vaillant 16y ago
    > "They're void of content" - no, they are just a restatement that any technology is only as evil as its use Which is exactly what I meant by "void of content". This sentence is self evident, almost a tautology. About NAT themselves, I wasn't talking about using them for yourself, but using it for your customers. But that's probably what you mean by "uncontrolled use of NAT". About the load balancer, wouldn't the problem be solved with SRV records? Anyway, it appears from your other comments that we basically agree on everything. So let's not fight.
    - ay 16y ago
      "This sentence is self evident, almost a tautology." - Ok, probably I misinterpreted your comment about the NATs being evil, apologies. "About the load balancer, wouldn't the problem be solved with SRV records?" - the SRVs would certainly help a lot - however, the predominant user of the load-balancers, the web browsers, are not using SRV and not planning to. The http://tools.ietf.org/html/draft-jennings-http-srv-00 http://tools.ietf.org/html/draft-jennings-http-srv-00 which proposed it (and which possibly could have been used by the clients too) - now got pushed into something that would never be possible to use by the browsers. Re. agreement - yes, I think we do agree.
      - loup-vaillant 16y ago
        > The http://tools.ietf.org/html/draft-jennings-http-srv-00 http://tools.ietf.org/html/draft-jennings-http-srv-00 which proposed it […] - now got pushed into something that would never be possible to use by the browsers. That would really suck. Could you elaborate, or send me a link, please ?
        ay 16y ago
        You can remove the -00 and look through the history of the doc - it's now at a later revision.

by ay 16y ago

loup-vaillant 16y ago

> NATs are not evil per se. They're a tool just like IPv is* "Nukes are not evil per se. They're a tool just like knives are." Please avoid this kind of sentence. They're void of content, and therefore can't be contradicted, but at the same time they convey wrong ideas. Here for instance, I can't think of any direct usage of nukes that isn't evil. Because nuke explosions automatically kill people and ruin the environment. Likewise, I can't think of any usage of NATs on behalf of other people which isn't evil (though much less so). Because, you automatically end up closing all receiving ports, and they can't re-open them.

ay 16y ago
"They're void of content" - no, they are just a restatement that any technology is only as evil as its use. Think P2P. One can argue it is evil because its predominant use is to distribute pirated content. But it is not. Similarly, nukes were seriously considered for plugging the oil leak - to name one recent example. If you can't think of any usage of NAT that is not harmful - it does not mean there isn't one. To start, what you mention - the stateful nature of the NATs (one of the reasons why people fight so hard to have them) - is a useful security property and is very frequently sought after by the people who want to put the NATs in IPv6. Check my vid on xtranormal that I mentioned in another message. What is harmful in NATs is that they destroy the end-to-end referrals (and when they remap the numeric ports to different ones, too). Another example of NATs that is useful and is widely used is the load balancer. It is exactly NAT, but put inside-out. Sometimes even doing SSL decapsulation. And you can use round-robin destination NAT as a poor man's loadbalancer technique (how useful it is today, is another story). To summarize: NATs are like recreational drugs. Pleasant in small dozes, lethal when uncontrolled. And people can not control themselves in using them.
- loup-vaillant 16y ago
  > "They're void of content" - no, they are just a restatement that any technology is only as evil as its use Which is exactly what I meant by "void of content". This sentence is self evident, almost a tautology. About NAT themselves, I wasn't talking about using them for yourself, but using it for your customers. But that's probably what you mean by "uncontrolled use of NAT". About the load balancer, wouldn't the problem be solved with SRV records? Anyway, it appears from your other comments that we basically agree on everything. So let's not fight.
  - ay 16y ago
    "This sentence is self evident, almost a tautology." - Ok, probably I misinterpreted your comment about the NATs being evil, apologies. "About the load balancer, wouldn't the problem be solved with SRV records?" - the SRVs would certainly help a lot - however, the predominant user of the load-balancers, the web browsers, are not using SRV and not planning to. The http://tools.ietf.org/html/draft-jennings-http-srv-00 http://tools.ietf.org/html/draft-jennings-http-srv-00 which proposed it (and which possibly could have been used by the clients too) - now got pushed into something that would never be possible to use by the browsers. Re. agreement - yes, I think we do agree.
    - loup-vaillant 16y ago
      > The http://tools.ietf.org/html/draft-jennings-http-srv-00 http://tools.ietf.org/html/draft-jennings-http-srv-00 which proposed it […] - now got pushed into something that would never be possible to use by the browsers. That would really suck. Could you elaborate, or send me a link, please ?
      - ay 16y ago
        You can remove the -00 and look through the history of the doc - it's now at a later revision.