10 ms·
Coming soon: Amazon launches free DNS service on 3.3.3.3 and 3.4.3.4? It's pretty crazy though that that huge range goes to Amazon in full. Wouldn't it have be
by Ambroos 8y ago
Coming soon: Amazon launches free DNS service on 3.3.3.3 and 3.4.3.4?
It's pretty crazy though that that huge range goes to Amazon in full. Wouldn't it have been better for the health of the internet as a whole to get them back to IANA for redistribution?
- adictator 8y agoHow else will we get people to adopt ipv6?
- Symbiote 8y agoBest for the internet is encouraging IPv6. There aren't extre fees for that, so people with less money are equal. Meanwhile, if Amazon is going to use all these in the medium-term future, that seems OK to me. (3.3.3.3 and 3.2.1.0 would be more memorable.)
- deleted 8y ago[deleted]
- Ocha 8y agoWhile 3.2.1.0 is a valid IP address, some users might experience problems with IP address ending in 0. It would not be a good idea to use 3.2.1.0 if you want best compatibility with all available hardware/software on the market.
- TazeTSchnitzel 8y agor-really? What do people do with routers that use 192.168.1.0?
- eli 8y agoIt's probably less of an issue when you're on a local network with the device you're trying to connect to. That said, I think 192.168.0.1 (ending in a 1) is much more common.
- isostatic 8y agoA /23 with the router in the middle of it? Surely that can't be common. If someone actually chose that (to be annoying or security through obscurity or whatever) then they know what they're doing DHCP giving out a client address of 192.168.1.0 in the middle of a lagre block sure, but a router?
- dcow 8y agoRouters being the “bottom of the block” in a subnet is just convention. In fact I’d say someone with a router in the “middle” of a block probably knows exactly what they are doing.
- isostatic 8y agoAnd thus would be able to change it if they actually had a problem with ip stacks failing on valid .0 or .255 ips
- floatingatoll 8y agoTo potentially clarify here: Many home routers issue IPs using the follow netblock: Network: 192.168.1.0 Netmask: 255.255.255.0 (/24) Broadcast: 192.168.1.255 Gateway: 192.168.1.1 (the first valid IP in that block) or less often .254 (the last valid IP in that block) So for the past thirty years, nearly _every_ network block issued by _any_ network admin used /24, to the point that some things simply refuse .0 and .255 as valid IP addresses. The suggestion upstream is to set up the IP 3.2.1.0, within _any_ network block that can contain it legally. If you adhere to strict netmasking, that'd be (this is from memory, correct me if I'm wrong): Network: 3.2.0.0 Netmask: 255.255.254.0 (/23) Broadcast: 3.2.1.255 Which would provide a contiguous block of valid IPs from 3.2.0.1 through 3.2.1.254, _including_ the two perfectly valid IPs 3.2.0.255 and 3.2.1.0. Those valid IPs end in .255 and .0, which is completely legal since they're in the middle of a /23, and the default gateway wouldn't be anywhere near them. A lot of human-operated networks will blacklist issuing .0, .1, .254, .255 on the theory that it's simpler to just prohibit them and lose 4 IPs per /24 within a block, than deal with what's truly possible for a /23 or wider block. EDIT: Public BGP requires /24 or wider, and /24 cannot contain .0 or .255 as a valid IP, so the next widest is /23, which can contain even-numbered .x.255 and .x+1.0. If you're doing this on an internal network that permits narrower subnets, the narrowest available would be a /30, based (irregularly) on either .1.254 or .1.255: Network: 3.2.0.254 (or .255) Netmask: 255.255.255.252 (/30) Broadcast: 3.2.1.1 (or .2) With 3.2.1.0 as the live IP and either 3.2.0.255 or 3.2.1.1 as the in-network gateway for that device.
- zamadatix 8y ago> Public BGP requires /24 or wider, and /24 cannot contain .0 or .255 as a valid IP That requirement is about how you advertise your routes not how you subnetted the internal network. .0 and .255 of your advertised /24 can work fine as /32s on the server. Using the internet FW to NAT the network and broadcast addresses is another common trick to get more addresses, particularly when you only get an e.g. /29 from a carrier who is just routing that /29 to your specified next hop and 2 more addresses is a big bump.
- floatingatoll 8y agoYou can also use a fake IP for the default gateway on a wholly different segment with local segment ARP, or an IPv6 default router with 4-wrapping, or set up a router that uses promiscuous mode to capture all packets it receives from your “default route eth0” host. These are all irregular solutions, though, so I didn’t want to go too deep into the confusing weeds.
- ghshephard 8y agoI wouldn't bet my life on it, but I've never experienced a problem with an IP address ending in 0, and I've been using them for over 10 years. Our primary VPN end-point used to end in .0 - so we had lots of opportunity to find chance for breakage. :-)
- ryan-c 8y agoI have, actually. Most of our networks were /23s, and the syslog server was a .0 in the middle of one. An SMS sending appliance we bought would not accept IPs ending in .0. Fortunately, the check was client-side in javascript, and once overridden, everything worked.
- nathancahill 8y ago> in javascript Spotted your problem.
- duskwuff 8y agoIIRC, IPs ending in .0 or .255 were unreachable from some older Windows systems.
- oasisbob 8y agoThat's been my experience too. Even in 2003, the network I was involved in was handing out .0s out of larger CIDR blocks in DHCP leases with no issues.
- wpietri 8y agoDo you have an example? I could possibly imagine this being a problem on a local /24, in that after you apply the netmask the local part is all zero bits. But for a remote DNS server, I cannot fathom how this could be a problem.
- johnklos 8y agoAnything that cares about the zeroth IP of a destination not on the local subnet is broken. Anything that caters to broken is worrying about the wrong things.
- crunchlibrarian 8y agoCatering to the broken is like 90% of every developer and data scientist's day. I've spent the past two weeks just trying to fix some horribly wrong/invalid data that is absolutely positively guaranteed to always be correct due to certain standards and lots of money and one of the biggest best tech companies in the world stands behind it. Guess what it's still broken they just refuse to admit it.
- harryh 8y agoJon Postel (who wrote an early specification) of TCP would like to have a word with you: "be conservative in what you do, be liberal in what you accept from others"
- oxguy3 8y agoI like the spirit of this, but the problem is that it only works if everyone operates at least somewhat in line with it. If you're liberal in what you accept, then people are going to start being liberal in what they send, and soon we'll have a proper mess on our hands. And there's no takebacks -- once you start permitting something, you can't take it away later, or you'll break things. You're creating more legacy requirements that may cause you problems when you try to evolve in the future. As a web developer, I can only dream of how clean web standards might be today if the browsers of yore were a bit more conservative.
- floatingatoll 8y agoCloudflare's work with 1.1.1.1 has demonstrated not only that it's _possible_ to use a previously-unusable IP address, but that it's _valuable_ to do so because it compels reporting of – and repair of – broken hardware and software on the market.
- PhantomGremlin 8y agoThe cynic in me thinks that inbound traffic on 1.1.1.1 is "valuable" mostly to help balance Cloudflare's inbound vs outbound data flows. This balance is important in deciding whether their peering is settlement free. They're a CDN and send out a lot of bits, so every last bit of inbound traffic helps. Or am I totally off base on this?
- Something1234 8y agoI'm 95 percent sure that every dns response is bigger than the request, so it might not help much. Although if they're getting a lot of garbage in it might be helpful.
- mastazi 8y agoIt depends on what methodology is used to classify traffic as inbound/outbound. The large DNS response in your example counts as outbound packets, but it's part of an inbound TCP connection. I don't know how peering agreements work.
- Something1234 8y agoInteresting. I would have thought that they would go with the simplest measure possible, bytes in vs bytes out.
- oAlbe 8y agoPardon the ignorance, but I'm curious: why is it important for them (or anybody) to receive inbound traffic, given they offer 1.1.1.1 for free? And also what does it mean "This balance is important in deciding whether their peering is settlement free."?
- rootbear 8y agoI might be tempted to use 3.1.4.1, or 3.1.4.2, if you round. Or those could resolve to a Raspberry Pi AWS instance :)
- benatkin 8y agoI'd avoid the rounding by using double digits... 3.14.15.9
- jandrese 8y ago3.141.59.27 But instead I would want a webserver on there that just serves up digits of Pi.
- gpvos 8y agoTwist: it serves up digits of e.
- saalweachter 8y agoTwist: it serves up the first 10 digits of pi followed by e[10:].
- gpvos 8y agoNow that's just evil. (Better do it from the 100th digit or so to make it less obvious.)
- benatkin 8y agoThat would have a different answer based on whether you rounded or truncated. It would be 3.141.59.26 if you truncated.
- auscompgeek 8y agoIt would also be 3.141.59.26 if you round half towards even.
- rustcharm 8y agoI'd rather companies like Amazon or Microsoft has them, in a way that people can cheaply rent them along with compute power at competitive rates, than companies like "Prudential" or some giant bank sit on them.
- WorldMaker 8y agoIt probably wouldn't be better for the health of the internet. At this point it seems like a desperate play by a company with deeply entrenched IPv4-only infrastructure (hi EC2) to eke out more time without major upgrades. Meanwhile IPv4 addresses remain scarce for small ISPs, and the (healthy, natural) push to IPv6 infrastructure continues apace everywhere else.
- athenot 8y agoAWS is IPv4-only? Can you elaborate? It seems IPv6 is pretty well supported. https://docs.aws.amazon.com/vpc/latest/userguide/get-started-ipv6.html https://docs.aws.amazon.com/vpc/latest/userguide/get-started...
- WorldMaker 8y agoI wasn't implying it was IPv4 only, I was merely teasingly repeating rumors that a lot of low level infrastructure still has IPv4 assumptions that Amazon has had enough IPv4 addresses to date that they don't need fix those underlying assumptions in their data centers. It's mostly dumb rumor mongering, I suppose, as I'm not sure I have a citation for that off hand other than other HN jabs at Amazon/AWS. I'm sorry for that, it was an unnecessary jab/tease, that I will blame on pre-coffee brain.
- cperciva 8y agoThey used to -- that's why IPv6 was so slow to arrive. But that's fixed now except possibly in some parts of "legacy EC2".
- deleted 8y ago[deleted]
- rustcharm 8y agoWe have IPv4 and IPv6 public interfaces on our AWS services.
- 8y ago
- ocdtrekkie 8y agoThen what I need is a DNS client on my PC which can use all these major DNS services, but at random to provide incomplete DNS info to any given one, so it'll maybe query any random two, confirm they respond the same to verify nobody's playing unfair.
- insomniacity 8y agoOn Linux (and OSX?) you could run a local resolver configured to do round-robin? Comparing answers would probably be new functionality though.
- 540297 8y ago> Then what I need is a DNS client on my PC which can use all these major DNS services, but at random to provide incomplete DNS info to any given one, so it'll maybe query any random two, confirm they respond the same to verify nobody's playing unfair. What kind of tricks are you afraid of these DNS services could get up to?
- ocdtrekkie 8y agoWell, DNS is both a significant way one could profile what types of information a given connection is used for and could be used to profile you, so I want to give a DNS provider incomplete information where possible. And as DNS is also a common way to redirect or censor traffic, I feel like there'd be value in a system that would double check that everyone's sending me to the same place. If I get inconsistent results, I could dump both and query two other ones in the pool.
- voltagex_ 8y agoThe problem I have there is that Akamai and other CDNs seem to return different results if I'm using my ISP's resolvers vs any others. Getting good local nodes is important in a bandwidth constrained (and far away) environment like Australia.
- cosmie 8y agoDNSCrypt-Proxy[1] already supports the randomized DNS resolver need[2]. It also supports DNS-over-HTTPS, providing assurance that even your ISP won't be able to snoop on all of your DNS queries. While it doesn't support live comparison of DNS results, it can log out entries per DNS resolver and you can post-process those logs to validate their responses against each other, considering your queries will over time hit different resolvers. Not perfect since there are legitimate reasons to return different responses over time, but it's something. [1] https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy [2] https://github.com/jedisct1/dnscrypt-proxy/wiki/Load-Balancing-Options https://github.com/jedisct1/dnscrypt-proxy/wiki/Load-Balanci...
- jhoechtl 8y agoI think your statement answers pretty well an observation made earlier: Why is IPv6 adoption so bad? I see little incentive for anyone as long as IPv4 is such a profitable business with IP addresses being traded as an asset. IPv6 and equality to the masses? Would be nice but economy took adifferent turn
- dagenix 8y agoThat's fully backwards. The people with the incentive to delay moving to IPV6 are the ones selling IPs. Those buying - ISPs - are also the ones that have the incentive to move to IPV6 as in an IPV6 world, they wouldn't have the spend that money. And ISPs are the ones best positioned for further IPV6. That IPV6 adoption is slow is precisy because buying ranges of IPV4 addresses is still cheap enough that people are doing it.
- sarah180 8y agoI don't think this analysis is correct. Imagine Chrome started charging small amounts of bitcoin for each HTTP request but Firefox still allowed free access. I don't think you'd say "I'm now incentivized to use Chrome because I have to have an artificial scarce resource." ISPs can basically get all the IPv6 resources they need, but IPv4 addresses are becoming scarce and costly. Amazon just spent a lot of money to get more IPv4 addresses: that's cost, not profit. If Amazon owned all the addresses and they were making great profits as a monopoly seller, this would indeed be an incentive not to move to IPv6. Instead, it's really just driving up people's costs. Adoption is slow because the extra costs of IPv4 addresses are still smaller than the costs of really getting every piece of infrastructure and software working correctly with IPv6. We're not that far away, but there's a bit of a chicken-and-egg problem until we're close enough that people can start to turn off IPv4 and effectively force stragglers to adopt.
- dasil003 8y agoWhen an equivalent solution becomes cheaper that's a recipe for disruption, not the other way around.
- cm2187 8y agoISP are really the bottleneck for IPv6 adoption. Pretty much all the infrastructures of the internet (network, datacentres, clouds) support it now.
- swarnie_ 8y agoAmazon rank up there just behind Google and Facebook in the list of companies i don't want harvesting any more data from me.
- PC_LOAD_LETTER 8y agoAmazon is on the extreme end of the customer-privacy side. Wtf are you talking about? If you're going to put them in a bucket, they belong with Apple.
- Retric 8y agoAmazon’s recommendation engine says differently. Retail in general wants to know a lot about you. PS: I don’t know about Amazon Echo, but it’s definitely on the creepy side of data privacy.
- caymanjim 8y agoIP block allocation has nothing whatsoever to do with harvesting your data.
- pyrale 8y agoGp was probably reacting to the dns idea.
- senozhatsky 8y agoWish it was 3.14.15.92 -ss
- maemilius 8y agoNah, they'll assign that one to something python related. (Get it? pi-thon. I'll see myself out...)
- chaoticmass 8y agoIt would get used up quickly and we'd be right back where we are.
- gtdawg 8y agoWhy not 3.0.0.0 or 3.255.255.255 ?
- hiimnate 8y ago3.0.0.0 is the network address, and cannot be assigned to a host. 3.255.255.255 is the broadcast address, and cannot be assigned to a host.
- thomseddon 8y agoBoth are valid addresses and can be assigned to hosts. Network address is only really used for directly attached networks, non directly attached networks will route to any address in the block correctly. Same for broadcast address, they're also relative to whatever block you're talking about at the time, so whilst 3.255.255.255 is the broadcast for 3.0.0.0/8 subnet it's just another "usable" address in the 3.0.0.0/5 subnet and when you send a packet then you, and probably your router, don't know what subnets in use on the other side :) (unless it's directly attached)
- parliament32 8y agoThere's no reason why you can't assign 3.0.0.0 to a host, it'll work fine. Just make sure you don't put anything else there by convention. 3.255.255.255 would be the default broadcast address, but not only can you use a different address (in fact, any address you want for broadcast, you just need to configure it), but this is also not a real /8... it's 3.0.0.0/15 according to ARIN. https://whois.arin.net/rest/net/NET-3-0-0-0-2/pft?s=3.0.0.0 https://whois.arin.net/rest/net/NET-3-0-0-0-2/pft?s=3.0.0.0 3.255.255.255 is default broadcast for 3.128.0.0/9.
- icedchai 8y agoThey delegated 3.0.0.0/15 to Singapore, out of the AWS 3.0.0.0/9 block, which is adjacent to their 3.128.0.0/9 block... which gives them all of 3.0.0.0/8... Broadcast addresses have no meaning outside of a broadcast domain / subnet. Nobody would use a full /9 as a subnet. It would be split into much smaller blocks...
- Kalium 8y ago> Coming soon: Amazon launches free DNS service on 3.3.3.3 and 3.4.3.4? Do they then cover Seattle in stickers and chalking with 3.3.3.3?