6 ms·

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly

by 4bpp 8y ago

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago now), the greater length of IPv6 headers had a quite measurable adverse impact on transmission latency of small packets (online gaming, remote shell...) - Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The way I see it, NAT and IP address reuse (especially together with some European countries' laws stipulating the address->identity mapping must be deleted within some time period) are the currently most widely rolled out privacy technology. Somewhere downthread, they talk about how Belgian police is trying to prevent ISPs from putting more than 16 customers behind the same internet address. Since I can hardly say everything I do on the internet is perfectly legal, what's bad for Belgian police is probably good for me.

z3phyr 8y ago
> Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The original tenet of the internet pretty much hinged on the idea that every person with a computer can host/self-publish information as well as consume other people's information in a distributed way. They will not have to depend on a centralized publishing authority. I think v6 could have enabled this
jjeaff 8y ago
I have no real first hand knowledge of this, but I have wondered if part of the reluctance of ipv6 is the fact that many of the "powers that be" use ip addresses to identify and group traffic and other activity from multiple devices. They also use ip addresses to block scrapers (both Google and Amazon do this heavily). With ipv6, an IP address can be completely disposable. You could scrape Google search results all day long and use a different address for each call. Heck, you could completely proxy search results in real time and create your own search engine, secretly using Google as your backend while injecting your own ads.
- nothrabannosir 8y ago
  Wouldn't you be bound to a specific subnet dedicated to you? Or how does it work? Can you really just propagate to the world at any time "I am now baba:fefe:..."? Don't backbone routing tables get crazy mad verbose that way? I know next to nothing about ipv6, I'm afraid.
  - Dagger2 8y ago
    It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet. Note that there's still no way to map a subnet to a person, just like there's no way to map a public v4 address to a person.
    - 4bpp 8y ago
      Huh, are you implying that with IPv6, the ISP can place multiple unrelated people in the same subnet but not coordinate with them regarding what address from the subnet they use? How does this work from a routing perspective? What if two people pick the same address? On the other hand, if the ISP ultimately does hand out the address in the subnet (and the end user can merely ask it for a new one), the ISP can retain a record of this, which together with the server-side data can be used to unambiguously deduce who accessed what, whereas the equivalent information in v4+NAT is insufficient without also logging everyone's connection metadata. It would therefore be more appropriate to say the privacy, tracking and banning implications are the same as dynamic IPv4 without NAT, where you can likewise request a new address from your provider at any time.
      - Dagger2 8y ago
        Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64. The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here. The ISP knows who has which prefix, because they handed them out, but the allocation of IPs inside that prefix is handled entirely by the end-user network. The ISP isn't involved in it, so they have no idea which IP is which computer. With NAT the LAN-side IPs are hidden from the ISP. In v6 the ISP can see the LAN part of the address, but without any way to identify which machine is using which IP that doesn't give them any extra information. All they get is the prefix and a random number. Computers typically change the random number on a regular basis too so you can't even do any long-term analysis on it.
gerdesj 8y ago
I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day. Now, for my gripes: - Try doing multi WAN effectively over IPv6 without PI and a routing algorithm, or NAT - Try changing ISP (new addressing everywhere) The second gripe I currently work around with RFC 4193 - Unique Local IPv6 Unicast Addresses, the first one I whine about and will probably use NPT (wholesale NAT for IPv6)
- 4bpp 8y ago
  > - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.) > - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh I wondered if this may be the case; I may need to rerun some tests. > - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day. A website I navigate to may, but how will the carrier fingerprint my browser? All in all, it seems like we are talking about very different threat models to privacy/security. You are worried about the likes of Google and Facebook profiling you, whereas I am worried about the likes of $intellectualpropertymonopolist sending me a $20k bill for identifying me in a torrent, or experiencing a nasty surprise at $nationalborder (or at home, [1]!) for something I said on an internet forum. (This does not seem like an abstract or overblown threat to me; I've seen 2 out of the 3 things above happen to friends and even one schoolmate more than 2 times.) [1] https://www.theguardian.com/uk/2012/nov/12/teenager-arrested-burning-poppy-facebook https://www.theguardian.com/uk/2012/nov/12/teenager-arrested...
lowercased 8y ago
Your point (and reply) about memorization was good. Yes, I'm not constantly remembering "210.40.138.43" but enough tech people need to remember some of these things - for debugging, support, etc - that IPv6 is painful. Asking someone to verify an IPv4 in a dialog setting is doable - an IPv6 is not. I've maintained for 2 decades that simply adding another 2 slots for 0-255 would have opened up a greatly usable amount. Every current v4 - 210.40.134.34 - would also be 0.0.210.40.134.34, but we'd have another 65000 groupings of 4 billion addresses to allocate as needed, and a transition would have been far easier (smaller space, less processing, easier to think about, etc).
- gerdesj 8y ago
  I use copy and paste for both IPv4 and IPv6 addresses. I understand where you are coming from by adding a few more bytes to the address scheme but one of the things IPv6 was designed for was massive address aggregation which means really short routing tables. Your 192.192.168.168.0.0 (say) scheme does not go far enough. Also, your scheme needs to be efficient in the world of bits and bytes and I don't think it is. Your scheme would probably need to be 64 bit to start with and not 48 bit because silicon, etc doesn't work like that. However that simple routing scheme was blown out of the water by private addressing - ie get your own ISP independent address range. When you change ISP you end up with another prefix and hence all your addresses change. All addresses. So you buy your own range (about £3000 set up and £3000 per year from memory. You also need an ISP(s) to route it and if more than one then a BGP peering arrangement. Another wrong in the name of IPv6: 64 bit IPv6 prefixes from an ISP means you can only have one subnet. No way to put your dodgy IoT stuff on its own VLAN.
  - AlphaSite 8y ago
    Sorry I'm not sure i understand: > Another wrong in the name of IPv6: 64 bit IPv6 prefixes from an ISP means you can only have one subnet. No way to put your dodgy IoT stuff on its own VLAN. Can't your router handle carving up a subnet just fine?
    - bdamm 8y ago
mirimir 8y ago
> Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The way I see it, NAT and IP address reuse (especially together with some European countries' laws stipulating the address->identity mapping must be deleted within some time period) are the currently most widely rolled out privacy technology. ... Although IPv6 doesn't have NAT, per se, it does have Network Prefix Translation (NPTv6). And some VPN services (FrootVPN and Perfect Privacy, for example) have already implemented that.
devdas 8y ago
NATs break end to end. This might be acceptable in a HTTP(s) only world though. Of course, some people aren't only using the Internet for browsing. The Internet of things will end up needing unique endpoints, and NAT does not play will with those either. India has a lot of people, and quite a few of them will be IPv6 only (or behind a very degraded carrier grade NAT). If you are talking to customers/clients/vendors there, assume you need IPv6. Memorising IP addresses isn't done in any larger scale network, you use DNS. NATs work well at about the scale of a single household, beyond that, they keep making things worse.
- theamk 8y ago
  > NATs break end to end. This might be acceptable in a HTTP(s) only world though. I was always curious about this argument -- do you mean that NAT elimination will allow any two arbitrary devices to communicate with each other? I would think that even in IPv6 world, the firewalls would still be a necessity. Most ISP would continue shipping routers with stateful firewall enabled by default (to prevent internet exploits), so any peer-to-peer software would still have to deal with UPnP/STUN/TURN. Sure, the STUN protocol will be simplified a bit because it would not need to worry about IP changing, but it would still be way more complex than just a simple connect() call. Note that the situation maybe better in some cases -- like for India or for cell phone networks -- but there would still be enough people behind the firewall to make arbitrary incoming connections unreliable. Related: the privacy extensions seem to be a pretty bad idea. I have no idea how would I set up a firewall to say "allow incoming traffic to my main laptop, port 22222" if it's IP address always changes. Ideas like "disable privacy extensions" and "filter by MAC" have their own significant downsides.
  - devdas 8y ago
    NAT elimination will indeed allow arbitrary devices to communicate with each other. Whether they do so will depend on the end users. Stateful packet filters will still be necessary, but those would be end user configurable. Keep in mind that you are thinking about a NAT you control. If your ISP is NATing you as well, you would have a very different impression.

by 4bpp 8y ago

z3phyr 8y ago

> Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The original tenet of the internet pretty much hinged on the idea that every person with a computer can host/self-publish information as well as consume other people's information in a distributed way. They will not have to depend on a centralized publishing authority. I think v6 could have enabled this

jjeaff 8y ago

I have no real first hand knowledge of this, but I have wondered if part of the reluctance of ipv6 is the fact that many of the "powers that be" use ip addresses to identify and group traffic and other activity from multiple devices. They also use ip addresses to block scrapers (both Google and Amazon do this heavily). With ipv6, an IP address can be completely disposable. You could scrape Google search results all day long and use a different address for each call. Heck, you could completely proxy search results in real time and create your own search engine, secretly using Google as your backend while injecting your own ads.

nothrabannosir 8y ago
Wouldn't you be bound to a specific subnet dedicated to you? Or how does it work? Can you really just propagate to the world at any time "I am now baba:fefe:..."? Don't backbone routing tables get crazy mad verbose that way? I know next to nothing about ipv6, I'm afraid.
- Dagger2 8y ago
  It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet. Note that there's still no way to map a subnet to a person, just like there's no way to map a public v4 address to a person.
  - 4bpp 8y ago
    Huh, are you implying that with IPv6, the ISP can place multiple unrelated people in the same subnet but not coordinate with them regarding what address from the subnet they use? How does this work from a routing perspective? What if two people pick the same address? On the other hand, if the ISP ultimately does hand out the address in the subnet (and the end user can merely ask it for a new one), the ISP can retain a record of this, which together with the server-side data can be used to unambiguously deduce who accessed what, whereas the equivalent information in v4+NAT is insufficient without also logging everyone's connection metadata. It would therefore be more appropriate to say the privacy, tracking and banning implications are the same as dynamic IPv4 without NAT, where you can likewise request a new address from your provider at any time.
    - Dagger2 8y ago
      Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64. The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here. The ISP knows who has which prefix, because they handed them out, but the allocation of IPs inside that prefix is handled entirely by the end-user network. The ISP isn't involved in it, so they have no idea which IP is which computer. With NAT the LAN-side IPs are hidden from the ISP. In v6 the ISP can see the LAN part of the address, but without any way to identify which machine is using which IP that doesn't give them any extra information. All they get is the prefix and a random number. Computers typically change the random number on a regular basis too so you can't even do any long-term analysis on it.

gerdesj 8y ago

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day. Now, for my gripes: - Try doing multi WAN effectively over IPv6 without PI and a routing algorithm, or NAT - Try changing ISP (new addressing everywhere) The second gripe I currently work around with RFC 4193 - Unique Local IPv6 Unicast Addresses, the first one I whine about and will probably use NPT (wholesale NAT for IPv6)

4bpp 8y ago
> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.) > - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh I wondered if this may be the case; I may need to rerun some tests. > - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day. A website I navigate to may, but how will the carrier fingerprint my browser? All in all, it seems like we are talking about very different threat models to privacy/security. You are worried about the likes of Google and Facebook profiling you, whereas I am worried about the likes of $intellectualpropertymonopolist sending me a $20k bill for identifying me in a torrent, or experiencing a nasty surprise at $nationalborder (or at home, [1]!) for something I said on an internet forum. (This does not seem like an abstract or overblown threat to me; I've seen 2 out of the 3 things above happen to friends and even one schoolmate more than 2 times.) [1] https://www.theguardian.com/uk/2012/nov/12/teenager-arrested-burning-poppy-facebook https://www.theguardian.com/uk/2012/nov/12/teenager-arrested...

lowercased 8y ago

Your point (and reply) about memorization was good. Yes, I'm not constantly remembering "210.40.138.43" but enough tech people need to remember some of these things - for debugging, support, etc - that IPv6 is painful. Asking someone to verify an IPv4 in a dialog setting is doable - an IPv6 is not. I've maintained for 2 decades that simply adding another 2 slots for 0-255 would have opened up a greatly usable amount. Every current v4 - 210.40.134.34 - would also be 0.0.210.40.134.34, but we'd have another 65000 groupings of 4 billion addresses to allocate as needed, and a transition would have been far easier (smaller space, less processing, easier to think about, etc).

gerdesj 8y ago
I use copy and paste for both IPv4 and IPv6 addresses. I understand where you are coming from by adding a few more bytes to the address scheme but one of the things IPv6 was designed for was massive address aggregation which means really short routing tables. Your 192.192.168.168.0.0 (say) scheme does not go far enough. Also, your scheme needs to be efficient in the world of bits and bytes and I don't think it is. Your scheme would probably need to be 64 bit to start with and not 48 bit because silicon, etc doesn't work like that. However that simple routing scheme was blown out of the water by private addressing - ie get your own ISP independent address range. When you change ISP you end up with another prefix and hence all your addresses change. All addresses. So you buy your own range (about £3000 set up and £3000 per year from memory. You also need an ISP(s) to route it and if more than one then a BGP peering arrangement. Another wrong in the name of IPv6: 64 bit IPv6 prefixes from an ISP means you can only have one subnet. No way to put your dodgy IoT stuff on its own VLAN.
- AlphaSite 8y ago
  Sorry I'm not sure i understand: > Another wrong in the name of IPv6: 64 bit IPv6 prefixes from an ISP means you can only have one subnet. No way to put your dodgy IoT stuff on its own VLAN. Can't your router handle carving up a subnet just fine?
  - bdamm 8y ago

mirimir 8y ago

> Why do people keep treating "you get your own unique IP address when browsing" as if it were an advantage? The way I see it, NAT and IP address reuse (especially together with some European countries' laws stipulating the address->identity mapping must be deleted within some time period) are the currently most widely rolled out privacy technology. ... Although IPv6 doesn't have NAT, per se, it does have Network Prefix Translation (NPTv6). And some VPN services (FrootVPN and Perfect Privacy, for example) have already implemented that.

devdas 8y ago

NATs break end to end. This might be acceptable in a HTTP(s) only world though. Of course, some people aren't only using the Internet for browsing. The Internet of things will end up needing unique endpoints, and NAT does not play will with those either. India has a lot of people, and quite a few of them will be IPv6 only (or behind a very degraded carrier grade NAT). If you are talking to customers/clients/vendors there, assume you need IPv6. Memorising IP addresses isn't done in any larger scale network, you use DNS. NATs work well at about the scale of a single household, beyond that, they keep making things worse.

theamk 8y ago
> NATs break end to end. This might be acceptable in a HTTP(s) only world though. I was always curious about this argument -- do you mean that NAT elimination will allow any two arbitrary devices to communicate with each other? I would think that even in IPv6 world, the firewalls would still be a necessity. Most ISP would continue shipping routers with stateful firewall enabled by default (to prevent internet exploits), so any peer-to-peer software would still have to deal with UPnP/STUN/TURN. Sure, the STUN protocol will be simplified a bit because it would not need to worry about IP changing, but it would still be way more complex than just a simple connect() call. Note that the situation maybe better in some cases -- like for India or for cell phone networks -- but there would still be enough people behind the firewall to make arbitrary incoming connections unreliable. Related: the privacy extensions seem to be a pretty bad idea. I have no idea how would I set up a firewall to say "allow incoming traffic to my main laptop, port 22222" if it's IP address always changes. Ideas like "disable privacy extensions" and "filter by MAC" have their own significant downsides.
- devdas 8y ago
  NAT elimination will indeed allow arbitrary devices to communicate with each other. Whether they do so will depend on the end users. Stateful packet filters will still be necessary, but those would be end user configurable. Keep in mind that you are thinking about a NAT you control. If your ISP is NATing you as well, you would have a very different impression.