4 ms·

NAT has crippled the Internet. We are permanently dependent on public facing servers to route packets from one device to the other. This service is absolutely

NAT has crippled the Internet. We are permanently dependent on public facing servers to route packets from one device to the other. This service is absolutely not needed in a non-NAT world. And I strongly believe we have lost a lot by being completely dependent on client-server model of Internet. I've written more about it here https://www.ankshilp.in/post/the_broken_promise_of_internet/ https://www.ankshilp.in/post/the_broken_promise_of_internet/

tambre 7y ago
Fortunately we're being uncrippled again by the continued deployment of IPv6 [0]. [0]: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- dmix 7y ago
  Germany (44%) and Belgium (53%) are killing it! The biggest surprise is India matching the US, must be that Indian mobile company that people mentioned here the other day? I'd love to see similar graphs for TLS. Edit: Google shows it only for Chromium sampling but it's nearly 90% in most countries which is almost double what it was before the Snowden leaks: https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview
  - rohan1024 7y ago
    Yes! It's the same company. There network was ipv6 ready since day one.
  - TrueDuality 7y ago
    Honestly I think the adoption of TLS has more to do with free certificates from LetsEncrypt and CloudFlare than the Snowden leaks. As much as I'd like to think people were concerned about the privacy of their communications... I don't think most of the masses actually care about security or avoid conveniences based on threats to their privacy...
    - ultrarunner 7y ago
      “The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least bit surprised if a high-level view showed Snowden having a lot to do with it.
      - TrueDuality 7y ago
        LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe" warnings that occasionally pop up.
        indigo945 7y ago
        If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. SSL helps against the skript kiddie at your local Starbucks, not against the NSA. (Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)
        gruez 7y ago
travbrack 7y ago
Buckle up because it'll be a while before ipv6 gets mass adoption and folks will need to support v4 long after that.
- ultrarunner 7y ago
  I remember (upon mentioning my excitement regarding IPv6) this exact sentiment over a decade ago. It was accurate then, and it’s accurate now.
jfries 7y ago
I'm probably missing something, but I think that, for home networks at least, NAT is wonderful because of how it requires some effort to make devices exposed on the external network. If we were given an unlimited supply of IP addresses from the ISP and all devices were accessible externally, it seems security issues in would be a much larger problem.
- rohan1024 7y ago
  The original purpose of NAT was to get additional devices connected to Internet since we had shortage of Ipv4 addresses. For security, we have firewalls. If we had not been dependent on NAT for security, firewalls would have been actually configured. We will have to configure firewalls with ipv6 anyway.
  - dboreham 7y ago
    NAT arose long before any address shortage concerns. Rather it was a response to ISPs attempting to charge "per user" by associating a fee with each additional address (note this is long before residential ISP service we know today: Internet service was for businesses with retail subs only having ppp access via dialup). NAT allowed customers to work around the ISPs pricing model at the time.
    - phate 7y ago
      When my family first got broadband via Comcast@home back in the early 2000s they had a proviso saying if you wanted more then one computer required a separate subscription. My dad and my bother quickly figured out we could get around this by using Windows Internet Connection Sharing. We eventually got a Linksys Router that did the same job and was faster. IIRC even most dial up ISPs did the same thing, if you wanted more then one computer online you had to use separate creds.
- TrueDuality 7y ago
  NAT is definitively not a security layer and was never intended as such. You can get better security with a simple stateful ingress firewall (block packets not associated with an established/related connection) which is what most people think of for security with NAT. The only slight benefit it has imparted is the privacy benefit of hiding multiple devices behind a single address, but they can usually be individually profile anyway.
jarcane 7y ago
I honestly think the fault here is not technical, it's ISPs. Between the RIAA/MPAA breathing down their necks about piracy, and the realization they could make a mint charging inflated "business rates" than letting you do what you wanted with your own damn internet connection, shit got locked up tight so fast no one even noticed. It's not NAT that's why my ISP is blocking half the protocols on the Internet. Why every ISP I've had for the last decade has blocked outgoing HTTP. Why I'd need to us a fucking VPN tunnel just to get SSH to my home computer. It's greed. It's the forgotten front of the net neutrality fight, and it's gone almost entirely ignored. We don't have the right to our own outgoing traffic anymore, and this has been the case for far longer than IP allocation has been an issue.
- smittywerben 7y ago
  > Why I'd need to us a fucking VPN tunnel just to get SSH to my home computer. My most recent disappointment was trying to mount an Azure SMB 3.0 network drive over port 445. It would function just like a network drive at work or school right? No more poorly made userland daemons i.e. Dropbox. Or any additional software, VPN, proxy, or admin rights for that matter. Just click “add network drive” button in explorer and paste in the URI. But nope port 445 is blocked by ISPs. So ironically the cheaper storage is only usuable by business internet plans. Which seems sorta atypical.
  - stepbeek 7y ago
    I ran into this with a client recently. Unfortunately, they were already on the business plan. We ended up just hosting an OpenVPN server and having them connect automatically on startup.... This then broke Microsoft Office's ability to verify it still has a paid subscription.
  - toast0 7y ago
    SMB ports being blocked is unfortunate, but it was probably the only reasonable response to all the worms and stuff that were going around on those ports.
neilv 7y ago
My first always-on home Internet was ADSL that came with 2 static IPv4 addrs and no filtering. I ran a server for my own needs, including hosting my own SMTP server, SSH, and SCM for my home directory&projects replication&backup. At one point, I temporarily hosted a friend's server on my home second IP addr, while he was moving apartments and had a long lead time to move SDSL to the new place. Unbeknownst to me, it wasn't just an email server, but, I learned after the fact, was also hosting a political activism Web site, advocating freeing a person who was in trouble with a government. (I assume friend didn't tell me in an attempt to not to involve me in any possible government disfavor, though I really wished he'd found a different way to host that.) This was before such activism was done by letting 'social media' companies own and intimately monitor the network and organizing/communications of people involved/interested in any movement. But earlier wasn't ideal either: if you wanted a decent Internet presence, including with your own domain name, you might've had to know how to set up a server, and be able to afford to operate it.
guilhas 7y ago
Besides the number of ips what are the advantages? ipv6 vs ipv4 Which one is better for privacy? Which one is better for security? Which one is better for speed? Which is easier to configure? Which is better for end user? Which is better for advanced user / net admin? Which is better for companies?
- zAy0LfpBZLC8mAC 7y ago
  > Besides the number of ips what are the advantages? That is the primary advantage ... or rather all the consequences of having globally unique addresses for everything available with minimal administrative overhead. > ipv6 vs ipv4 Which one is better for privacy? Rarely makes a difference (web tracking happens via cookies anyway), and IPv6 has a huge potential of enabling less centralized protocols. > Which one is better for security? IPv6, because one flat address space without translators is easier to reason about and doesn't need so many workarounds to make connections work. > Which one is better for speed? According to what large content companies publish, IPv6 is usually quite a bit faster (lower latency), rarely slightly slower. > Which is easier to configure? IPv6 > Which is better for end user? Directly? Doesn't really matter. Indirectly? IPv6. > Which is better for advanced user / net admin? IPv6 hands down. > Which is better for companies? IPv6, unless you have to deal with legacy software that doesn't want to speak IPv6.
solotronics 7y ago
As a network engineer I believe IPv6 is the answer.

tambre 7y ago

Fortunately we're being uncrippled again by the continued deployment of IPv6 [0]. [0]: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html

dmix 7y ago
Germany (44%) and Belgium (53%) are killing it! The biggest surprise is India matching the US, must be that Indian mobile company that people mentioned here the other day? I'd love to see similar graphs for TLS. Edit: Google shows it only for Chromium sampling but it's nearly 90% in most countries which is almost double what it was before the Snowden leaks: https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview
- rohan1024 7y ago
  Yes! It's the same company. There network was ipv6 ready since day one.
- TrueDuality 7y ago
  Honestly I think the adoption of TLS has more to do with free certificates from LetsEncrypt and CloudFlare than the Snowden leaks. As much as I'd like to think people were concerned about the privacy of their communications... I don't think most of the masses actually care about security or avoid conveniences based on threats to their privacy...
  - ultrarunner 7y ago
    “The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least bit surprised if a high-level view showed Snowden having a lot to do with it.
    - TrueDuality 7y ago
      LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe" warnings that occasionally pop up.
      - indigo945 7y ago
        If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. SSL helps against the skript kiddie at your local Starbucks, not against the NSA. (Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)
        gruez 7y ago

travbrack 7y ago

Buckle up because it'll be a while before ipv6 gets mass adoption and folks will need to support v4 long after that.

ultrarunner 7y ago
I remember (upon mentioning my excitement regarding IPv6) this exact sentiment over a decade ago. It was accurate then, and it’s accurate now.

jfries 7y ago

I'm probably missing something, but I think that, for home networks at least, NAT is wonderful because of how it requires some effort to make devices exposed on the external network. If we were given an unlimited supply of IP addresses from the ISP and all devices were accessible externally, it seems security issues in would be a much larger problem.

rohan1024 7y ago
The original purpose of NAT was to get additional devices connected to Internet since we had shortage of Ipv4 addresses. For security, we have firewalls. If we had not been dependent on NAT for security, firewalls would have been actually configured. We will have to configure firewalls with ipv6 anyway.
- dboreham 7y ago
  NAT arose long before any address shortage concerns. Rather it was a response to ISPs attempting to charge "per user" by associating a fee with each additional address (note this is long before residential ISP service we know today: Internet service was for businesses with retail subs only having ppp access via dialup). NAT allowed customers to work around the ISPs pricing model at the time.
  - phate 7y ago
    When my family first got broadband via Comcast@home back in the early 2000s they had a proviso saying if you wanted more then one computer required a separate subscription. My dad and my bother quickly figured out we could get around this by using Windows Internet Connection Sharing. We eventually got a Linksys Router that did the same job and was faster. IIRC even most dial up ISPs did the same thing, if you wanted more then one computer online you had to use separate creds.
TrueDuality 7y ago
NAT is definitively not a security layer and was never intended as such. You can get better security with a simple stateful ingress firewall (block packets not associated with an established/related connection) which is what most people think of for security with NAT. The only slight benefit it has imparted is the privacy benefit of hiding multiple devices behind a single address, but they can usually be individually profile anyway.

jarcane 7y ago

I honestly think the fault here is not technical, it's ISPs. Between the RIAA/MPAA breathing down their necks about piracy, and the realization they could make a mint charging inflated "business rates" than letting you do what you wanted with your own damn internet connection, shit got locked up tight so fast no one even noticed. It's not NAT that's why my ISP is blocking half the protocols on the Internet. Why every ISP I've had for the last decade has blocked outgoing HTTP. Why I'd need to us a fucking VPN tunnel just to get SSH to my home computer. It's greed. It's the forgotten front of the net neutrality fight, and it's gone almost entirely ignored. We don't have the right to our own outgoing traffic anymore, and this has been the case for far longer than IP allocation has been an issue.

smittywerben 7y ago
> Why I'd need to us a fucking VPN tunnel just to get SSH to my home computer. My most recent disappointment was trying to mount an Azure SMB 3.0 network drive over port 445. It would function just like a network drive at work or school right? No more poorly made userland daemons i.e. Dropbox. Or any additional software, VPN, proxy, or admin rights for that matter. Just click “add network drive” button in explorer and paste in the URI. But nope port 445 is blocked by ISPs. So ironically the cheaper storage is only usuable by business internet plans. Which seems sorta atypical.
- stepbeek 7y ago
  I ran into this with a client recently. Unfortunately, they were already on the business plan. We ended up just hosting an OpenVPN server and having them connect automatically on startup.... This then broke Microsoft Office's ability to verify it still has a paid subscription.
- toast0 7y ago
  SMB ports being blocked is unfortunate, but it was probably the only reasonable response to all the worms and stuff that were going around on those ports.

neilv 7y ago

My first always-on home Internet was ADSL that came with 2 static IPv4 addrs and no filtering. I ran a server for my own needs, including hosting my own SMTP server, SSH, and SCM for my home directory&projects replication&backup. At one point, I temporarily hosted a friend's server on my home second IP addr, while he was moving apartments and had a long lead time to move SDSL to the new place. Unbeknownst to me, it wasn't just an email server, but, I learned after the fact, was also hosting a political activism Web site, advocating freeing a person who was in trouble with a government. (I assume friend didn't tell me in an attempt to not to involve me in any possible government disfavor, though I really wished he'd found a different way to host that.) This was before such activism was done by letting 'social media' companies own and intimately monitor the network and organizing/communications of people involved/interested in any movement. But earlier wasn't ideal either: if you wanted a decent Internet presence, including with your own domain name, you might've had to know how to set up a server, and be able to afford to operate it.

guilhas 7y ago

Besides the number of ips what are the advantages? ipv6 vs ipv4 Which one is better for privacy? Which one is better for security? Which one is better for speed? Which is easier to configure? Which is better for end user? Which is better for advanced user / net admin? Which is better for companies?

zAy0LfpBZLC8mAC 7y ago
> Besides the number of ips what are the advantages? That is the primary advantage ... or rather all the consequences of having globally unique addresses for everything available with minimal administrative overhead. > ipv6 vs ipv4 Which one is better for privacy? Rarely makes a difference (web tracking happens via cookies anyway), and IPv6 has a huge potential of enabling less centralized protocols. > Which one is better for security? IPv6, because one flat address space without translators is easier to reason about and doesn't need so many workarounds to make connections work. > Which one is better for speed? According to what large content companies publish, IPv6 is usually quite a bit faster (lower latency), rarely slightly slower. > Which is easier to configure? IPv6 > Which is better for end user? Directly? Doesn't really matter. Indirectly? IPv6. > Which is better for advanced user / net admin? IPv6 hands down. > Which is better for companies? IPv6, unless you have to deal with legacy software that doesn't want to speak IPv6.

solotronics 7y ago

As a network engineer I believe IPv6 is the answer.