9 ms·

> we are now looking at carrier-grade NAT vendors as a longer term solution rather then buying more IPv4 space That's even worse. I read a definition of Intern

> we are now looking at carrier-grade NAT vendors as a longer term solution rather then buying more IPv4 space That's even worse. I read a definition of Internet long back which I vaguely remember A network of devices where each device is assigned with unique IP address so that they can communicate with each other. No central party is needed for two devices to connect with each other! This always fascinated me. But NAT breaks that definition or was the definition wrong? It no longer holds true. IPV6 is the only hope. I've wrote more about it here https://www.ankshilp.in/post/the_broken_promise_of_internet/ https://www.ankshilp.in/post/the_broken_promise_of_internet/

cm2187 7y ago
Also IPv6 makes scanning the address space infeasible. This is the only realistic hope to get a bit more security in IoT.
- Fnoord 7y ago
  That seems like security through obscurity. I have other hopes to get IoT more secure. Open source firmware, for starters. Support contracts where you don't buy the hardware but buy a working (and insecure isn't working) device. The problem with IPv6 is that it is a chicken-egg problem. Those who get CGNAT plus native IPv6 are part of the unfortunate bunch who are not using native IPv4 (and therefore miss out on certain IPv4-only services). Meanwhile, the IPv4-only services are causing issues for CGNAT. The logical conclusion is that everyone who currently offers IPv4-only should (and should've been) focusing on adopting native IPv6 dual stack. The continuous procrastination, out of greed and egocentric thinking, is what caused the current situation in the first place. My ISP tried to shove CGNAT with native IPv6 through my throat. My modem was unstable. BitTorrent didn't work well anymore. I could not use services over LTE anymore (my LTE provider, actually same provider as my cable, used IPv4-only back then; don't know now). I relied on that to work. So they gave me what I had before: IPv4 only. Why not dual stack first?
  - cm2187 7y ago
    Having to guess a 128bit AES key is also security through obscurity then! Though it doesn't give any protection against local scanning.
    - BrandoElFollito 7y ago
      I was about to comment exactly that. This is security by realistic approximation of compute capacities and basic probability math. Aka. good security
  - stevekemp 7y ago
    > (and therefore miss out on certain IPv4-only services) Such as github, for example. Something that really surpised me when I setup an IPv6-only virtual machine and then went to clone some projects to setup the host.
  - reaperducer 7y ago
    That seems like security through obscurity. People on HN like to say that "security through obscurity" is not security at all. But there's a reason that the military puts its secret stuff out in the middle of nowhere.
- chopin 7y ago
  Only if it is assigned randomly. I doubt that.
  - kabwj 7y ago
    Exactly. In many implementations I’ve seen the user’s MAC address ends up getting exposed to the WAN. I suppose this is the wet dream of Google, and that’s why they want to push ipv6 adoption.
    - sneak 7y ago
      Most systems use the privacy extensions that randomize addresses to prevent that.
      - kabwj 7y ago
        Yes, I’m sure those iot devices will use infallible privacy extensions... Nah, they’ll probably expose their mac, which will make it trivial to scan for them. Truth is, right now iot devices are protected by nat (your router) and maybe cgnat too (if your isp is good enough and provides that service). With ipv6 those devices will lie exposed to the wan. I hardly see how that’s an improvement. Also don’t trust regular devices. Windows disabled privacy extensions because of a bug (not sure if it’s fixed already). https://social.technet.microsoft.com/Forums/windows/en-US/57925467-2b8d-4c2d-b1f2-b0402581a30e/how-does-one-get-the-system-to-actually-use-the-ipv6-temporary-addresses?forum=win10itpronetworking https://social.technet.microsoft.com/Forums/windows/en-US/57... — I trust my router’s nat much more: it can’t be disabled because of a bug ;-)
        berti 7y ago
        > Truth is, right now iot devices are protected by nat (your router) and maybe cgnat too (if your isp is good enough and provides that service). With ipv6 those devices will lie exposed to the wan. I hardly see how that’s an improvement. You're planning to just get rid of your firewall when you don't need it for NAT anymore?
- RidingPegasus 7y ago
  https://www.internetsociety.org/blog/2015/02/ipv6-security-myth-4-ipv6-networks-are-too-big-to-scan/ https://www.internetsociety.org/blog/2015/02/ipv6-security-m...
  - cm2187 7y ago
    I believe the default on retail set ups (defaut for MacOS, iOS and Windows) plus router is random addressing. So surely it may be different on certain corporate or university networks. But at least there is a guy supposed to be paid to handle security.
    - class4behavior 7y ago
      [Edit: I was wrong about that: //No, it is not. By default the suffix is generated based on your MAC address.//] Moreover the wasteful norm to rely on /64 subnets and other, similar more practical than privacy-conscious design decisions diminish the potential to stay pseudo-anonymous.
      - cm2187 7y ago
        I don't think MAC is the default [1]: the following operating systems use IPv6 privacy extensions BY DEFAULT: All versions of Windows after Windows XP All versions of Mac OS X from 10.7 onward All versions of iOS since iOS 4.3 All versions of Android since 4.0 (ICS) Some versions of Linux (and for others it can be easily configured) For routers, then I have no way to tell. But I would be surprised if stateless addressing wasn't the default on the vast majority of retail routers. [1] https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...
- Nyandalized 7y ago
  This also means that banning separate IP's is now infeasible. Not that it's the right way to go about things anyway, but a ton of sites rely on it
  - Faaak 7y ago
    You can still ban the /64
icebraining 7y ago
They also say "despite the decision to invest in NAT technology, Aussie Broadband has also decided it needs to speed up its IPv6 rollout". Despite IPv6, you still need CGNAT, because not every site/service is available over IPv6. It's fine as long as it's a stopgap, not the main solution.
- spiderfarmer 7y ago
  At what point will NAT no longer be required? Is IPv6 really seen as a successor or just a supplement to IPv4?
  - Bombthecat 7y ago
    At least in gaming, ipv6 causes issues especially together with NAT or dual stack lite...
  - zamadatix 7y ago
    - v4<->v4 increasingly requires NAT due to scarcity - v6<->v6 does not require NAT - v6<->v4 requires NAT but does not require your v6 device also have a v4 address Until the v6<->v4 is no longer needed you will always have some form of NAT as there aren't enough addresses to give everyone a v4.
- zamadatix 7y ago
  > Despite IPv6, you still need CGNAT, because not every site/service is available over IPv6. It's fine as long as it's a stopgap, not the main solution. NAT64 is better than CG-NAT (single NAT vs double NAT) and they both solve the same problem.

cm2187 7y ago

Also IPv6 makes scanning the address space infeasible. This is the only realistic hope to get a bit more security in IoT.

Fnoord 7y ago
That seems like security through obscurity. I have other hopes to get IoT more secure. Open source firmware, for starters. Support contracts where you don't buy the hardware but buy a working (and insecure isn't working) device. The problem with IPv6 is that it is a chicken-egg problem. Those who get CGNAT plus native IPv6 are part of the unfortunate bunch who are not using native IPv4 (and therefore miss out on certain IPv4-only services). Meanwhile, the IPv4-only services are causing issues for CGNAT. The logical conclusion is that everyone who currently offers IPv4-only should (and should've been) focusing on adopting native IPv6 dual stack. The continuous procrastination, out of greed and egocentric thinking, is what caused the current situation in the first place. My ISP tried to shove CGNAT with native IPv6 through my throat. My modem was unstable. BitTorrent didn't work well anymore. I could not use services over LTE anymore (my LTE provider, actually same provider as my cable, used IPv4-only back then; don't know now). I relied on that to work. So they gave me what I had before: IPv4 only. Why not dual stack first?
- cm2187 7y ago
  Having to guess a 128bit AES key is also security through obscurity then! Though it doesn't give any protection against local scanning.
  - BrandoElFollito 7y ago
    I was about to comment exactly that. This is security by realistic approximation of compute capacities and basic probability math. Aka. good security
- stevekemp 7y ago
  > (and therefore miss out on certain IPv4-only services) Such as github, for example. Something that really surpised me when I setup an IPv6-only virtual machine and then went to clone some projects to setup the host.
- reaperducer 7y ago
  That seems like security through obscurity. People on HN like to say that "security through obscurity" is not security at all. But there's a reason that the military puts its secret stuff out in the middle of nowhere.
chopin 7y ago
Only if it is assigned randomly. I doubt that.
- kabwj 7y ago
  Exactly. In many implementations I’ve seen the user’s MAC address ends up getting exposed to the WAN. I suppose this is the wet dream of Google, and that’s why they want to push ipv6 adoption.
  - sneak 7y ago
    Most systems use the privacy extensions that randomize addresses to prevent that.
    - kabwj 7y ago
      Yes, I’m sure those iot devices will use infallible privacy extensions... Nah, they’ll probably expose their mac, which will make it trivial to scan for them. Truth is, right now iot devices are protected by nat (your router) and maybe cgnat too (if your isp is good enough and provides that service). With ipv6 those devices will lie exposed to the wan. I hardly see how that’s an improvement. Also don’t trust regular devices. Windows disabled privacy extensions because of a bug (not sure if it’s fixed already). https://social.technet.microsoft.com/Forums/windows/en-US/57925467-2b8d-4c2d-b1f2-b0402581a30e/how-does-one-get-the-system-to-actually-use-the-ipv6-temporary-addresses?forum=win10itpronetworking https://social.technet.microsoft.com/Forums/windows/en-US/57... — I trust my router’s nat much more: it can’t be disabled because of a bug ;-)
      - berti 7y ago
        > Truth is, right now iot devices are protected by nat (your router) and maybe cgnat too (if your isp is good enough and provides that service). With ipv6 those devices will lie exposed to the wan. I hardly see how that’s an improvement. You're planning to just get rid of your firewall when you don't need it for NAT anymore?
RidingPegasus 7y ago
https://www.internetsociety.org/blog/2015/02/ipv6-security-myth-4-ipv6-networks-are-too-big-to-scan/ https://www.internetsociety.org/blog/2015/02/ipv6-security-m...
- cm2187 7y ago
  I believe the default on retail set ups (defaut for MacOS, iOS and Windows) plus router is random addressing. So surely it may be different on certain corporate or university networks. But at least there is a guy supposed to be paid to handle security.
  - class4behavior 7y ago
    [Edit: I was wrong about that: //No, it is not. By default the suffix is generated based on your MAC address.//] Moreover the wasteful norm to rely on /64 subnets and other, similar more practical than privacy-conscious design decisions diminish the potential to stay pseudo-anonymous.
    - cm2187 7y ago
      I don't think MAC is the default [1]: the following operating systems use IPv6 privacy extensions BY DEFAULT: All versions of Windows after Windows XP All versions of Mac OS X from 10.7 onward All versions of iOS since iOS 4.3 All versions of Android since 4.0 (ICS) Some versions of Linux (and for others it can be easily configured) For routers, then I have no way to tell. But I would be surprised if stateless addressing wasn't the default on the vast majority of retail routers. [1] https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...
Nyandalized 7y ago
This also means that banning separate IP's is now infeasible. Not that it's the right way to go about things anyway, but a ton of sites rely on it
- Faaak 7y ago
  You can still ban the /64

icebraining 7y ago

They also say "despite the decision to invest in NAT technology, Aussie Broadband has also decided it needs to speed up its IPv6 rollout". Despite IPv6, you still need CGNAT, because not every site/service is available over IPv6. It's fine as long as it's a stopgap, not the main solution.

spiderfarmer 7y ago
At what point will NAT no longer be required? Is IPv6 really seen as a successor or just a supplement to IPv4?
- Bombthecat 7y ago
  At least in gaming, ipv6 causes issues especially together with NAT or dual stack lite...
- zamadatix 7y ago
  - v4<->v4 increasingly requires NAT due to scarcity - v6<->v6 does not require NAT - v6<->v4 requires NAT but does not require your v6 device also have a v4 address Until the v6<->v4 is no longer needed you will always have some form of NAT as there aren't enough addresses to give everyone a v4.
zamadatix 7y ago
> Despite IPv6, you still need CGNAT, because not every site/service is available over IPv6. It's fine as long as it's a stopgap, not the main solution. NAT64 is better than CG-NAT (single NAT vs double NAT) and they both solve the same problem.