7 ms·

So is this a tool or an exploit? Or both? Is this something likely to get patched by the major software/hardware vendors? Would this be a tool that would be saf

So is this a tool or an exploit? Or both? Is this something likely to get patched by the major software/hardware vendors? Would this be a tool that would be safe to use at home if I wanted to connect to a private network on AWS or GCP and did not want to poke a hole through my nat gateway at home?

api 7y ago
NAT is an ugly hack to extend IPv4 address space that breaks the internet. There are numerous ugly hacks for NAT traversal to fix what NAT breaks, all of which kind of seem like exploits, and some of which are effectively standardized in RFCs and used heavily for things like VoIP. The whole thing is a hideous mess that IPv6 will hopefully eventually kill.
- AnIdiotOnTheNet 7y ago
  > NAT is an ugly hack to extend IPv4 address space that breaks the internet Or to phrase it more generously, NAT is an ugly but simple hack that allowed the internet grow despite limited address space and without a gigantic investment in hardware to support an over-engineered replacement protocol.
  - api 7y ago
    It may have done that back when 128 bit addresses were actually expensive, but it also altered the evolution of that network from a more open peer to peer architecture to a closed silo mediated architecture. Things that should be simple and easy became complex and expensive. We are all poorer for it. You could say that instead of paying to upgrade we are paying for lost capabilities and technical debt.
    - AnIdiotOnTheNet 7y ago
      I'm not sure that wouldn't have happened anyway, just with firewalls. ISPs were not above port blocking regardless.
      - api 7y ago
        It's much easier to deal with port opening or changing than it is to deal with a fragmented address space. NAT reminds me of the networking analog of segmented addressing on 16 bit 8086 processors, but worse as it is not systematic.
        AnIdiotOnTheNet 7y ago
        Opening a port through NAT on your own setup is pretty much the same process as doing it on any firewall. I'm not sure how the address space being fragmented changes anything in this case, the user must poke a hole somewhere somehow.
        api 7y ago
        Try writing P2P software and you'll see it. NAT is like 16-bit segmented addressing. Go find some old 16-bit C programs and see what a "near" vs "far" pointer is and that whole mess. IPv6 is like the arrival of 32-bit real mode addressing with the 80386.
        AnIdiotOnTheNet 7y ago
        P2P software wouldn't work too well without fiddling with the firewall anyway, is what I'm saying. I don't think circumstances would have changed much if we'd adopted IPv6 instead of NAT. P2P largely failed to take off outside of piracy circles because centralization is more reliable and efficient, that's all. And yeah, I've dealt with segmented memory models, in C and ASM. I don't think the situation is very comparable at all, nor are segments as bad as people say, but that's neither here nor there. I mean, FFS, all modern systems use an MMU that remaps memory addresses between processes anyway.
  - adev_ 7y ago
    > without a gigantic investment in hardware to support an over-engineered replacement protocol. Bullshit. Almost every piece of hardware sold since 15 years is compatible IPv6. There is no need of any "expensive hardware". The main reason that IPV6 never lift off is the lack of interest, lazyness and no will for configuration.
    - AnIdiotOnTheNet 7y ago
      NAT is older than 15 years though. And > lack of interest, lazyness and no will for configuration Is a symptom of v6 being over-engineered.
      - ronsor 7y ago
        NAT is more over-engineered than IPv6. IPv6 is literally the same as IPv4 in most aspects. People are just lazy because NAT makes things "work" (if you can call it that).
      - api 7y ago
        IPv6 is really just IPv4 with more address space. There are a bunch of extensions that nobody uses, sure, but nobody uses them and they can be safely ignored in most cases. The only other significant change from V4 to V6 is the use of multicast instead of dumb broadcast for V6's equivalent of ARP on LANs. That's an improvement as it allows smart switches to more easily scale address lookup.

api 7y ago

NAT is an ugly hack to extend IPv4 address space that breaks the internet. There are numerous ugly hacks for NAT traversal to fix what NAT breaks, all of which kind of seem like exploits, and some of which are effectively standardized in RFCs and used heavily for things like VoIP. The whole thing is a hideous mess that IPv6 will hopefully eventually kill.

AnIdiotOnTheNet 7y ago
> NAT is an ugly hack to extend IPv4 address space that breaks the internet Or to phrase it more generously, NAT is an ugly but simple hack that allowed the internet grow despite limited address space and without a gigantic investment in hardware to support an over-engineered replacement protocol.
- api 7y ago
  It may have done that back when 128 bit addresses were actually expensive, but it also altered the evolution of that network from a more open peer to peer architecture to a closed silo mediated architecture. Things that should be simple and easy became complex and expensive. We are all poorer for it. You could say that instead of paying to upgrade we are paying for lost capabilities and technical debt.
  - AnIdiotOnTheNet 7y ago
    I'm not sure that wouldn't have happened anyway, just with firewalls. ISPs were not above port blocking regardless.
    - api 7y ago
      It's much easier to deal with port opening or changing than it is to deal with a fragmented address space. NAT reminds me of the networking analog of segmented addressing on 16 bit 8086 processors, but worse as it is not systematic.
      - AnIdiotOnTheNet 7y ago
        Opening a port through NAT on your own setup is pretty much the same process as doing it on any firewall. I'm not sure how the address space being fragmented changes anything in this case, the user must poke a hole somewhere somehow.
        api 7y ago
        Try writing P2P software and you'll see it. NAT is like 16-bit segmented addressing. Go find some old 16-bit C programs and see what a "near" vs "far" pointer is and that whole mess. IPv6 is like the arrival of 32-bit real mode addressing with the 80386.
        AnIdiotOnTheNet 7y ago
        P2P software wouldn't work too well without fiddling with the firewall anyway, is what I'm saying. I don't think circumstances would have changed much if we'd adopted IPv6 instead of NAT. P2P largely failed to take off outside of piracy circles because centralization is more reliable and efficient, that's all. And yeah, I've dealt with segmented memory models, in C and ASM. I don't think the situation is very comparable at all, nor are segments as bad as people say, but that's neither here nor there. I mean, FFS, all modern systems use an MMU that remaps memory addresses between processes anyway.
- adev_ 7y ago
  > without a gigantic investment in hardware to support an over-engineered replacement protocol. Bullshit. Almost every piece of hardware sold since 15 years is compatible IPv6. There is no need of any "expensive hardware". The main reason that IPV6 never lift off is the lack of interest, lazyness and no will for configuration.
  - AnIdiotOnTheNet 7y ago
    NAT is older than 15 years though. And > lack of interest, lazyness and no will for configuration Is a symptom of v6 being over-engineered.
    - ronsor 7y ago
      NAT is more over-engineered than IPv6. IPv6 is literally the same as IPv4 in most aspects. People are just lazy because NAT makes things "work" (if you can call it that).
    - api 7y ago
      IPv6 is really just IPv4 with more address space. There are a bunch of extensions that nobody uses, sure, but nobody uses them and they can be safely ignored in most cases. The only other significant change from V4 to V6 is the use of multicast instead of dumb broadcast for V6's equivalent of ARP on LANs. That's an improvement as it allows smart switches to more easily scale address lookup.