3 ms·

I am not sure I saw any IPv6-with-NAT deployment in the wild, which is probably a good thing. Then, yes, I really mean it. Or at the very least provide a way t

I am not sure I saw any IPv6-with-NAT deployment in the wild, which is probably a good thing. Then, yes, I really mean it. Or at the very least provide a way to punch holes trough the firewall from the inside, like UPNP does. The Internet is completely asymmetric in how users are expected to open connections nowadays, probably thanks to big tech. If I have a p2p chat app, I would like to be able to use it at my friend's place with his Wi-Fi without relying on external servers, for instance. Same for mobile networks: my carrier has deployed IPv6 on its network, but I have no mean to open ports to the outside, for SSH or similar. The abuses I can see without firewall are: * sending broken packets: there should still be a firewall rejecting invalid traffic * hosting servers on public Internet hotspots: yes, that could be an issue. But is it really? * incoming connections could drain battery a lot faster for mobile devices (including rejected ones). A remotely configurable firewall would be nice for these. * it would expose all sorts of services not meant to be exposed, or with security flaws, to the internet. How about we accept that this is an issue that needs to be solved at the root? You wouldn't empty the pond because your boat is leaking? Though I agree that blocking-by-default lowers the attack surface, not everyone wants it.

Nextgrid 7y ago
> sending broken packets Is this a big deal? The device can just discard it. > hosting servers on public Internet hotspots There's really no difference between someone hosting a server and streaming or uploading video on a social media platform. There are already ways to control or bill for data usage (some of which are stupid, like data caps), they will work just fine to control this behaviour too. > incoming connections could drain battery a lot faster for mobile devices I've used a SIM with a non-firewalled public IP for months. I haven't noticed any extra battery drain.
- MayeulC 7y ago
  Keep in mind, my point was that the possible trade-offs seemed worth it to me. > Is this a big deal? The device can just discard it. I read someone around here who stated this was the original goal of firewalls. The device could indeed discard it, but having dedicated hardware for that check could avoid denials of service. > I've used a SIM with a non-firewalled public IP for months. I haven't noticed any extra battery drain. I am a bit jealous: mine is firewalled. Such extra drain could happen if you had, say, an ssh server on it, and someone was trying to bruteforce its way in, or if you had an http server with a few crawlers hitting it, but those are theoretical issues. On the other hand, you get much easier push notifications (too many of those, and the battery starts being an issue again).
GoblinSlayer 7y ago
As long as you don't have something overly nasty like symmetric NAT everywhere, p2p is possible over UDP.
deleted 7y ago
[deleted]
oarsinsync 7y ago
Blocking-by-default is absolutely necessary given the sorry state of affairs for software these days. While it would be nice for that to be optionally disabled for specific people/cases, these options already exist, but come with a high dollar barrier to entry. Ideally, it shouldn't come at a high cost.

Nextgrid 7y ago

> sending broken packets Is this a big deal? The device can just discard it. > hosting servers on public Internet hotspots There's really no difference between someone hosting a server and streaming or uploading video on a social media platform. There are already ways to control or bill for data usage (some of which are stupid, like data caps), they will work just fine to control this behaviour too. > incoming connections could drain battery a lot faster for mobile devices I've used a SIM with a non-firewalled public IP for months. I haven't noticed any extra battery drain.

MayeulC 7y ago
Keep in mind, my point was that the possible trade-offs seemed worth it to me. > Is this a big deal? The device can just discard it. I read someone around here who stated this was the original goal of firewalls. The device could indeed discard it, but having dedicated hardware for that check could avoid denials of service. > I've used a SIM with a non-firewalled public IP for months. I haven't noticed any extra battery drain. I am a bit jealous: mine is firewalled. Such extra drain could happen if you had, say, an ssh server on it, and someone was trying to bruteforce its way in, or if you had an http server with a few crawlers hitting it, but those are theoretical issues. On the other hand, you get much easier push notifications (too many of those, and the battery starts being an issue again).

GoblinSlayer 7y ago

As long as you don't have something overly nasty like symmetric NAT everywhere, p2p is possible over UDP.

deleted 7y ago

[deleted]

oarsinsync 7y ago

Blocking-by-default is absolutely necessary given the sorry state of affairs for software these days. While it would be nice for that to be optionally disabled for specific people/cases, these options already exist, but come with a high dollar barrier to entry. Ideally, it shouldn't come at a high cost.