3 ms·

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they

by saurik 7y ago

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they would all get melded together as one, but unless you very carefully generate a new IP address for every single connection you make (which is how you can get back to where you were with NAT), you now have the ability to somewhat differentiate users who before would have been mixed. So it is at best the same but probably worse, at which point why not use the thing that is always at least as good if not much better?...

Avamander 7y ago
Sounds like we need shorter IPv6 leases and more rotation between the prefixes, but that somehow goes a bit against what IPv6 should provide us - freedom to hold on to an address.
- zrm 7y ago
  Some systems already have a solution for this, since devices can have multiple IPv6 addresses at once. They have one permanent IPv6 address which is not used for outgoing connections but can be used for incoming connections, and then temporary IPv6 addresses used for outgoing connections which can be rotated arbitrarily often. The first address is permanent but can only be used if you already know it. An improvement on this would for services to request the machine to hold a specific address, permitted if the address is valid on the current network and not already in use. Then services could each have their own address (generated on first use and then requested when they start) which is effectively permanent but not the same as the addresses used by other services on the same machine.
mirimir 7y ago
It's a wash, I think. Anyone who cares uses VPNs and/or Tor. You can do either IPv4 or IPv6 with VPNs, but the methodology is different. With IPv4, it's just NAT. With IPv6, VPN servers must assign a public address. And with Tor, sites only see the exit address.

by saurik 7y ago

Avamander 7y ago

Sounds like we need shorter IPv6 leases and more rotation between the prefixes, but that somehow goes a bit against what IPv6 should provide us - freedom to hold on to an address.

zrm 7y ago
Some systems already have a solution for this, since devices can have multiple IPv6 addresses at once. They have one permanent IPv6 address which is not used for outgoing connections but can be used for incoming connections, and then temporary IPv6 addresses used for outgoing connections which can be rotated arbitrarily often. The first address is permanent but can only be used if you already know it. An improvement on this would for services to request the machine to hold a specific address, permitted if the address is valid on the current network and not already in use. Then services could each have their own address (generated on first use and then requested when they start) which is effectively permanent but not the same as the addresses used by other services on the same machine.

mirimir 7y ago

It's a wash, I think. Anyone who cares uses VPNs and/or Tor. You can do either IPv4 or IPv6 with VPNs, but the methodology is different. With IPv4, it's just NAT. With IPv6, VPN servers must assign a public address. And with Tor, sites only see the exit address.