4 ms·

Looking at the number of unprotected databases (see i.e. https://news.ycombinator.com/item?id=23957510 https://news.ycombinator.com/item?id=23957510) I think it

Looking at the number of unprotected databases (see i.e. https://news.ycombinator.com/item?id=23957510 https://news.ycombinator.com/item?id=23957510) I think it's good that cloud providers push for gateways etc. in order to restrict access on network level. (They still could do IPv6 proper - no argument there)

throw0101a 6y ago
> I think it's good that cloud providers push for gateways etc. in order to restrict access on network level. If the default security group for IPv6 only allows SSH and ICMPv6 to an instance/host, what difference does it make? * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-secu... It's not the NATing that gives (internal) networks security, it's the stateful packet inspection at the gateway and--more and more--at the host level.
jiggawatts 6y ago
Nobody said there wouldn't be ACLs or firewalls in an IPv6 network. IPv4 NAT provides security as a side effect. You don't need NAT for security. PS: This is the #1 most common argument trotted out against IPv6, and it is blatantly false.
- dijit 6y ago
  NAT doesn't do much if anything for security at all, as soon as there's an outbound connection the internet has a port mapping back to your host. https://www.f5.com/services/resources/white-papers/the-myth-of-network-address-translation-as-security#:~:text=Static%20and%20destination%20translation%20of%20hosts%20provides%20no%20security.&text=While%20it%20is%20true%20that,methods%20to%20circumvent%20the%20NAT https://www.f5.com/services/resources/white-papers/the-myth-....
  - Dagger2 6y ago
    You don't even need an outbound connection. If your router receives a packet with a dest IP set to one of your LAN machines, it'll be routed to that LAN machine. NAT does nothing to stop that, and thus does nothing for (this aspect of) security.
    - dungdang 6y ago
      of course it does nothing to stop it, because you start your scenario after the stop has been made. you don't know the ip of the lan machine. the public machine receiving it's outbound packet doesn't either. but here's your simple test for the home of why nat helps with security. take a winxp machine. connect it to your lan. come back tomorrow. it's not infected. now connect it to the wan and wait about 2 minutes. you have several viruses. then, go back here, and tell us how despite nat protecting you from viruses, it does not. then we'll all laugh. you lock your door. but a guy can pick the lock. so why do you lock it? in the real world, nat adds security. wep for wifi is enough security for your home lan. and dvd encryption works for preventing copying. just like your house key. by reducing the attack surface by 99%. but i know i won't convince you, so stay with your opinion. but apply it also to vaccines.
Dagger2 6y ago
As a side benefit of v6, it makes it harder to find unprotected machines due to the vastly increased address space. Obviously that doesn't make those machines secure, but an insecure machine that hasn't been exploited is better than an insecure machine that has.

throw0101a 6y ago

> I think it's good that cloud providers push for gateways etc. in order to restrict access on network level. If the default security group for IPv6 only allows SSH and ICMPv6 to an instance/host, what difference does it make? * https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-secu... It's not the NATing that gives (internal) networks security, it's the stateful packet inspection at the gateway and--more and more--at the host level.

jiggawatts 6y ago

Nobody said there wouldn't be ACLs or firewalls in an IPv6 network. IPv4 NAT provides security as a side effect. You don't need NAT for security. PS: This is the #1 most common argument trotted out against IPv6, and it is blatantly false.

dijit 6y ago
NAT doesn't do much if anything for security at all, as soon as there's an outbound connection the internet has a port mapping back to your host. https://www.f5.com/services/resources/white-papers/the-myth-of-network-address-translation-as-security#:~:text=Static%20and%20destination%20translation%20of%20hosts%20provides%20no%20security.&text=While%20it%20is%20true%20that,methods%20to%20circumvent%20the%20NAT https://www.f5.com/services/resources/white-papers/the-myth-....
- Dagger2 6y ago
  You don't even need an outbound connection. If your router receives a packet with a dest IP set to one of your LAN machines, it'll be routed to that LAN machine. NAT does nothing to stop that, and thus does nothing for (this aspect of) security.
  - dungdang 6y ago
    of course it does nothing to stop it, because you start your scenario after the stop has been made. you don't know the ip of the lan machine. the public machine receiving it's outbound packet doesn't either. but here's your simple test for the home of why nat helps with security. take a winxp machine. connect it to your lan. come back tomorrow. it's not infected. now connect it to the wan and wait about 2 minutes. you have several viruses. then, go back here, and tell us how despite nat protecting you from viruses, it does not. then we'll all laugh. you lock your door. but a guy can pick the lock. so why do you lock it? in the real world, nat adds security. wep for wifi is enough security for your home lan. and dvd encryption works for preventing copying. just like your house key. by reducing the attack surface by 99%. but i know i won't convince you, so stay with your opinion. but apply it also to vaccines.

Dagger2 6y ago

As a side benefit of v6, it makes it harder to find unprotected machines due to the vastly increased address space. Obviously that doesn't make those machines secure, but an insecure machine that hasn't been exploited is better than an insecure machine that has.