5 ms·
All cloud services. Personal computers and devices are not allowed to talk to each other on the internet. They are only allowed to talk to specially designated
by jjoonathan 5y ago
All cloud services.
Personal computers and devices are not allowed to talk to each other on the internet. They are only allowed to talk to specially designated servers -- specially designated by virtue of having a public IPv4 and open port. Enforcement happens through liability: if you put data in a cloud service and the cloud service gets hacked, it's the cloud service's fault, but if you run a program on an open port and the program gets hacked, it's your fault, not the program's fault. This is an arbitrary social choice that follows directly from enshrining NAT as a "best practice." Even the term "open port" presupposes that there is something unnatural about plebian computers talking to each other on the open internet! This effectively forces services to be centralized, or at least pushes very strongly in that direction.
Of course, we can quibble: what about video conferencing? What about gaming? They use direct connections! Yes, but they pay an extraordinarily steep complexity and reliability price to obtain them and the solutions still wind up using centralized servers. They are exceptions that prove the rule because they allow us to observe how "stepping out of line" is discouraged. It's an accidental line drawn by monkies rather than an intentional line drawn by lizard people, but it's strongly enforced and society-shaping all the same.
It's totally wild to consider the social and market consequences of NAT, the unassuming lazy and kludgy security hack. It got out of hand and reshaped the internet, the technology market, and society from the ground up! That's hardly even an exaggeration!
- BlueTemplar 5y agoThankfully, this is going away now with IPv6.
- jjoonathan 5y agoI want to believe!
- BlueTemplar 5y agoWell, IPv6 seems to be today (both in popularity and speed of adoption) where UTF-8 was about a decade ago. So, hopefully in a decade..?
- 10000truths 5y agoUnfortunately not. Most consumer and SOHO routers have reflexive ACLs enabled by default, and your average Joe doesn’t know or care to turn it off.
- BlueTemplar 5y agoOh, interesting, what is it exactly ? Surprising that with over a year of discussions about this subject I only first hear of it ? Would this be the reason why at least tens of millions of consumer routers don't have IPv6 firewalls (technically, opt-in firewalls, but you know how that goes...), and don't have their networks hacked ? Wait, does it even work with UDP, which doesn't have a concept of "connection" ? (Especially IPv6 (no NAT) UDP ?)
- throwawaaarrgh 5y agoNAT is literally the only thing stopping every single personal device in the world from being hacked. It may be a kludge, but it's the best kludge in all of technology. And what do you have against QoS? Would it be better if your VoIP calls stuttered every time you loaded a fat web page?
- ikiris 5y agoNo it isn't, that's basic stateful firewalling. NAT in no way provides security. At all.
- 10000truths 5y agoEven stateful firewalls don’t protect you from being hacked. Hacks occur when you run untrusted code on your machine. That untrusted code can easily bypass your stateful firewall by initiating a connection to a C&C server.
- throwawaaarrgh 5y agoThe fact that a kid with a port scanner can't remotely connect to and exploit your printer is due to NAT not being able to route the traffic, whether you have a stateful firewall or not. The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. There are plenty of attacks to get around that, but by default, nothing else protects random devices like NAT does.
- dnautics 5y agoYes I agree with this but do note that in your gp you stated "every single personal device", not "half of all personal devices"
- throw0101a 5y ago> The majority of internet-addressable devices in the world do not have firewalls. Hence, NAT keeps most devices safe from drive-by RCE. According to System Preferences, my Mac's firewall is currently turned off. Here are the current non-NATed IPv6 addresses on it: $ ifconfig en1 | grep inet6 | grep -v fe80 inet6 2607:f2c0:93c7:fe00:144f:b9a3:bcd4:ef6 prefixlen 64 autoconf secured inet6 2607:f2c0:93c7:fe00:e04c:f356:f2:b9e2 prefixlen 64 autoconf temporary You should be able to ping(6). Can you connect to tcp/22? If not, it shows that my router's stateful packet inspection (SPI) works even when NAT isn't present. * http://www.ipv6scanner.com/cgi-bin/main.py http://www.ipv6scanner.com/cgi-bin/main.py The results of an nmap of one of those address from the system itself: PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 111/tcp open rpcbind syn-ack 1022/tcp open exp2 syn-ack 2049/tcp open nfs syn-ack If you have a device doing NAT, then that device is already doing SPI, and so the NAT part is redundant. It is the SPI that gives you the security.