8 ms·
Ipv6excuses.com (2016)
- dfbour 5y agoWaiting for ipv7
- perryizgr8 5y ago> I don't want to lose the security provided by NAT This grinds my gears so much. I hate everything about NAT. It is a pain to deploy, pain to debug, pain to code, pain to think about, pain to workaround in other protocols. Just the elimination of NAT is enough benefit to use IPv6 over IPv4.
- otabdeveloper4 5y agoMost people love the NAT. There's no sense in pissing against the wind here and telling people they're idiots and shouldn't like what they like. (If we ever get to an IPv6 future, there will certainly be a NAT in it. Except this time more convoluted and hacky and brittle than it ever was back in the IPv4 days.)
- perryizgr8 5y ago> telling people they're idiots I never said that. > If we ever get to an IPv6 future, there will certainly be a NAT in it. That will indeed be a very sad day for mankind.
- georgyo 5y agoThat day has already passed: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch18s04.html https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html#id-ipv6-nat-overview__d14963e63 https://www.juniper.net/documentation/us/en/software/junos/n... I'm used to be with you, but some things are only possible will NAT.
- tuyiown 5y ago> I'm used to be with you, but some things are only possible will NAT. On ipv6 besides hiding (most common setup) a randomly assigned /64 ip address behind another /64 address I really don't see what any stateful firewall can't achieve
- stevefan1999 5y agoWhat? NAT hinders the deployment of P2P applications, how was that not a bane of NAT to get rid if it already?
- endymi0n 5y agoDepending on whether you‘re someone trying to build clever, distributed applications or someone trying to defend a corporate network against them, that may be a bug or a feature.
- georgyo 5y agoThere are many good reasons for IPv6 nat. Security is not one of them at all. There is no security gained from IPv6 nat, in fact some may even be lost. I think this page has a bunch of good examples on when IPv6 nat is useful: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 For why NAT doesn't actually add to security this is a decent article: https://www.internetsociety.org/blog/2015/01/ipv6-security-myth-3-no-ipv6-nat-means-less-security/ https://www.internetsociety.org/blog/2015/01/ipv6-security-m...
- perryizgr8 5y ago> someone trying to defend a corporate network against them If nat is part of your security strategy, you need a new security strategy.
- jve 5y agoWhy? I mean, security is always defence-in-depth thing, a think that consists of multiple layers, etc. If you would have left out the "part of" words, then yeah, implying that NAT is the only defense, that strategy must be thrown out of the window. By the way, ~20 years ago, when ISP just gave public IP and that was directly hooked to PC... yeah, got bitten by some random script on internet that just deleted my files via SMB thanks to how insecure windows configuration was. Was grateful when router was my defense :) Not that something important was there for a kid, but credit goes to... NAT. I think that may have been the time when I learned something about open shares.
- HWR_14 5y agoNAT helps obfuscate how many devices are on my home network. I don't look forward to the day my ISP starts wanting to charge me per computer/phone/tablet I have.
- perryizgr8 5y agoThey will probably give you an entire /64 subnet. You can use 2^64 devices. It will be fine :)
- paranoidrobot 5y agoI suspect they're referring more to a policy thing. For instance carriers that forced phone makers to allow them to switch off using your phone as a Hotspot, unless you pay your carrier more.
- deknos 5y agoyou say this with the assumption that your devices will all implement a good ipv6 strategy and not suck. generally the ipv6 support in endpoint/iot devices really sucks.
- dsr_ 5y agoIPv6 offers randomly assigned addresses from the nice large subnet that you should have been given -- a /64 is 2^64 addresses, comfortably insanely larger than the entire IPv4 internet. Your ISP can look at how many addresses you sent traffic from in a particular time period, but that's not indicative of how many machines or NICs you have.
- rhn_mk1 5y agoThat would have been true if parcelling out a /64 was actually easy or common. In practice, it's designed that one /64 is one device, and it's really hard to split up that subnet, with SLAAC outright making it impossible. It's possible with some static configuration, but that's not something an average Joe is going to use, and router software I came across usually considers it an unsupported option. EDIT: disregard that, the /64 is actually the smallest subnet. It does hinder subnetting fun, but not allocation to devices. I'll leave the invalid post for the sake of transparency.
- magicalhippo 5y agoIPv6 isn't better in my experience. The software out there is frequently very immature and does not support typical use-cases. It's also so many new moving parts, so I find it very difficult to translate my IPv4 experience, making it a pain to work with. Every time something breaks on my network it's IPv6 related, and every time I have to go digging in RFC's and whatnot to figure out what to do. The main pain points with IPv4+NAT are still pain points with IPv6, namely dynamically open ports in the firewall. I'm sure IPv6 will be in a better place in 10-20 years time, and I'm sure a lot of my annoyance with it is due to my inexperience. One day...
- ApolIllo 5y agoHow can I publicly shame my ISP into providing IPv6? I have symmetrical 1gbps fiber but the lack of IPv6 is laughable. I love everything about them (Race Communications) but this is something that really gets under my skin.
- georgyo 5y agoThere is nothing really you can do. Verizon FiOS in NYC does not support IPv6 and does not have it on any public road maps. So I'm in the same boat 1gbps symmetric without native IPv6. But Verizon FiOS does have IPv6 else where, including places in NY state for many years already. They clearly have a reason to pause the roll out, but I have no clue what it is.
- ac29 5y agoLooks like a pretty small provider - maybe just call them and ask if they will set up a tunnel or something for you?
- ApolIllo 5y agoIs there an advantage to use my ISPs tunnel vs another tunnel? I have an open case inquiring about IPv6 and can ask them via that ticket. But if there isn't a benefit from using an ISPs tunnel then I'd rather just save them the work.
- ChrisArchitect 5y ago(2016)
- ChrisArchitect 5y agoSome previous discussion: https://news.ycombinator.com/item?id=16715209 https://news.ycombinator.com/item?id=16715209
- dvh 5y agoThisipv6excusedoesnotexist.com
- hdjjhhvvhga 5y ago"Our business intelligence team can't even parse IPv4 logfiles " - this one is so true and hard to argue against.
- HWR_14 5y agoI have yet to understand why I care about IPv6. I haven't seen any problems it solves. Instead, I see a giant change for no real benefit. It's like Catalina refusing to support 32-bit applications for no reason.
- nikanj 5y agoThis is similar to opposing infrastructure updates because I don't see any benefit from replacing the transformers on our block. The power company does not need me to care, or understand. But they should probably try to keep the lights on while they do the change.
- HWR_14 5y ago> The power company does not need me to care, or understand Sure, but I'm reasonably intelligent and well versed in the subject matter. If a random person asks about replacing the transformer, you have a fine response. If someone who worked for ConEd asked, then you should answer them.
- q-rews 5y agoThis is like the comment “Who needs the iPhone 13’s faster CPU” I read yesterday on a random forum, except you’re on HN and you should probably know better. The reason is simple: IPv4 addresses are getting more rare and therefore more costly.
- ratww 5y ago> Who needs the iPhone 13’s faster CPU Ironically I think the answer here is the same: not the end customer. Most normal people don't really need a faster CPU and wish they could still be hanging on to their beloved iPhone 4, but the developers writing software for it need customer phones to be faster, so everyone has to spend money on it. For IPv6, not everyone needs private addresses, especially in the age of IoT. Even though NAT is not a safety feature, it's probably the main reason we only have millions rather than billions of exposed IoT devices in Shodan. And in the age of privacy violations (and done, again, by people who write software), sharing an IP with my neighbours because of Carrier-Grade NAT doesn't sound like a bad idea to me at all anymore. As for the lack and cost of IPv4, I'd bet that the main reason for that is not because of domestic customers, but rather because of companies, other institutions or even countries holding onto or using IPv4 addresses unnecessarily like they're candy.
- NabiDev 5y ago> Larger headers are less efficient LMAO
- nikanj 5y agoIn the back of my mind I have a "Days since I solved networking issues by disabling ipv6" calculator. Currently it's at one month, give or take. The host in question was not serving proper ssl certs on ipv6 ports, so connections failed with really scary errors. I know ipv6 solves a lot of issues for actual networking people, but for the grunts who just want mom's printer to start working, disabling ipv6 still seems to be a silver bullet. I'm very aware that the latest issue I solved was entirely the fault of the server operator, not of ipv6, but the user experience still was "ipv6 broken, no ipv6, no broken"
- malinens 5y agoOn the other hand I had performance issues when disabling ipv6 on gentoo based system for running docker (containers where starting in 1.5-2 seconds instead of 0.4 seconds). Enabling ipv6 solved those issues.
- belorn 5y agoInteresting that you mention certificates because my counter of Days since I could have solved website issue by disabling https is also about a month or so. Those certificate warnings are really scary for users, but telling them what the certificate error means and how to fix it made for an happy client. Of course they could have solved it by disabling https but then the browser would display this ugly icon and google would not rank their website as good as before, so there is a strong incentive to keep https. The server admins responsible for the site will just have to accept that certificate renewal is part of their responsibility.
- HelloNurse 5y agoWhen I had more hair and I was about to graduate, IPv6 was basically ready. After decades of half-assed adoption, there are still bugs related to expecting IPv4 addresses; I take it almost personally.
- Animats 5y agoI'm on IPv6. Right now. Via Sonic.net. And I didn't do anything. Here's an argument to use with management: Conversion to IPv6 is in the 14th Five Year Plan of the People's Republic of China. "We will focus on strengthening support for digital transformations, intelligent upgrades, and integration and innovation and deploy and construct new infrastructure such as information infrastructure, integration infrastructure, and innovation infrastructure. We will build high-speed, ubiquitous, integrated and interconnected, safe, and efficient information infrastructure that integrates space and earth (天地一体) and enhance data perception, transmission, storage, and computing capabilities. We will accelerate the large-scale deployment of 5G networks, increase the user penetration rate to 56%, and promote the upgrade of gigabit optical fiber networks. We will build up technology reserves for the future deployment of 6G network technology. We will expand backbone network interconnection nodes, set up a number of new international communication gateways, and comprehensively promote the commercial deployment of Internet Protocol Version 6 (IPv6)." Does your company want to be Left Behind? [1] https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Five_Year_Plan_EN.pdf https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Fi...
- rhn_mk1 5y agoIs there a good/hassle-free IPv6 tunnel broker that could be used instead of SiXXS?
- mercora 5y agoif you dont need dynamic tunnels like sixxs offered them via aiccu you can you tunnelbroker.net for free 6in4 tunels, they are pretty stable and fast.
- usui 5y agoI'm worried that IPv4 is too entrenched and that IPv6 will forever be niche. It reminds me of the situation of USB-A versus USB-C. I try as much as possible to have USB-C devices/ports only, but too many manufacturers of devices insist on USB-A or something else like Lightning ports. For the rare times that it has been 100% USB-C, it's made a noticeable difference. Similarly, I would like a future for 100% IPv6, but we will never get there because the world's core services have been set up on IPv4 and there isn't enough political will to shift the decentralized community. If core infra sees a client try to connect from IPv6, it will expect the client to bridge through to IPv4 somehow. It might be like this for a hundred years or more. If only IPv6 had come just a little bit sooner...
- tehbeard 5y agoI don't see it as matching the situation with USB-C. USB-C has way, way too many subtypes (Power delivery, Displayport over USB-C, Thunderbolt 4, USB 3.2 Gen-2x2.6467764, USB-C form factor but only wired for USB 2.0/3.0) and needs "smart" cables to make half these work (which, while only some resistors, still means a manufactuer has to weight spending on resistors vs just on copper and plugs) and for most use cases "2.0 micro-B" works well enough. IPv6 instead is slow to adopt because there is a LOT of infastructure (almost like it's a global spanning network) that needs upgrading, and companies will absolutely wring out the value of their original IPv4 purchases as long as possible before spending on upgrades.
- usui 5y agoI feel like it wouldn't be too hard to come up with software IP-equivalents analogies to the USB-C woes you mentioned, don't you think so? Not really the same, but relatable in terms of entrenchment and adoption speed? I agree that IPv6 adoption will be made even more difficult by the fact that companies will try their hardest to hold onto IPv4 and the money associated with it.
- deknos 5y agoIs there like a list of services and/or software which are fully ipv6-capable? I guess that would mitigate many of these excuses and fears. I know a time, where OpenVPN had to be patched. And there ARE CloudProviders who not really have IPv6 as a firstclass citizen (i would like to have the same for dnssec, the adoption rate is similar abysmal)
- anticensor 5y agoBecause your favourite chat software does not support IPv6.
- matips 5y agoMain problem with IPv6 is lack of backward compatibility. You cannot "just use IPv6". If you accessing Internet you still needs to obtain IPv4 address and setup NAT if needed. Then optionally you can setup IPv6. Internet connection works great without IPv6 but is broken without IPv4. My IPS do not offer IPv6. I asked him about it and they response that they does not have plan to implement IPv6. I understand them: for their clients (normal consumer) there is no significant benefit from adding IPv6 protocol. I configured 4to6 tunnel for P2P tests... but it is already deprecated and Google complains about using it.
- timw4mail 5y agoI have a dual-stack home network. I care about 1 IPv6 address, my web server. My local network has IPv6 connectivity, but the address space is private. All of the fixed addresses I worry about are IPv4. I don't see a need for IPv6 for a home network (from a address management standpoint), but I do think an external IPv6 address is important. My concern with IPv4 is increasingly restrictive carrier-grade NAT to stretch addresses further.
- dekhn 5y agomy ISP has supported IPv6 for some time. The provided router out of the box doesn't do much but if you put it in passthrough mode, you can do anything IPv6 related. After screwing with this for a few weeks, all I had was weird networking problems. v6 and v4 don't coexist nicely, especially naming, and if you want to talk to a v4 web server and only have a v6, well... you need a proxy.
- matips 5y agoExactly: it shows how lack of backward compatibility slows technology adoption. 25 years after IPv6 there is still no benefit for ISP from using it. They still needs IPv4 address (and NAT, DHCP etc.) - IPv6 do not resolve problem of limited number of IPv4 for them.