7 ms·

Anything extending the life of IPv4 is actively harmful. (Like I said last time this was posted.) The most important problem with IPv4 is that it mandates 1:N

by api 5y ago

Anything extending the life of IPv4 is actively harmful. (Like I said last time this was posted.) The most important problem with IPv4 is that it mandates 1:N NAT configurations that break direct connectivity between devices on the Internet. Yes you can traverse NAT but it's an ugly and often unreliable hack. This of course is because the address space is too small for everything to have an IP, whether global or 1:1 NATed. Difficult peer to peer connectivity means everything has to have a server. You can't just write communication apps that... communicate. The added cost here is enormous both in money and in privacy/security. IPv4 is also too small for private networks. Corporate networks are often full of hideous hacks like multiple NATs that negotiate interoperability between networks with overlapping 10.x address spaces, "theft" of unused IPv4 space such as US DoD addresses, etc.

perryizgr8 5y ago
> Anything extending the life of IPv4 is actively harmful. +1 > Yes you can traverse NAT Not always. My ISP uses CGNAT, which means I have absolutely no straightforward way to break out. I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed.
- yarosv 5y ago
  I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.
  - kazen44 5y ago
    protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.
    - yarosv 5y ago
      I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
      - api 5y ago
        The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.
      - nezgar 5y ago
        I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
  - merlyn 5y ago
    You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.
    - mercora 5y ago
      just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
      - ale42 5y ago
        ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
        kaliszad 5y ago
        In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.
        ale42 5y ago
        Sure, but keeping logs for legal reasons doesn't mean transmitting those logs to all the web sites you visit. I think the point here was untrackability by websites rather than pure anonymity.
  - deleted 5y ago
    [deleted]
  - jagger27 5y ago
    I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.
  - p_l 5y ago
    New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.
- po1nt 5y ago
  > I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed As you can see, It's because not many people understand IPv6. Also there are many devices that would stop working. There is no clear path for adoption, everything is "switch and let's see if it breaks". Many systems are legacy systems. Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. ISP's are unwilling to implement it as there are not so many qualified workers that even understand IPv6, big companies like Google straight refuse to fully implement DHCPv6 and so on. IPv6 is IT's esperanto.
  - po1nt 5y ago
    Also IPv6 was officially ratified 2 years after all IPv4s were exhausted. IPv6 was designed in 1998 when total number of internet connected devices is estimated to be equal roughly our daily increase of internet connected devices.
  - dijit 5y ago
    > Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. Mainframes are a _lot_ more maintained than you think they are, but overall this is a bit of a weird statement as Mainframes talk TCP/IP for compatability reasons anyway, Mainframes talk amongst themselves using a protocol called SNA/APPN. (Which, can be encapsulated in arbitrary IP frames, but is not required and doesn't require support of the mainframe)
  - p_l 5y ago
    IBM Mainframes, for various reasons including how IBM structured the pricing tend to run pretty recent versions of software. In case of IPv6, all supported OS versions work with v6, the limits involved are also somewhat no longer valid outside of very locked down intranet-only setups.
xg15 5y ago
> The most important problem with IPv4 is that it mandates 1:N NAT configurations that break direct connectivity between devices on the Internet. Honestly, I don't think direct peer-to-peer connectivity will come back even after everything swutched to IPv6. There is enough dangerous stuff out there that will actively try to exploit any device that is reachable on the internet that you usually don't want to have your devices reachable if you could avoid it in any way. NATs have become de-facto firewalls, but in that property, they're quite important.
- api 5y ago
  Modern P2P does not generally consist of hanging your whole system online with its pants down. They're specialized protocols with authentication, and Rust and Go are popular in the space because they are safe languages.
  - xg15 5y ago
    The problem is how consumer internet connections should be configured. If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own firewalls - or put up a common firewall for all users. Right now, the default is option #2. Unfortunately, this means that the ISP will configure the firewall to support the most common use case - which for consumer internet right now is a user without any technical knowledge who just wants to browse the web. So outgoing connections only, it is. Switching to option #1 would mean that the networks of all users are exposed, whether they want to use P2P or not. And for anyone who is not an expert, this would mean exactly that: hanging your whole system online with its pants down. What we'd really need is an ISP who lets you configure exceptions in the ISP's firewall yourself. However, this would mean significantly more effort for both the ISP and the user. I think it's unlikely, an ISP would offer such a feature without charging extra for it - and even if they were, it would mean that P2P software would still not work out of the box but would need configuration on the user's side. To sum up: Right now, I don't see how P2P software is usable for non-expert users without opening up glaring security holes. With "security holes", I mean everything else that runs on the user's network. The P2P software itself can be perfectly secure, but that doesn't matter if the cheap IoT device on the same LAN has a well-known RCE vulnerability and the vendor doesn't bother to patch it. This all assumes an ISP who is fully on your side and doesn't have business interests on its own - such as actively blocking consumers from running servers at home because they also sell dedicated servers in a separate business unit. What I can see as a pragmatic way forward is more along the lines of WebRTC and ICE: Make direct connections if possible, use a TURN relay server otherwise. It sucks that you still need a control server to coordinate matchmaking between peers. I wonder if we could have something like "(almost-)serverless WebRTC" in the future, where we can exchange the control information through other means - e.g. QR codes, bluteooth, emails, etc. I also really hope, we get back more LAN-only devices in the IoT space. Currently, it seems insane that my smart light switch has to talk to half a dozen cloud servers to activate my smart lightbulb half a meter away.
technerder 5y ago
Does IPV6 actually allow any two devices from anywhere in the world to connect directly to one another without requiring port forwarding?
- Symbiote 5y ago
  Yes. Of course, firewalls are usually configured to prevent that. By default, on a home router. But changing roles in the firewall is simpler without the need for port forwarding.
  - iggldiggl 5y ago
    Is it? Okay, so you don't have to specify the external-to-internal port mapping (and routers might offer you a default of external port = internal port anyway), but other than that it still seems like more or less the same procedure to me. And at least my own home router does indeed use the same configuration interface for both IPv4 and IPv6.
    - Symbiote 5y ago
      If you have more than one device which needs similar external access, you won't have to use a non-standard port. I have three devices at home which I'd like SSH access to. Because I only have IPv4, two of them aren't on port 22, and sometimes the non-default ports I've chosen are blocked by hotel Wifi etc. Similarly, I'd like two different webservers to be available, but I can only have one on my single port 80. For the more typical user, it can mean only one person playing a particular game etc.
      - iggldiggl 5y ago
        Yes, that is of course a benefit, but what I was trying to get at was that you'd still have to dig around within the router config, so it'd still not quite be the radically easy, absolutely hassle-free peer-to-peer communication world.
  - api 5y ago
selfhoster11 5y ago
> IPv4 is also too small for private networks. Corporate networks are often full of hideous hacks like multiple NATs that negotiate interoperability between networks with overlapping 10.x address spaces, "theft" of unused IPv4 space such as US DoD addresses, etc. IPv4 is perfectly adequate as long as you're the only one using the e. g. 10.0.0.0/8 range. I don't think that overlapping private networks were ever designed into the use case.

by api 5y ago

perryizgr8 5y ago

> Anything extending the life of IPv4 is actively harmful. +1 > Yes you can traverse NAT Not always. My ISP uses CGNAT, which means I have absolutely no straightforward way to break out. I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed.

yarosv 5y ago
I'm not a network engineer. But I've yet to see a good way to protect ipv6 network. I don't want my local webserver develop on to be exposed to the internet. It's my understanding that default router configuration will do just that. I don't see a good way to deal with privacy issues. Ipv6 essentially gives a unique identifier for every computer in the household by default.
- kazen44 5y ago
  protecting ipv6 Networks works just the same as ipv4 networks. by using firewalling. NAT is not a security mechanism. most consumer routers seem to block any incoming traffic from the outside world by default anyways.
  - yarosv 5y ago
    I'm not trying to be aggressive here. But what's the actual end user difference between NAT and firewalled ipv6 for me and my local network then? I assume I could route now than one addresses for a specific port. On the other hand I have to pay for domain record to access my local resource without a struggle. Should I use ipv6 at home when my doesn't have one? I honestly struggle to find good information on the protocol that's decades old. It's either to deep for me to care for my needs or too shallow to understand why and how should I just it. Scaremongering is what I find on the internet. And no real benefits for me to update my hardware or find ISP that has ipv6.
    - api 5y ago
      The difference is that traversal protocols like UDP hole punching work deterministically almost 100% of the time in an IPv6 environment but are flaky in an IPv4 NAT environment. It also means that you never experience port exhaustion on large networks, which is a problem for large IPv4 NAT deployments.
    - nezgar 5y ago
      I can kind of relate to the feeling of IPv6 being "new and scary" to back in 1995 when I barely grasped IPv4 routing... everything becomes clear eventually with experience and exposure... hopefully eventually I'll understand more IPv6 concepts with time. I "want to believe". :) But I do fully get that firewall without NAT is perfectly fine (great) in an IPv6 world - but may be necessary in simpler multi-ISP routing scenarios...
- merlyn 5y ago
  You'd setup your firewall to protect your IPv6 network. This policy says do this, firewall defaults to no traffic pass. Same as you have now. IPv6 privacy extension (been around for many many years, and default on at least MacOS and others for many iterations), gives you a new IPv6 address every time period, and rotates through them transparently.
  - mercora 5y ago
    just want to make it clear, usually you are assigned a prefix which you can announce to your network and then nodes will pick random addresses from that prefix. its still easy to determine the packets came from your network just not clear from which device exactly much like current NAT setups lets say...
    - ale42 5y ago
      ... unless your ISP would change your prefix regularly (like every day), like it's now the case for those who have a public dynamic IPv4. If they give you a static IPv6 prefix, it's like giving you a static IPv4 now, i.e. something ISPs would probably want to monetize as a premium service. So I'm pretty sure we'll end up with regularly changing prefixes... which is probably good for privacy.
      - kaliszad 5y ago
        In most countries, the ISP is legally obliged to keep records at which point in time has a customer had an address. Usually a court can order an ISP to hand over those records. In other cases, the police, secret service, copyright lawyers etc. can talk directly to the ISP.
        ale42 5y ago
        Sure, but keeping logs for legal reasons doesn't mean transmitting those logs to all the web sites you visit. I think the point here was untrackability by websites rather than pure anonymity.
- deleted 5y ago
  [deleted]
- jagger27 5y ago
  I haven't seen a single IPv6 network configured to behave like that by default. Just because it has a globally unique address doesn't mean it's reachable.
- p_l 5y ago
  New home routers (the kind that ISPs give out to clients) with IPv6 support include default deny firewall on externally-initiated connections, precisely for that reason. If you think NAT gave you any privacy benefits... at best it made for easy "household mapping" of people.
po1nt 5y ago
> I'm confused why people are willing to develop hacks on top of hacks just to avoid using IPv6. It is really elegantly designed As you can see, It's because not many people understand IPv6. Also there are many devices that would stop working. There is no clear path for adoption, everything is "switch and let's see if it breaks". Many systems are legacy systems. Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. ISP's are unwilling to implement it as there are not so many qualified workers that even understand IPv6, big companies like Google straight refuse to fully implement DHCPv6 and so on. IPv6 is IT's esperanto.
- po1nt 5y ago
  Also IPv6 was officially ratified 2 years after all IPv4s were exhausted. IPv6 was designed in 1998 when total number of internet connected devices is estimated to be equal roughly our daily increase of internet connected devices.
- dijit 5y ago
  > Banks still run old IBM mainframes and you would need to think about it when migrating to IPv6. Mainframes are a _lot_ more maintained than you think they are, but overall this is a bit of a weird statement as Mainframes talk TCP/IP for compatability reasons anyway, Mainframes talk amongst themselves using a protocol called SNA/APPN. (Which, can be encapsulated in arbitrary IP frames, but is not required and doesn't require support of the mainframe)
- p_l 5y ago
  IBM Mainframes, for various reasons including how IBM structured the pricing tend to run pretty recent versions of software. In case of IPv6, all supported OS versions work with v6, the limits involved are also somewhat no longer valid outside of very locked down intranet-only setups.

xg15 5y ago

> The most important problem with IPv4 is that it mandates 1:N NAT configurations that break direct connectivity between devices on the Internet. Honestly, I don't think direct peer-to-peer connectivity will come back even after everything swutched to IPv6. There is enough dangerous stuff out there that will actively try to exploit any device that is reachable on the internet that you usually don't want to have your devices reachable if you could avoid it in any way. NATs have become de-facto firewalls, but in that property, they're quite important.

api 5y ago
Modern P2P does not generally consist of hanging your whole system online with its pants down. They're specialized protocols with authentication, and Rust and Go are popular in the space because they are safe languages.
- xg15 5y ago
  The problem is how consumer internet connections should be configured. If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own firewalls - or put up a common firewall for all users. Right now, the default is option #2. Unfortunately, this means that the ISP will configure the firewall to support the most common use case - which for consumer internet right now is a user without any technical knowledge who just wants to browse the web. So outgoing connections only, it is. Switching to option #1 would mean that the networks of all users are exposed, whether they want to use P2P or not. And for anyone who is not an expert, this would mean exactly that: hanging your whole system online with its pants down. What we'd really need is an ISP who lets you configure exceptions in the ISP's firewall yourself. However, this would mean significantly more effort for both the ISP and the user. I think it's unlikely, an ISP would offer such a feature without charging extra for it - and even if they were, it would mean that P2P software would still not work out of the box but would need configuration on the user's side. To sum up: Right now, I don't see how P2P software is usable for non-expert users without opening up glaring security holes. With "security holes", I mean everything else that runs on the user's network. The P2P software itself can be perfectly secure, but that doesn't matter if the cheap IoT device on the same LAN has a well-known RCE vulnerability and the vendor doesn't bother to patch it. This all assumes an ISP who is fully on your side and doesn't have business interests on its own - such as actively blocking consumers from running servers at home because they also sell dedicated servers in a separate business unit. What I can see as a pragmatic way forward is more along the lines of WebRTC and ICE: Make direct connections if possible, use a TURN relay server otherwise. It sucks that you still need a control server to coordinate matchmaking between peers. I wonder if we could have something like "(almost-)serverless WebRTC" in the future, where we can exchange the control information through other means - e.g. QR codes, bluteooth, emails, etc. I also really hope, we get back more LAN-only devices in the IoT space. Currently, it seems insane that my smart light switch has to talk to half a dozen cloud servers to activate my smart lightbulb half a meter away.

technerder 5y ago

Does IPV6 actually allow any two devices from anywhere in the world to connect directly to one another without requiring port forwarding?

Symbiote 5y ago
Yes. Of course, firewalls are usually configured to prevent that. By default, on a home router. But changing roles in the firewall is simpler without the need for port forwarding.
- iggldiggl 5y ago
  Is it? Okay, so you don't have to specify the external-to-internal port mapping (and routers might offer you a default of external port = internal port anyway), but other than that it still seems like more or less the same procedure to me. And at least my own home router does indeed use the same configuration interface for both IPv4 and IPv6.
  - Symbiote 5y ago
    If you have more than one device which needs similar external access, you won't have to use a non-standard port. I have three devices at home which I'd like SSH access to. Because I only have IPv4, two of them aren't on port 22, and sometimes the non-default ports I've chosen are blocked by hotel Wifi etc. Similarly, I'd like two different webservers to be available, but I can only have one on my single port 80. For the more typical user, it can mean only one person playing a particular game etc.
    - iggldiggl 5y ago
      Yes, that is of course a benefit, but what I was trying to get at was that you'd still have to dig around within the router config, so it'd still not quite be the radically easy, absolutely hassle-free peer-to-peer communication world.
- api 5y ago

selfhoster11 5y ago

> IPv4 is also too small for private networks. Corporate networks are often full of hideous hacks like multiple NATs that negotiate interoperability between networks with overlapping 10.x address spaces, "theft" of unused IPv4 space such as US DoD addresses, etc. IPv4 is perfectly adequate as long as you're the only one using the e. g. 10.0.0.0/8 range. I don't think that overlapping private networks were ever designed into the use case.