5 ms·

Let me perface this by saying thank you for being sincere and civil, because what I am about type might not be up to the standard you established. I read that

Let me perface this by saying thank you for being sincere and civil, because what I am about type might not be up to the standard you established. I read that email and there's a serious tons of hand waving and 'dude, trust me.' I am going to ignore "would be useful to a lot of people -- hundreds of millions of people who you may never know." There's no example use case of who the hundreds of millions of people might be, and how this proposal would benefit them. What are the benefits that the existing CG-NAT and ipv6 couldn't provide? I am also going to ignore "one-line patches is almost risk-free." Sure if all the software in the world is only Linux/Windows/BSD TCP/IP stack and no one build anything on top of the stacks, then the patch would indeed be only 'one -line'. What I really have a problem is 'simply include them in new releases of the various operating systems and router OS's that implement the Internet protocols.' I work for a _major_ hardware firewall company, and it is ridiculous the amount of effort we would put on our customers to upgrade their firmware. There are still hardware that run with 15 year old firmware (with all the accumulated CVEs). You are telling me it's easy to convince these people to upgrade their stuff? Are you serious??? 'People naturally upgrade their OS's every few years." Oh I guess we can ignore all the IoTs and middle-boxes on the interweb then. "We have tested major routers, and none so far require software updates to enable most of these addresses." As mentioned I work for a firewall company. I just logged into a sample firewall under my control- yes the configuration is doable. But in enterprise, everything needs to be rigorously tested or else the sysadmin's not gonna touch it. The sysadmins are certainly not going to waste a few weeks of their lives testing things that might bring down their entire network, and would only benefit the select few who managed to grab ahold of the new IPs. It's late at night and I don't want to continue. So here.

saagarjha 5y ago
Adding on to this, the claims seem actively contradictory: it wants us to feel for the millions of people who never got IP addresses (they were late to the internet for whatever reason) but also thinks that they will upgrade on the drop of a hat. Like, these people are using Windows XP and Android KitKat: that’s all they can afford. It seems wrong to present this change as being for them and in the next ask for them to do something that is out of their reach.
- xg15 5y ago
  I agree. If updating were so easy, we could all just switch to IPv6 tomorrow and be done with all of this. This whole IPv4 address mining thing is only relevant because updating is hard.
- yyyk 5y ago
  People who use Windows XP and Android KitKat today can't connect to most sites anyway due to TLS 1.2, I doubt they're relevant to any discussion.
  - kaliszad 5y ago
    See my comment in the other thread. Basically, Windows XP / Windows Server 2003 and other OSes of that vintage still probably drive a good portion of industrial machines. For example a new and modern dentist office, with top of the line equipment had to buy a used panoramic x-ray machine. It makes sharp images, it runs on a separate network and only talks to the NAS - so it is quite decoupled. It works really well but it runs Windows XP. I noticed when I was there, that is how I know all this. In this case, the unicast extension doesn't really apply but it could be other Windows XP machines connect e.g. over a VPN somewhere perhaps in the public cloud. The machine doesn't listen on any port on the public IPs it has... until one day, it can't connect to the VPN endpoint for some reason, because it is in the 0/8 or 127/8 range or whatever. You have to consider it, it is still millions of devices potentially flooding the new addresses, causing major security holes in legacy networks and a lot of maintenance burden. It is a dream/ nightmare come true for support companies and contractors depending on who you support.
    - Fnoord 5y ago
      How about a Windows XP VM which can only talk to the NAS?
      - kaliszad 5y ago
        Not certified I guess. Remember, medicine. :-) In practice, VMs on PCs for non-technical personnel are a major pain. All kinds of stuff breaks in curious ways e.g. the pass-through of the protocol or the specific interface might not work reliably, there is a custom setup to support, some pop-up causes the windows to overlap in a way that makes it hard for the medical personnel to get going quickly yadayada. Yes, you can do snapshots and other stuff. Also, the technicians setting this up are usually not trained in IT DevOps/ broad sysadmin tasks so much as in the setup of special medical devices. They also tend to cost a small fortune, because again, they are certified to work on those machines costing on the order $100000 when used and multiple that when new and there might be a handful of them for the whole region. In this particular case, as a patient you also don't want more x-rays than you absolutely need to get. Doing a panoramic x-ray multiple times because e.g. of some software failure could breach some daily/ monthly whatever irradiation limits so you would need another appointment etc. Not something you want to go through as a responsible doctor because of some custom setup. I get it, I am also enthusiastic about Windows never touching bare metal if at all possible for long running professional stuff precisely because of snapshots and e.g. the possibility to cut the network remotely and bring it back up if needed. But I also come in contact with non-technical folks that don't want to risk stuff, deal with more stuff than they already deal with etc. I respect that, it is an approach that works for them.
mschuster91 5y ago
> What are the benefits that the existing CG-NAT and ipv6 couldn't provide? CG-NAT is nasty: you can't be reached from the Internet and (this is the more important thing) IP-based rate limiting or activity tracking (think of stuff like Wikipedia and anonymous edits) don't work any more. IPv6 adoption has been ... sluggish by any measure, I remember playing around with sixxs ~2010ish, and there still are providers that don't hand out native IPv6!
- Avamander 5y ago
  > and there still are providers that don't hand out native IPv6! There's still a lot of Linux' that can't handle IPv6 handed out by their ISP as well, for example systemd-networkd got working PD support that's at best a few years old (so only in the latest LTS releases of Ubuntu for ex.). I think we're now at the hardest 20% to fix and deploy, that 20% includes humans as well.

saagarjha 5y ago

Adding on to this, the claims seem actively contradictory: it wants us to feel for the millions of people who never got IP addresses (they were late to the internet for whatever reason) but also thinks that they will upgrade on the drop of a hat. Like, these people are using Windows XP and Android KitKat: that’s all they can afford. It seems wrong to present this change as being for them and in the next ask for them to do something that is out of their reach.

xg15 5y ago
I agree. If updating were so easy, we could all just switch to IPv6 tomorrow and be done with all of this. This whole IPv4 address mining thing is only relevant because updating is hard.
yyyk 5y ago
People who use Windows XP and Android KitKat today can't connect to most sites anyway due to TLS 1.2, I doubt they're relevant to any discussion.
- kaliszad 5y ago
  See my comment in the other thread. Basically, Windows XP / Windows Server 2003 and other OSes of that vintage still probably drive a good portion of industrial machines. For example a new and modern dentist office, with top of the line equipment had to buy a used panoramic x-ray machine. It makes sharp images, it runs on a separate network and only talks to the NAS - so it is quite decoupled. It works really well but it runs Windows XP. I noticed when I was there, that is how I know all this. In this case, the unicast extension doesn't really apply but it could be other Windows XP machines connect e.g. over a VPN somewhere perhaps in the public cloud. The machine doesn't listen on any port on the public IPs it has... until one day, it can't connect to the VPN endpoint for some reason, because it is in the 0/8 or 127/8 range or whatever. You have to consider it, it is still millions of devices potentially flooding the new addresses, causing major security holes in legacy networks and a lot of maintenance burden. It is a dream/ nightmare come true for support companies and contractors depending on who you support.
  - Fnoord 5y ago
    How about a Windows XP VM which can only talk to the NAS?
    - kaliszad 5y ago
      Not certified I guess. Remember, medicine. :-) In practice, VMs on PCs for non-technical personnel are a major pain. All kinds of stuff breaks in curious ways e.g. the pass-through of the protocol or the specific interface might not work reliably, there is a custom setup to support, some pop-up causes the windows to overlap in a way that makes it hard for the medical personnel to get going quickly yadayada. Yes, you can do snapshots and other stuff. Also, the technicians setting this up are usually not trained in IT DevOps/ broad sysadmin tasks so much as in the setup of special medical devices. They also tend to cost a small fortune, because again, they are certified to work on those machines costing on the order $100000 when used and multiple that when new and there might be a handful of them for the whole region. In this particular case, as a patient you also don't want more x-rays than you absolutely need to get. Doing a panoramic x-ray multiple times because e.g. of some software failure could breach some daily/ monthly whatever irradiation limits so you would need another appointment etc. Not something you want to go through as a responsible doctor because of some custom setup. I get it, I am also enthusiastic about Windows never touching bare metal if at all possible for long running professional stuff precisely because of snapshots and e.g. the possibility to cut the network remotely and bring it back up if needed. But I also come in contact with non-technical folks that don't want to risk stuff, deal with more stuff than they already deal with etc. I respect that, it is an approach that works for them.

mschuster91 5y ago

> What are the benefits that the existing CG-NAT and ipv6 couldn't provide? CG-NAT is nasty: you can't be reached from the Internet and (this is the more important thing) IP-based rate limiting or activity tracking (think of stuff like Wikipedia and anonymous edits) don't work any more. IPv6 adoption has been ... sluggish by any measure, I remember playing around with sixxs ~2010ish, and there still are providers that don't hand out native IPv6!

Avamander 5y ago
> and there still are providers that don't hand out native IPv6! There's still a lot of Linux' that can't handle IPv6 handed out by their ISP as well, for example systemd-networkd got working PD support that's at best a few years old (so only in the latest LTS releases of Ubuntu for ex.). I think we're now at the hardest 20% to fix and deploy, that 20% includes humans as well.