4 ms·

HN doesn't like to hear this, but the shortage crated is artificial, and there also is nothing wrong with NAT. First, running exactly one open port per IP (443

HN doesn't like to hear this, but the shortage crated is artificial, and there also is nothing wrong with NAT. First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records. This could be implemented with "here and now" technology, rather than adopting a new standard for the entire internet backbone. Next, widespread use of NAT provides plausible deniability for everyone on the internet. Google, Facebook, Comcast, Verizon, etc push ipv6 hard in order to enable causing tracking of individual traffic on the internet. These institutions have exactly 0 business knowing how many physical devices are behind a firewall. No, ipv6 privacy extensions do not provide the same sort of anonymity that a NAT firewall does before you hit that downvote button and take away some of my fake internet points.

gm 5y ago
That's a very pre-emptively defensive statement... Why doesn't HN like to hear this?
- exabrial 5y ago
  I've been downvoted in the past for pointing out what everyone says works in theory vs what actually happens in the real world.
  - Arnt 5y ago
    NAT works for some use cases, not so well for others. I know a database that's updated every night via a server-to-server connection that passes five levels of NAT, and when that crontab broke someone had to fix it by finding and correcting a bug in a 1500-line NAT configuration on one important router where the consequences of a mistake would be very bad indeed. It works in the sense that the database is updated, but I cannot help thinking of Truth 3 in RFC1925.
  - dang 5y ago
    Ok, but please don't bait the community like that. Pre-emptive defensiveness puts a negative torque on conversation.
- anonomousename 5y ago
  NAT makes it significantly harder to self host things, and as a consequence limits decentralization.
  - maccolgan 5y ago
    Which makes it easier for typical HN employers and YC startups (esp the social media kind) to stay afloat.
tehbeard 5y ago
> there also is nothing wrong with NAT Hahahaha.... Oh.... The amount of bullshit I've dealt with over the literal decades, going back to secondary school, college and University, as a consumer, because of NAT (The joys of console gaming and "Strict NAT" or skype in the early days just falling straight over). The privacy implications I will however grant you.
jeroenhd 5y ago
SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that. Many ports have also been restricted by the browser because you can format malicious HTTP requests to be an DoS vector for certain services, like IRC, which has been abused by malvertisers in the past. Because of this you'd still be working with a whitelist of ports, only extending the problem a bit longer. I'm not entirely sure what privacy your NAT guarantees for you. Individual devices can already be fingerprinted by their behaviour, so you'd need to run identical software on identical hardware to combat that. If you manage to do that, you're only one Set-Cookie away from unique identifiers anyway. Because of the refreshing nature of privacy extensions, you can't derive an exact number of devices active on a network. More and more random new addresses become in use over time to the point where you'd need access to your router (which your ISP already has, unless you configure your own) to get a proper count. You can at best get guesstimations, but that's not much different from the result of NAT. In theory, I agree with you: pasdive fingerprinting IPv6 is easier than passive fingerprinting IPv4 on an ISP scale or larger. In practice, though, I don't think it matters. Someone who has access to all traffic from your network, probably has access to some kind of boundary as well. If you already install your own traffic collector to NAT everything through so your ISP modem doesn't see your devices, you can do the exact same for IPv6. NAT may be strongly discouraged, but it's still possible using the same techniques.
- zamadatix 5y ago
  > SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that. The security reasons would go away with the presence of the SRV record specifying the allowed port for the domain though. Well, at least as much as any other DNS challenged based method is secure.
throw0101a 5y ago
> there also is nothing wrong with NAT. Try hole punching for games through CGN: * https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT AFAIK there is no way to do it, so you're SOL if that's what your ISP uses.
zamadatix 5y ago
IPv6 does not make it any easier or any harder to know the number of physical devices behind a firewall. Even if you sat directly in front of the handoff to the ISP with a packet sniffer counting the number of unique sources you'd still get the wrong number. Correlating source tuple with destination tuple and making inference would get you a more accurate number (though still not perfect) but that doesn't care about v4 vs v6.
greyface- 5y ago
> First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records. TLS SNI[1] and the HTTP Host: header[2] already do this. Enabling multiple HTTP(s) serving ports with something like SRV wouldn't give us any additional capacity here. > These institutions have exactly 0 business knowing how many physical devices are behind a firewall. These institutions can already analyze TTL, source port, IPid, and other packet metadata to enumerate hosts behind NAT.[3] [1]: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication [2]: https://en.wikipedia.org/wiki/Virtual_hosting#Name-based https://en.wikipedia.org/wiki/Virtual_hosting#Name-based [3]: https://www.cs.columbia.edu/~smb/papers/fnat.pdf https://www.cs.columbia.edu/~smb/papers/fnat.pdf

gm 5y ago

That's a very pre-emptively defensive statement... Why doesn't HN like to hear this?

exabrial 5y ago
I've been downvoted in the past for pointing out what everyone says works in theory vs what actually happens in the real world.
- Arnt 5y ago
  NAT works for some use cases, not so well for others. I know a database that's updated every night via a server-to-server connection that passes five levels of NAT, and when that crontab broke someone had to fix it by finding and correcting a bug in a 1500-line NAT configuration on one important router where the consequences of a mistake would be very bad indeed. It works in the sense that the database is updated, but I cannot help thinking of Truth 3 in RFC1925.
- dang 5y ago
  Ok, but please don't bait the community like that. Pre-emptive defensiveness puts a negative torque on conversation.
anonomousename 5y ago
NAT makes it significantly harder to self host things, and as a consequence limits decentralization.
- maccolgan 5y ago
  Which makes it easier for typical HN employers and YC startups (esp the social media kind) to stay afloat.

tehbeard 5y ago

> there also is nothing wrong with NAT Hahahaha.... Oh.... The amount of bullshit I've dealt with over the literal decades, going back to secondary school, college and University, as a consumer, because of NAT (The joys of console gaming and "Strict NAT" or skype in the early days just falling straight over). The privacy implications I will however grant you.

jeroenhd 5y ago

SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that. Many ports have also been restricted by the browser because you can format malicious HTTP requests to be an DoS vector for certain services, like IRC, which has been abused by malvertisers in the past. Because of this you'd still be working with a whitelist of ports, only extending the problem a bit longer. I'm not entirely sure what privacy your NAT guarantees for you. Individual devices can already be fingerprinted by their behaviour, so you'd need to run identical software on identical hardware to combat that. If you manage to do that, you're only one Set-Cookie away from unique identifiers anyway. Because of the refreshing nature of privacy extensions, you can't derive an exact number of devices active on a network. More and more random new addresses become in use over time to the point where you'd need access to your router (which your ISP already has, unless you configure your own) to get a proper count. You can at best get guesstimations, but that's not much different from the result of NAT. In theory, I agree with you: pasdive fingerprinting IPv6 is easier than passive fingerprinting IPv4 on an ISP scale or larger. In practice, though, I don't think it matters. Someone who has access to all traffic from your network, probably has access to some kind of boundary as well. If you already install your own traffic collector to NAT everything through so your ISP modem doesn't see your devices, you can do the exact same for IPv6. NAT may be strongly discouraged, but it's still possible using the same techniques.

zamadatix 5y ago
> SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that. The security reasons would go away with the presence of the SRV record specifying the allowed port for the domain though. Well, at least as much as any other DNS challenged based method is secure.

throw0101a 5y ago

> there also is nothing wrong with NAT. Try hole punching for games through CGN: * https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT AFAIK there is no way to do it, so you're SOL if that's what your ISP uses.

zamadatix 5y ago

IPv6 does not make it any easier or any harder to know the number of physical devices behind a firewall. Even if you sat directly in front of the handoff to the ISP with a packet sniffer counting the number of unique sources you'd still get the wrong number. Correlating source tuple with destination tuple and making inference would get you a more accurate number (though still not perfect) but that doesn't care about v4 vs v6.

greyface- 5y ago

> First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records. TLS SNI[1] and the HTTP Host: header[2] already do this. Enabling multiple HTTP(s) serving ports with something like SRV wouldn't give us any additional capacity here. > These institutions have exactly 0 business knowing how many physical devices are behind a firewall. These institutions can already analyze TTL, source port, IPid, and other packet metadata to enumerate hosts behind NAT.[3] [1]: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication [2]: https://en.wikipedia.org/wiki/Virtual_hosting#Name-based https://en.wikipedia.org/wiki/Virtual_hosting#Name-based [3]: https://www.cs.columbia.edu/~smb/papers/fnat.pdf https://www.cs.columbia.edu/~smb/papers/fnat.pdf