4 ms·

Interesting work, but IMHO anything that extends the life of IPv4 does active harm. I'd prefer if these addresses stay out of the pool so scarcity increases and

by api 5y ago

Interesting work, but IMHO anything that extends the life of IPv4 does active harm. I'd prefer if these addresses stay out of the pool so scarcity increases and forces people to upgrade. IPv4 is fundamentally too small, period. There are already more people and computers on Earth than possible IPv4 addresses even if it were perfectly optimally used. It leads us further down a path in which everything is behind increasingly starved NATs, making point to point connectivity more and more difficult. Now we are seeing NATs in front of carrier-grade NAT and other madness. ... and no, NAT is not a security feature. You can and almost always do have a firewall in front of IPv6. If you really want NAT there is IPv6 NAT, but it allows you to have all mappings be 1:1 eliminating the need for port starvation madness and making P2P always work. All internal IPs get their own external IP, but those can be random and rotated if you want.

paulnpace 5y ago
The total population I don't find to be a very strong argument, because all that matters is the population of people who desire to communicate with my service. If people not able to communicate with my service also don't want to communicate with my service and I don't see a need for them to communicate with my service, why do we both need the same protocols? Something I have observed is that sites that tend to attract DDoS attacks tend not to use IPv6 (note that reddit and HN do not have AAAA records, though I don't know the actual reason for this). I've even seen the heavily attacked sites that I know are using paid Cloudflare or Sucuri services to not have AAAA records, and I wonder if that's a decision or recommendation from the service providers. So, elimination of IPv4 may mean that sites can more easily and cheaply be knocked off the Internet.
- api 5y ago
  As for point one: I'm not talking about client/server access to services. I'm talking about the capacity for endpoints to talk to each other. IPv4 would be fine if we want a fully centralized computing infrastructure where everything is only a thin client, but that's a future with zero privacy or personal freedom. I don't think there's anything special about IPv4 in terms of DDOS mitigation. What you're probably seeing is an artifact of focus and investment. IPv4 is still the lowest common denominator standard. Virtually everyone can talk to an IPv4 endpoint. As a result the DDOS protection services still mostly use IPv4 endpoints because it reduces the amount of attack surface they have to protect. If they were dual-stack they would have to deal with BGP black holing on what amounts to two BGP networks instead of just one. DDOS is something that desperately needs a more comprehensive solution, but it's a hard problem to solve. Right now the solution is for DDOS protection services to run bastions with enough bandwidth to absorb attacks, but that's a solution that constricts innovation tremendously. I feel like a permanent solution would require cryptography to be designed into the entire network so that you could do things like rate limit packets to your host for people who didn't present a certificate. That would require a deep redesign of the entire network though, and that's not going to happen.
  - paulnpace 5y ago
    I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv6 addresses. You simply can't have that level of problem in IPv4. However, I have never been on the inside of a DDoS attack, so I don't speak from experience on this. In regards to mitigation, what we are talking about is an exclusive network with central controllers in the form of ICANN. Every packet has digital footprints, so what ICANN could do is permit IP address blocks to be seized and transferred when it is demonstrated the owners are consistently using the network for purposes of doing harm, even when it is through negligence. This would work its way through the service level agreements between various ISPs. As in the rest of the business world, you cannot just dump your garbage onto someone's property without eventually being forced to pay for it.
    - api 5y ago
      IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.
    - welterde 5y ago
      With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.
myself248 5y ago
A modest proposal: Turn IPv4 off for one minute a day. Next month, increase it to two minutes, and so on. IPv6 adoption will _soar_.
- api 5y ago
  One popular service could do this to great effect.
ATsch 5y ago
Yeah I admire all of the efforts people are proposing, but they are bailing out a sinking ship with a spoon. Let's say we claw back /8 networks somehow and let's say we can free up one of those /8 networks per year. Pretty optimistic. The allocation rate for /8 networks from IANA after conservation measures were put in place was still 5 /8 networks per year. Even if we conserved IP addresses five times better than that, this would still merely freeze the current situation for a few until we run out once again. There is just no amount of crumb picking that can fix the fact that 32 bits are woefully inadequate.

by api 5y ago

paulnpace 5y ago

The total population I don't find to be a very strong argument, because all that matters is the population of people who desire to communicate with my service. If people not able to communicate with my service also don't want to communicate with my service and I don't see a need for them to communicate with my service, why do we both need the same protocols? Something I have observed is that sites that tend to attract DDoS attacks tend not to use IPv6 (note that reddit and HN do not have AAAA records, though I don't know the actual reason for this). I've even seen the heavily attacked sites that I know are using paid Cloudflare or Sucuri services to not have AAAA records, and I wonder if that's a decision or recommendation from the service providers. So, elimination of IPv4 may mean that sites can more easily and cheaply be knocked off the Internet.

api 5y ago
As for point one: I'm not talking about client/server access to services. I'm talking about the capacity for endpoints to talk to each other. IPv4 would be fine if we want a fully centralized computing infrastructure where everything is only a thin client, but that's a future with zero privacy or personal freedom. I don't think there's anything special about IPv4 in terms of DDOS mitigation. What you're probably seeing is an artifact of focus and investment. IPv4 is still the lowest common denominator standard. Virtually everyone can talk to an IPv4 endpoint. As a result the DDOS protection services still mostly use IPv4 endpoints because it reduces the amount of attack surface they have to protect. If they were dual-stack they would have to deal with BGP black holing on what amounts to two BGP networks instead of just one. DDOS is something that desperately needs a more comprehensive solution, but it's a hard problem to solve. Right now the solution is for DDOS protection services to run bastions with enough bandwidth to absorb attacks, but that's a solution that constricts innovation tremendously. I feel like a permanent solution would require cryptography to be designed into the entire network so that you could do things like rate limit packets to your host for people who didn't present a certificate. That would require a deep redesign of the entire network though, and that's not going to happen.
- paulnpace 5y ago
  I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv6 addresses. You simply can't have that level of problem in IPv4. However, I have never been on the inside of a DDoS attack, so I don't speak from experience on this. In regards to mitigation, what we are talking about is an exclusive network with central controllers in the form of ICANN. Every packet has digital footprints, so what ICANN could do is permit IP address blocks to be seized and transferred when it is demonstrated the owners are consistently using the network for purposes of doing harm, even when it is through negligence. This would work its way through the service level agreements between various ISPs. As in the rest of the business world, you cannot just dump your garbage onto someone's property without eventually being forced to pay for it.
  - api 5y ago
    IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.
  - welterde 5y ago
    With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.

myself248 5y ago

A modest proposal: Turn IPv4 off for one minute a day. Next month, increase it to two minutes, and so on. IPv6 adoption will _soar_.

api 5y ago
One popular service could do this to great effect.

ATsch 5y ago

Yeah I admire all of the efforts people are proposing, but they are bailing out a sinking ship with a spoon. Let's say we claw back /8 networks somehow and let's say we can free up one of those /8 networks per year. Pretty optimistic. The allocation rate for /8 networks from IANA after conservation measures were put in place was still 5 /8 networks per year. Even if we conserved IP addresses five times better than that, this would still merely freeze the current situation for a few until we run out once again. There is just no amount of crumb picking that can fix the fact that 32 bits are woefully inadequate.