3 ms·

The total population I don't find to be a very strong argument, because all that matters is the population of people who desire to communicate with my service.

The total population I don't find to be a very strong argument, because all that matters is the population of people who desire to communicate with my service. If people not able to communicate with my service also don't want to communicate with my service and I don't see a need for them to communicate with my service, why do we both need the same protocols? Something I have observed is that sites that tend to attract DDoS attacks tend not to use IPv6 (note that reddit and HN do not have AAAA records, though I don't know the actual reason for this). I've even seen the heavily attacked sites that I know are using paid Cloudflare or Sucuri services to not have AAAA records, and I wonder if that's a decision or recommendation from the service providers. So, elimination of IPv4 may mean that sites can more easily and cheaply be knocked off the Internet.

api 5y ago
As for point one: I'm not talking about client/server access to services. I'm talking about the capacity for endpoints to talk to each other. IPv4 would be fine if we want a fully centralized computing infrastructure where everything is only a thin client, but that's a future with zero privacy or personal freedom. I don't think there's anything special about IPv4 in terms of DDOS mitigation. What you're probably seeing is an artifact of focus and investment. IPv4 is still the lowest common denominator standard. Virtually everyone can talk to an IPv4 endpoint. As a result the DDOS protection services still mostly use IPv4 endpoints because it reduces the amount of attack surface they have to protect. If they were dual-stack they would have to deal with BGP black holing on what amounts to two BGP networks instead of just one. DDOS is something that desperately needs a more comprehensive solution, but it's a hard problem to solve. Right now the solution is for DDOS protection services to run bastions with enough bandwidth to absorb attacks, but that's a solution that constricts innovation tremendously. I feel like a permanent solution would require cryptography to be designed into the entire network so that you could do things like rate limit packets to your host for people who didn't present a certificate. That would require a deep redesign of the entire network though, and that's not going to happen.
- paulnpace 5y ago
  I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv6 addresses. You simply can't have that level of problem in IPv4. However, I have never been on the inside of a DDoS attack, so I don't speak from experience on this. In regards to mitigation, what we are talking about is an exclusive network with central controllers in the form of ICANN. Every packet has digital footprints, so what ICANN could do is permit IP address blocks to be seized and transferred when it is demonstrated the owners are consistently using the network for purposes of doing harm, even when it is through negligence. This would work its way through the service level agreements between various ISPs. As in the rest of the business world, you cannot just dump your garbage onto someone's property without eventually being forced to pay for it.
  - api 5y ago
    IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.
  - welterde 5y ago
    With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.

api 5y ago

As for point one: I'm not talking about client/server access to services. I'm talking about the capacity for endpoints to talk to each other. IPv4 would be fine if we want a fully centralized computing infrastructure where everything is only a thin client, but that's a future with zero privacy or personal freedom. I don't think there's anything special about IPv4 in terms of DDOS mitigation. What you're probably seeing is an artifact of focus and investment. IPv4 is still the lowest common denominator standard. Virtually everyone can talk to an IPv4 endpoint. As a result the DDOS protection services still mostly use IPv4 endpoints because it reduces the amount of attack surface they have to protect. If they were dual-stack they would have to deal with BGP black holing on what amounts to two BGP networks instead of just one. DDOS is something that desperately needs a more comprehensive solution, but it's a hard problem to solve. Right now the solution is for DDOS protection services to run bastions with enough bandwidth to absorb attacks, but that's a solution that constricts innovation tremendously. I feel like a permanent solution would require cryptography to be designed into the entire network so that you could do things like rate limit packets to your host for people who didn't present a certificate. That would require a deep redesign of the entire network though, and that's not going to happen.

paulnpace 5y ago
I'm not clear that IPv4 doesn't offer at least one measure of reduction against a DDoS, and that's just one time hits every second from 1 quadrillion unique IPv6 addresses. You simply can't have that level of problem in IPv4. However, I have never been on the inside of a DDoS attack, so I don't speak from experience on this. In regards to mitigation, what we are talking about is an exclusive network with central controllers in the form of ICANN. Every packet has digital footprints, so what ICANN could do is permit IP address blocks to be seized and transferred when it is demonstrated the owners are consistently using the network for purposes of doing harm, even when it is through negligence. This would work its way through the service level agreements between various ISPs. As in the rest of the business world, you cannot just dump your garbage onto someone's property without eventually being forced to pay for it.
- api 5y ago
  IPv6 /64 prefixes are analogous to the role IPv4 addresses typically play. Most cloud endpoints have one or more /64s and most endpoint connections from ISPs get a /64. Yes this does mean your house can have 18,446,744,073,709,551,616 devices in it with unique public addresses, but they're behind one /64. When DDOS black holing is done the recipient will actually look up the BGP advertised prefix from which the attack is coming and black hole the whole thing. Many IPv6 prefixes are /32 and /48. I am pretty deeply familiar with this stuff. There's nothing about IPv6 that makes current mitigation techniques much harder. The most logical explanation for IPv4-only in the DDOS protection world is just to limit the attack surface by picking the lowest common denominator address. That way you only have to defend in the IPv4 realm instead of in two addressing realms. IPv6-only would give you the same effect but there are still too many edge devices without IPv6 addresses to use IPv6 alone for anything public facing. IPv6-only systems are sometimes used in private networks, as bastion boxes, etc.
- welterde 5y ago
  With spoofed addresses (which are not uncommon in ddos attacks) you have exactly the same issue with IPv4. And I don't really see it making any difference if the packets contain 32bit of random information or 128bit.