3 ms·

The home side is basically the same as the business side: a good router has needed to be a good firewall regardless of NAT anyway, because the router can't just

The home side is basically the same as the business side: a good router has needed to be a good firewall regardless of NAT anyway, because the router can't just assume NAT (even if it is de facto everywhere). NATs as first-pass filter of a firewall was always an accidental feature at best. Obviously we start to see which routers are "good" home routers shake out as IPv6 adoption picks up, but given current statistics homes are leading IPv6 adoption and it is businesses (with their complex surveillance proxies and IPv4 micro-management practices) that are greatly lagging in adoption curves. (Typical IPv6 graphs show a "bathtub" effect where IPv6 goes up in evenings and weekends as people switch from work devices and networks/VPNs to home devices and home networks.) Homes are more ready for IPv6 than people want to give credit to. Claiming NATs to be one of the best features of Home IPv4 seems sometimes to just be FUD designed to be anti-IPv6 as much as it is a legitimate concern.

throwaway894345 4y ago
> Obviously we start to see which routers are "good" home routers shake out as IPv6 adoption picks up Experts might, but most security isn't a visible property to most users, or at least they won't readily or reliably attribute router vulnerabilities to the router. This in turn means that security will get worse but the market probably won't correct itself, or at least the correction won't manifest as markedly better routers (the consumer router space sucks as it is because the customers aren't usually experts). I don't think this is a compelling reason to avoid an ipv6 transition, but I don't agree with the implication that ipv6 will have positive security benefits.
- BenjiWiebe 4y ago
  I have yet to see a home router that doesn't have a default-deny firewall. I also haven't seen one that has IPv6 support without having a default-deny IPv6 firewall. They may exist, but certainly aren't common.

throwaway894345 4y ago

> Obviously we start to see which routers are "good" home routers shake out as IPv6 adoption picks up Experts might, but most security isn't a visible property to most users, or at least they won't readily or reliably attribute router vulnerabilities to the router. This in turn means that security will get worse but the market probably won't correct itself, or at least the correction won't manifest as markedly better routers (the consumer router space sucks as it is because the customers aren't usually experts). I don't think this is a compelling reason to avoid an ipv6 transition, but I don't agree with the implication that ipv6 will have positive security benefits.

BenjiWiebe 4y ago
I have yet to see a home router that doesn't have a default-deny firewall. I also haven't seen one that has IPv6 support without having a default-deny IPv6 firewall. They may exist, but certainly aren't common.