4 ms·

Being able to talk directly between peers has advantages. Most services today basically require some kind of arbiter who has a public IP address. While there a

Being able to talk directly between peers has advantages. Most services today basically require some kind of arbiter who has a public IP address. While there are ways to poke holes in NAT, it’s not really scalable. Also, you might be behind more than one level of NAT and not even realize it today. eg: When I ask a website for my IP, it shows something different than what my hotspot is assigned… and my hotspot is not reporting an RFC1918 address. This means I am already sharing ports with someone else on the public IPv4 address that the world sees. Also, no http proxy in the middle here. As for obscurity of addresses, NAT is pretty easily guessed in most scenarios today. IPv6 has far more address space per network making it really hard to scan. That combined with privacy addresses that change constantly is a pretty compelling reason to use IPv6 over IPv4+NAT if what you care about is people not being able to guess your IP.

throwaway894345 4y ago
> Being able to talk directly between peers has advantages. Most services today basically require some kind of arbiter who has a public IP address. Right, but you can't do this without punching holes in your firewall, and I assert that's not a desirable tradeoff, at least for consumer use cases. As far as I can tell, you still need an arbiter with a public IP address. > While there are ways to poke holes in NAT, it’s not really scalable. Agreed, but this is a relatively infrequent problem. It seems like there is some belief that IPv6 is going to make p2p stuff painless, but for most use case it's still going to require poking holes in something; however, for a few use cases (e.g., 2 game consoles in the same network) it will be significantly better. I definitely agree that there's some benefit to foregoing NAT, but it doesn't seem like it will improve most use cases and it certainly doesn't seem like it will deliver the painless p2p experience that many people expect. > As for obscurity of addresses, NAT is pretty easily guessed in most scenarios today. IPv6 has far more address space per network making it really hard to scan. That combined with privacy addresses that change constantly is a pretty compelling reason to use IPv6 over IPv4+NAT if what you care about is people not being able to guess your IP. My concern about obscuring addresses was more about making fingerprinting more difficult (some website can't just see my IP address and associate it with my identity), albeit this isn't a well-founded concern, and it could be mitigated by rotating IP addresses.
- jjoonathan 4y ago
  Well, the trusted-network ship has probably sailed, but giving up peer-to-peer in exchange for allowing sloppy endpoint security was a terrible trade.
  - throwaway894345 4y ago
    I'm not sure what this means. Are firewalls "sloppy endpoint security"?
    - alduin32 4y ago
      I think the person you replied to meant that gateway firewalls enable sloppy endpoint security (which I agree with).
- alduin32 4y ago
  > Right, but you can't do this without punching holes in your firewall, and I assert that's not a desirable tradeoff, at least for consumer use cases. As far as I can tell, you still need an arbiter with a public IP address. That's true, but setting up these firewall rules dynamically is way easier than setting up NAT mappings (for example, UPnP through two different NATs never works properly). And even for consumer use cases, gateways could provide a way to allow all traffic to a specific destination, as most operating systems should provide a proper firewall. Of course, there is still work to be done, the UI for these firewalls should be made better (for example, allowing an application to request to accept incoming packets, and letting the user choose if it should only for the LAN, or for the whole Internet, etc). Indeed IPv6 by itself will not make p2p stuff painless, but it's still a better basis than IPv4.

throwaway894345 4y ago

> Being able to talk directly between peers has advantages. Most services today basically require some kind of arbiter who has a public IP address. Right, but you can't do this without punching holes in your firewall, and I assert that's not a desirable tradeoff, at least for consumer use cases. As far as I can tell, you still need an arbiter with a public IP address. > While there are ways to poke holes in NAT, it’s not really scalable. Agreed, but this is a relatively infrequent problem. It seems like there is some belief that IPv6 is going to make p2p stuff painless, but for most use case it's still going to require poking holes in something; however, for a few use cases (e.g., 2 game consoles in the same network) it will be significantly better. I definitely agree that there's some benefit to foregoing NAT, but it doesn't seem like it will improve most use cases and it certainly doesn't seem like it will deliver the painless p2p experience that many people expect. > As for obscurity of addresses, NAT is pretty easily guessed in most scenarios today. IPv6 has far more address space per network making it really hard to scan. That combined with privacy addresses that change constantly is a pretty compelling reason to use IPv6 over IPv4+NAT if what you care about is people not being able to guess your IP. My concern about obscuring addresses was more about making fingerprinting more difficult (some website can't just see my IP address and associate it with my identity), albeit this isn't a well-founded concern, and it could be mitigated by rotating IP addresses.

jjoonathan 4y ago
Well, the trusted-network ship has probably sailed, but giving up peer-to-peer in exchange for allowing sloppy endpoint security was a terrible trade.
- throwaway894345 4y ago
  I'm not sure what this means. Are firewalls "sloppy endpoint security"?
  - alduin32 4y ago
    I think the person you replied to meant that gateway firewalls enable sloppy endpoint security (which I agree with).
alduin32 4y ago
> Right, but you can't do this without punching holes in your firewall, and I assert that's not a desirable tradeoff, at least for consumer use cases. As far as I can tell, you still need an arbiter with a public IP address. That's true, but setting up these firewall rules dynamically is way easier than setting up NAT mappings (for example, UPnP through two different NATs never works properly). And even for consumer use cases, gateways could provide a way to allow all traffic to a specific destination, as most operating systems should provide a proper firewall. Of course, there is still work to be done, the UI for these firewalls should be made better (for example, allowing an application to request to accept incoming packets, and letting the user choose if it should only for the LAN, or for the whole Internet, etc). Indeed IPv6 by itself will not make p2p stuff painless, but it's still a better basis than IPv4.