5 ms·

It's kinda sad how much of the Internet design comes down to "this is why we can't have nice things". Pretty much everything that can be abused, is. Third part

by jmyeet 4y ago

It's kinda sad how much of the Internet design comes down to "this is why we can't have nice things". Pretty much everything that can be abused, is. Third party cookies, DNS interception by ISPs, monitoring (and selling) your Web activity and so on. You can really see the Internet was designed for simpler, more innocent times. Take the trash fire that is IPv6 with its stupidly large address space (ie 128 bits). Not 48 or even 64 bits. Why? To give users a /64 address space. Why? Because MAC addresses were 48 bits and the IPv6 designers thought they'd "solve" internal network addressing by just using the MAC address in the /64 bit space. Obviously we don't do that because it's a privacy issue. So it's inevitable that DNS goes the SSL route. It's sad that it comes to that but here we are. I really wish IP had a guaranteed connectionless delivery option (ie TCP without the connection handshake). Yeah I know there are hacks to kind of achieve this. Likewise, a lot of CDNs and big sites use extremely short TTLs for load-balancing and other reasons. DNS lookup can significantly degrade application performance to the point people have done research on the speed up benefits of keeping a warm DNS cache. Adding SSL to the mix isn't going to improve things.

the8472 4y ago
I don't like the "simpler, more innocent" phrasing, at least if we consider the innocent ~ naive connotations. It obfuscates that not spending resources on attacks and the perpetual defenses that would render the attacks useless make the system multi-agent optimal as long as those actors don't have extreme future discounting - i.e. as long as they don't try to maximize short-term gains at the expense of making the system less valuable for everyone. And the protocols started out in such an environment where it wasn't really "innocent" to not waste huge amounts of engineering on defenses, it was the sensible thing to do.
- b112 4y ago
  It all comes back to data collection. All of it. No market, means no motive. If absolutely all collection of Pii was made illegal, or perhaps even all sale of any data based upon it, be it anonomized or not, things would rapidly change. Even better to make illegal all targeted marketing, based upon stored data or info about a user. Adtech would still exist. If you visit a reddit about showers, show shower ads. You don't need to know a single thing, except the page currently visited is about showers... so show shower ads. All of it, massive issues with our democracies, with spying, with tracking, with price fixing, all of it comes back to, what is now, a purely evil industry. User tracking. Take the profit away from all collectable data about a user, and watch things improve fast.
  - riedel 4y ago
    The GDPR makes processing of PII illegal by default and then adds clearly defined exceptions. The problem are IMHO not the exceptions but the enforcement problem that persists. I see a huge risk in centralising DNS records resolvers. Being able to set a default DoH resolver for all your devices is adding another layer of tracking after centralised WiFi location resolvers. Like browser choices, resolver choices need to be displayed to the user at setup. We need a competition on trust rather than on convenience.
billpg 4y ago
There was probably a time when people thought the 32 bits of IPv4 was ridiculously large. They set aside a whole /8 for the loopback address.
- deleted 4y ago
  [deleted]
- Anunayj 4y ago
  Relevant xkcd[1] [1] https://xkcd.com/865/ https://xkcd.com/865/
tenebrisalietum 4y ago
Beneath IP are things that are hardware, or very close to it. Hardware physically pushes bits on a medium and gets them off. Hardware is the only layer that can even try to provide any guarantees about those bits, since it's the one physically handling them. Anything above isn't "real" until that point. But it can't--after all, power may go out, your cat may chew on the Ethernet cable, your ISP cuts you off because your bill is unpaid, etc. Kinda like the same way your filesystem really wants to treat the underlying storage devices as reliable, but does so at its peril because when a drive wants to die, it's going to die and you're not going to stop it. So you put layers between the high-level filesystem and low-level devices to abstract it. IP is an internetworking protocol that enables routing. Routing is supposed to be where "RAID" for Internet is supposed to live - ideally there is one global Internet, not millions of balkanized mini-Internets behind NATs, and robust networks would have working multiple routes out of their network, and those routes would be known to all hosts on that network and easily be communicable to adjacent networks. So your path to a given IP could take one of many, and that is what happens between service provider networks. DNS does suck, we could go back to passing hosts files around. Essentially that's what's happening in reverse with ad-blocklists.
p1mrx 4y ago
Why is it bad to give users 64 bits of address space? Today's Ethernet/WiFi networks don't use the space very effectively, but IP will be with us for a very long time, and those bits are reserved for future innovation at the network edge.
- jmyeet 4y ago
  Why is it good? IPv6 has a lot of problems. Primarily it solves non-problems and doesn't solve actual problems (other than address space). The actual problems with IPv4 are: 1. Lack of sufficient addresses; and 2. Roaming. It's actually a step backwards for IP portability too. This too is another example of solving a non-problem (ie routing of random address blocks). The user /64 space was specifically done to be large enough to fit a MAC address, which we never ended up doing. Ports are somehow deemed bad too. So with IPV^ we haven't gotten away from the need for NATs, we have a ridicously large address space and then waste half of those bits. This is all classic Second System Syndrome stuff.
  - sliken 4y ago
    That's not my take at all. I have a /60 from my ISP, and have 5 ports on my router, each getting it's own /64. Hosts get a stateless IPv6 address, no running out of leases, no DHCP service that's painful to make redundant, no expired leases when the DHCP server is down, etc. I consider that a win. Also with so many IPs, each client can grab a few, and rotate them, so facebook doesn't see the same IP as twitter, etc. Nor can you assume that connecting to facebook today will be from the same IP as facebook tomorrow. So your MAC related IP never need to be shared with the internet, but can be used to accept incoming connections, for those that know the IP, or know the DNS to look up the IP. For those that really want DHCP you can have that as well with DHCPv6. IPv6 also removes the need for a NAT, all my /60 of IP addresses are visible to the internet, nothing gross like the various ugly hacks for connection forwarding, tunneling, and various weird unreliable technologies trying to get past consumer NATs. IPv6 seems so much saner than IPv4. You can autoconfigure IPs and setup a firewall for any restrictions you want to make. I can share files gasp without dropbox, share photos without a photo hosting site, remotely open/close/check my garage door without depending on some few $ a month cloud service, remotely view my home security cams, etc. Generally I think of the normal IPv4 provided single IP+NAT as a crippled consumer only connection that forces the use of someone else's service/cloud for even the most simple of things.
teddyh 4y ago
MAC addresses are an Ethernet thing, but Ethernet is not the only LAN protocol in existence. The way I heard it, IPv6 reserves 64 bits for local addresses because there are some non-Ethernet LAN protocols which uses 64 bits instead of 48.
topranks 4y ago
Separating IP and the transport layer (initially TCP but now also UDP, SCTP, QUIC etc) was a really smart move that’s enabled lots of innovation. Any version of IP is better without a “guaranteed delivery option”. Your point about IPv6 is rather random I feel. Smaller address space may have sufficed, but it’s flaws are elsewhere (many changes in how it operates versus IPv4 rather than simply larger address field). The use of TLS should have no effect on how “hot” resolver caches are.
nine_k 4y ago
> Pretty much everything that can be abused, is. This is Security 101 :( Also, I suppose that in 10 years, there'll be virtually no unencrypted traffic above the IP level, and the outer IP level will only be used to help run various encrypted channels, overlay networks, VPNs, etc, which usually have their own, unrelated IP routing inside.
- deleted 4y ago
  [deleted]
gorgoiler 4y ago
IPv6 has 64bit host addresses so you can do whatever the hell you like. SLAAC EUI64 (the MAC based one you describe) is one of those. So is tmpaddrs, where you just assign yourself a new random address every ten minutes. A quite reasonable use case, I think.
afiori 4y ago
You might like a couple episode where John Day* talks about the history of the internet https://www.programmingthrowdown.com/2022/06/137-origins-of-internet-with-john-day.html https://www.programmingthrowdown.com/2022/06/137-origins-of-... https://www.programmingthrowdown.com/2022/07/138-fixing-internet-with-john-day.html https://www.programmingthrowdown.com/2022/07/138-fixing-inte... * I had never heard of him before: quoting wikipedia https://en.wikipedia.org/wiki/John_Day_(computer_scientist) https://en.wikipedia.org/wiki/John_Day_(computer_scientist) > John D. Day (from Kinmundy, Illinois, born 1947) is an electrical engineer, an Internet pioneer, and a historian. He has been involved in the development of the communication protocols of Internet and its predecessor ARPANET since the 1970s, and he was also active in the design of the OSI reference model. He has contributed in the research and development of network management systems, distributed databases, supercomputing, and operating systems.

by jmyeet 4y ago

the8472 4y ago

I don't like the "simpler, more innocent" phrasing, at least if we consider the innocent ~ naive connotations. It obfuscates that not spending resources on attacks and the perpetual defenses that would render the attacks useless make the system multi-agent optimal as long as those actors don't have extreme future discounting - i.e. as long as they don't try to maximize short-term gains at the expense of making the system less valuable for everyone. And the protocols started out in such an environment where it wasn't really "innocent" to not waste huge amounts of engineering on defenses, it was the sensible thing to do.

b112 4y ago
It all comes back to data collection. All of it. No market, means no motive. If absolutely all collection of Pii was made illegal, or perhaps even all sale of any data based upon it, be it anonomized or not, things would rapidly change. Even better to make illegal all targeted marketing, based upon stored data or info about a user. Adtech would still exist. If you visit a reddit about showers, show shower ads. You don't need to know a single thing, except the page currently visited is about showers... so show shower ads. All of it, massive issues with our democracies, with spying, with tracking, with price fixing, all of it comes back to, what is now, a purely evil industry. User tracking. Take the profit away from all collectable data about a user, and watch things improve fast.
- riedel 4y ago
  The GDPR makes processing of PII illegal by default and then adds clearly defined exceptions. The problem are IMHO not the exceptions but the enforcement problem that persists. I see a huge risk in centralising DNS records resolvers. Being able to set a default DoH resolver for all your devices is adding another layer of tracking after centralised WiFi location resolvers. Like browser choices, resolver choices need to be displayed to the user at setup. We need a competition on trust rather than on convenience.

billpg 4y ago

There was probably a time when people thought the 32 bits of IPv4 was ridiculously large. They set aside a whole /8 for the loopback address.

deleted 4y ago
[deleted]
Anunayj 4y ago
Relevant xkcd[1] [1] https://xkcd.com/865/ https://xkcd.com/865/

tenebrisalietum 4y ago

Beneath IP are things that are hardware, or very close to it. Hardware physically pushes bits on a medium and gets them off. Hardware is the only layer that can even try to provide any guarantees about those bits, since it's the one physically handling them. Anything above isn't "real" until that point. But it can't--after all, power may go out, your cat may chew on the Ethernet cable, your ISP cuts you off because your bill is unpaid, etc. Kinda like the same way your filesystem really wants to treat the underlying storage devices as reliable, but does so at its peril because when a drive wants to die, it's going to die and you're not going to stop it. So you put layers between the high-level filesystem and low-level devices to abstract it. IP is an internetworking protocol that enables routing. Routing is supposed to be where "RAID" for Internet is supposed to live - ideally there is one global Internet, not millions of balkanized mini-Internets behind NATs, and robust networks would have working multiple routes out of their network, and those routes would be known to all hosts on that network and easily be communicable to adjacent networks. So your path to a given IP could take one of many, and that is what happens between service provider networks. DNS does suck, we could go back to passing hosts files around. Essentially that's what's happening in reverse with ad-blocklists.

p1mrx 4y ago

Why is it bad to give users 64 bits of address space? Today's Ethernet/WiFi networks don't use the space very effectively, but IP will be with us for a very long time, and those bits are reserved for future innovation at the network edge.

jmyeet 4y ago
Why is it good? IPv6 has a lot of problems. Primarily it solves non-problems and doesn't solve actual problems (other than address space). The actual problems with IPv4 are: 1. Lack of sufficient addresses; and 2. Roaming. It's actually a step backwards for IP portability too. This too is another example of solving a non-problem (ie routing of random address blocks). The user /64 space was specifically done to be large enough to fit a MAC address, which we never ended up doing. Ports are somehow deemed bad too. So with IPV^ we haven't gotten away from the need for NATs, we have a ridicously large address space and then waste half of those bits. This is all classic Second System Syndrome stuff.
- sliken 4y ago
  That's not my take at all. I have a /60 from my ISP, and have 5 ports on my router, each getting it's own /64. Hosts get a stateless IPv6 address, no running out of leases, no DHCP service that's painful to make redundant, no expired leases when the DHCP server is down, etc. I consider that a win. Also with so many IPs, each client can grab a few, and rotate them, so facebook doesn't see the same IP as twitter, etc. Nor can you assume that connecting to facebook today will be from the same IP as facebook tomorrow. So your MAC related IP never need to be shared with the internet, but can be used to accept incoming connections, for those that know the IP, or know the DNS to look up the IP. For those that really want DHCP you can have that as well with DHCPv6. IPv6 also removes the need for a NAT, all my /60 of IP addresses are visible to the internet, nothing gross like the various ugly hacks for connection forwarding, tunneling, and various weird unreliable technologies trying to get past consumer NATs. IPv6 seems so much saner than IPv4. You can autoconfigure IPs and setup a firewall for any restrictions you want to make. I can share files gasp without dropbox, share photos without a photo hosting site, remotely open/close/check my garage door without depending on some few $ a month cloud service, remotely view my home security cams, etc. Generally I think of the normal IPv4 provided single IP+NAT as a crippled consumer only connection that forces the use of someone else's service/cloud for even the most simple of things.

teddyh 4y ago

MAC addresses are an Ethernet thing, but Ethernet is not the only LAN protocol in existence. The way I heard it, IPv6 reserves 64 bits for local addresses because there are some non-Ethernet LAN protocols which uses 64 bits instead of 48.

topranks 4y ago

Separating IP and the transport layer (initially TCP but now also UDP, SCTP, QUIC etc) was a really smart move that’s enabled lots of innovation. Any version of IP is better without a “guaranteed delivery option”. Your point about IPv6 is rather random I feel. Smaller address space may have sufficed, but it’s flaws are elsewhere (many changes in how it operates versus IPv4 rather than simply larger address field). The use of TLS should have no effect on how “hot” resolver caches are.

nine_k 4y ago

> Pretty much everything that can be abused, is. This is Security 101 :( Also, I suppose that in 10 years, there'll be virtually no unencrypted traffic above the IP level, and the outer IP level will only be used to help run various encrypted channels, overlay networks, VPNs, etc, which usually have their own, unrelated IP routing inside.

deleted 4y ago
[deleted]

gorgoiler 4y ago

IPv6 has 64bit host addresses so you can do whatever the hell you like. SLAAC EUI64 (the MAC based one you describe) is one of those. So is tmpaddrs, where you just assign yourself a new random address every ten minutes. A quite reasonable use case, I think.

afiori 4y ago

You might like a couple episode where John Day* talks about the history of the internet https://www.programmingthrowdown.com/2022/06/137-origins-of-internet-with-john-day.html https://www.programmingthrowdown.com/2022/06/137-origins-of-... https://www.programmingthrowdown.com/2022/07/138-fixing-internet-with-john-day.html https://www.programmingthrowdown.com/2022/07/138-fixing-inte... * I had never heard of him before: quoting wikipedia https://en.wikipedia.org/wiki/John_Day_(computer_scientist) https://en.wikipedia.org/wiki/John_Day_(computer_scientist) > John D. Day (from Kinmundy, Illinois, born 1947) is an electrical engineer, an Internet pioneer, and a historian. He has been involved in the development of the communication protocols of Internet and its predecessor ARPANET since the 1970s, and he was also active in the design of the OSI reference model. He has contributed in the research and development of network management systems, distributed databases, supercomputing, and operating systems.