5 ms·

Are you referring to port forwarding? This can work around only a small part of the stuff NAT breaks, and even for those it covers it's a major barrier to appli

Are you referring to port forwarding? This can work around only a small part of the stuff NAT breaks, and even for those it covers it's a major barrier to application adoption. A new application relying network effects needs to work for the vast majority of users to be able to take off. If you prevent 30-50% of users adopting it, it's not going to take off for example in gaming or communications / sharing apps. For example port forwarding dosn't help evolution of new internet protocols. Iit prevents replacing TCP with SCTP due to this, or deployment end-to-end IP level encryption (like IPSEC attempted). Or a myriad of other decentralized or security enhancing inventions that depended on the end-to-end nature of the internet architecture that now have never gotten off the drawing board because they are not NAT-compatible. (And of course the majority of users behind NAT are in fact behind third party controlled NATs)

iggldiggl 4y ago
Well yes, NAT might pose some additional constraints, but my main line of argument is that even in an alternative timeline where we never had the IPv4 address shortage and therefore no pressure to develop NAT because every device can be assigned its own address just as is possible now with IPv6, we might still have ended up with default-deny-inbound firewalls for home networks anyway, because it might have turned out that letting random programs run world-accessible serves on random computers without any special user authorisation isn't such a good idea. IPv6 doesn't require NAT, but my bog standard home router still firewalls it, and I need to manually allow inbound connections (or give up and just use UPnP).
- fulafel 4y ago
  Yes. Default-deny-inbound firewalls are much better than NAT because they are meant to provide security, can be managed (the "default"), and don't prevent deployment of new protocols. Also we might have a standard way to manage the firewall policy in this alternative future (upnp was done outside the IETF, and is a tire fire, because IETF rejected NAT). But also the whole posture of a home network and consumer os might have been different without NAT, maybe the host based firewall would have won out, who knows. In the alternative universes we can't assume other things remain the same.

iggldiggl 4y ago

Well yes, NAT might pose some additional constraints, but my main line of argument is that even in an alternative timeline where we never had the IPv4 address shortage and therefore no pressure to develop NAT because every device can be assigned its own address just as is possible now with IPv6, we might still have ended up with default-deny-inbound firewalls for home networks anyway, because it might have turned out that letting random programs run world-accessible serves on random computers without any special user authorisation isn't such a good idea. IPv6 doesn't require NAT, but my bog standard home router still firewalls it, and I need to manually allow inbound connections (or give up and just use UPnP).

fulafel 4y ago
Yes. Default-deny-inbound firewalls are much better than NAT because they are meant to provide security, can be managed (the "default"), and don't prevent deployment of new protocols. Also we might have a standard way to manage the firewall policy in this alternative future (upnp was done outside the IETF, and is a tire fire, because IETF rejected NAT). But also the whole posture of a home network and consumer os might have been different without NAT, maybe the host based firewall would have won out, who knows. In the alternative universes we can't assume other things remain the same.