4 ms·

Their arguments around IPv4 and IPv6 and DNS felt weird, like, who cares about how large the DNS name space is if you never exhaust the limited reagent, IPv6?

Their arguments around IPv4 and IPv6 and DNS felt weird, like, who cares about how large the DNS name space is if you never exhaust the limited reagent, IPv6? I guess it felt like the obvious conclusion is that IPv6 would allow for this sort of individual site blocking but they didn’t want to say that so spent a lot of word count trying to make it sound ridiculous. I hope I simply misunderstood something because it felt very dishonest.

zamadatix 4y ago
IPv6 has enough bits to uniquely identify everything if you wanted but that does not mean it's structured and deployed in a way that makes it actually so just like your computer using 64 bit addresses does not mean programs should expect 18 exabytes of physical RAM instead of any other use or future-proofing of the address space. Beyond that I'm not sure I follow the "obvious conclusion" further or immediate rush to dishonesty as the explanation.
- burnished 4y ago
  To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage. I think part of the reason this feels dishonest is that they make the analogy of a skyscraper and it’s street address - obviously many tenets must share. But that relationship becomes inverted with IPv6, now everyone can have many. Problem solved. Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. That argument doesn’t follow. They even point to the early internet as a time when everything had its own IP address and that sort of IP blocking made sense, which it would again under IPv6. I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could.
  - netheril96 4y ago
    Actually, since any device can and does have multiple IPv6 addresses and can easily get more, blocking individual IPv6 address is ineffective. Some services choose to block /64 so the collateral damage is not reduced in any way.
    - burnished 4y ago
      Well, your site has to be findable, so one could just block multiple addresses, that would solve your first objection right? Is blocking a /64 a fundamental limitation? I dont see how it is relevant otherwise.
  - zamadatix 4y ago
    > To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? I'd say not right for the following reasons: 1) The article never states anything about the demand of IPs exceeding the number of IPs 2) The article never claims such a lack of IP supply is the reason for shared addresses. These may be your reasons for using a shared IP but that doesn't mean it's everyone's or the only reason for using a shared IP and it certainly doesn't mean that's what the article is written about. > So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage. And so being in this hypothetical world does not actually imply there are no more shared addresses it just implies address demand isn't a reason for shared addresses. Things like convenience and scaling still drive sharing services on a single IPv6 address in the real world. > Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. They never really deny this as they didn't even consider the possibility they were supposed to be confronting that argument in the article. This section is purely an answer to the question they pose immediately prior "Here’s an interesting question: could we, or any content service provider, ensure that every IP address matches to one and only one name? The answer is an unequivocal no, and here too, because of a protocol design -- in this case, DNS.". When read as if the article is making the argument for why shared addresses are used I could then see where you're coming from but the article never talks about the why it just says they are. This section is actually arguing the design of the internet never intended them to have a 1:1 mapping not that the lack of such a mapping is why Cloudflare (and others) use shared IPs. That may seem an extraordinarily pedantic difference from what you said but when you realize the article spends most of its time showing the internet was never designed with the intent for names to have dedicated addresses instead of explaining why shared addresses are in use it makes more sense and completely changes what that section is talking about. > I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could. Well it's all a bit moot to bring up if you're not familiar but the whole point of the analogy is that many initially expect all 64 bits of virtual address space to be used then are surprised to learn half the added 32 bits aren't even valid as virtual addresses then sometimes even less than that are valid physical memory addresses. Similar things happen in IPv6 but to an even greater extreme. The internet of having such a large 128 bit address space was not to have 2^128 addresses or the like it was to make things simpler by using vast swaths of the space on convenience or getting around real world scaling limitations. That is to say the goal in expanding the address space so much wasn't to forgo things like shared addresses in favor of always unique ones even if one of the goals was to reduce address scarcity.
dan-robertson 4y ago
Well for one thing, IPv6 adoption hasn’t reached the point where it’s worth talking about blocking IPv6 addresses to block sites. Maybe it’s just a funky section because of editing (maybe IPv6 was added later) or clouded thinking by the author? A benign explanation seems more likely to me.
- burnished 4y ago
  Yes, but TFA had the context of future actions and things that you could do to prevent collateral damage from this kind of block. It would have been a stronger argument to acknowledge that IPv6 would do the trick if it were ever to be fully adopted, strong emphasis on the if. I go into some specifics that bothered me in a sibling comment. Im having a hard time believing it was an editing mistake or clouded thinking because the IPv4 vs IPv6 thing is entwined through the length of TFA. Not that I think they have some nefarious agenda, if I had to guess it reads like they already knew what conclusion they wanted to reach and had a deadline. Which is still dishonest. Still, if it didn’t read like there was a glaring admission to you then I am glad of it. I would rather be wrong about that kind of thing anyway.

zamadatix 4y ago

IPv6 has enough bits to uniquely identify everything if you wanted but that does not mean it's structured and deployed in a way that makes it actually so just like your computer using 64 bit addresses does not mean programs should expect 18 exabytes of physical RAM instead of any other use or future-proofing of the address space. Beyond that I'm not sure I follow the "obvious conclusion" further or immediate rush to dishonesty as the explanation.

burnished 4y ago
To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage. I think part of the reason this feels dishonest is that they make the analogy of a skyscraper and it’s street address - obviously many tenets must share. But that relationship becomes inverted with IPv6, now everyone can have many. Problem solved. Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. That argument doesn’t follow. They even point to the early internet as a time when everything had its own IP address and that sort of IP blocking made sense, which it would again under IPv6. I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could.
- netheril96 4y ago
  Actually, since any device can and does have multiple IPv6 addresses and can easily get more, blocking individual IPv6 address is ineffective. Some services choose to block /64 so the collateral damage is not reduced in any way.
  - burnished 4y ago
    Well, your site has to be findable, so one could just block multiple addresses, that would solve your first objection right? Is blocking a /64 a fundamental limitation? I dont see how it is relevant otherwise.
- zamadatix 4y ago
  > To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? I'd say not right for the following reasons: 1) The article never states anything about the demand of IPs exceeding the number of IPs 2) The article never claims such a lack of IP supply is the reason for shared addresses. These may be your reasons for using a shared IP but that doesn't mean it's everyone's or the only reason for using a shared IP and it certainly doesn't mean that's what the article is written about. > So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage. And so being in this hypothetical world does not actually imply there are no more shared addresses it just implies address demand isn't a reason for shared addresses. Things like convenience and scaling still drive sharing services on a single IPv6 address in the real world. > Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. They never really deny this as they didn't even consider the possibility they were supposed to be confronting that argument in the article. This section is purely an answer to the question they pose immediately prior "Here’s an interesting question: could we, or any content service provider, ensure that every IP address matches to one and only one name? The answer is an unequivocal no, and here too, because of a protocol design -- in this case, DNS.". When read as if the article is making the argument for why shared addresses are used I could then see where you're coming from but the article never talks about the why it just says they are. This section is actually arguing the design of the internet never intended them to have a 1:1 mapping not that the lack of such a mapping is why Cloudflare (and others) use shared IPs. That may seem an extraordinarily pedantic difference from what you said but when you realize the article spends most of its time showing the internet was never designed with the intent for names to have dedicated addresses instead of explaining why shared addresses are in use it makes more sense and completely changes what that section is talking about. > I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could. Well it's all a bit moot to bring up if you're not familiar but the whole point of the analogy is that many initially expect all 64 bits of virtual address space to be used then are surprised to learn half the added 32 bits aren't even valid as virtual addresses then sometimes even less than that are valid physical memory addresses. Similar things happen in IPv6 but to an even greater extreme. The internet of having such a large 128 bit address space was not to have 2^128 addresses or the like it was to make things simpler by using vast swaths of the space on convenience or getting around real world scaling limitations. That is to say the goal in expanding the address space so much wasn't to forgo things like shared addresses in favor of always unique ones even if one of the goals was to reduce address scarcity.

dan-robertson 4y ago

Well for one thing, IPv6 adoption hasn’t reached the point where it’s worth talking about blocking IPv6 addresses to block sites. Maybe it’s just a funky section because of editing (maybe IPv6 was added later) or clouded thinking by the author? A benign explanation seems more likely to me.

burnished 4y ago
Yes, but TFA had the context of future actions and things that you could do to prevent collateral damage from this kind of block. It would have been a stronger argument to acknowledge that IPv6 would do the trick if it were ever to be fully adopted, strong emphasis on the if. I go into some specifics that bothered me in a sibling comment. Im having a hard time believing it was an editing mistake or clouded thinking because the IPv4 vs IPv6 thing is entwined through the length of TFA. Not that I think they have some nefarious agenda, if I had to guess it reads like they already knew what conclusion they wanted to reach and had a deadline. Which is still dishonest. Still, if it didn’t read like there was a glaring admission to you then I am glad of it. I would rather be wrong about that kind of thing anyway.