3 ms·

The amount of idiocy and ignorance around ipv6 is crazy. I’ve seen many supposedly senior engineers that claimed they didn’t want to implement ipv6 because any

by znpy 4y ago

The amount of idiocy and ignorance around ipv6 is crazy. I’ve seen many supposedly senior engineers that claimed they didn’t want to implement ipv6 because anyone could connect to hosts from “outside”. Nat has become so engraved in people’s thinking that they can’t even understand the actual role of a firewall anymore. We’re going to see many stories like this, where networking incompetence will start costing pretty pennies to companies.

FridgeSeal 4y ago
> I’ve seen many supposedly senior engineers that claimed they didn’t want to implement ipv6 because anyone could connect to hosts from “outside” I had this argument with the head of dev ops at my previous work. They claimed IPv6/dual stack networks were a security risk that couldn’t possibly be tolerated. The fact that they were going to be private sunsets, and would have a firewall, NACL’s, etc was lost on them.
jedberg 4y ago
Basic corporate and home networking with NAT and sane default firewalls have been solved for so long now that even senior engineers have never had to deal with it. I haven't had to deal with firewalls in 15 years now. So I can't entirely fault them for not understanding, but you're right, it's kinda nuts.
whatwhaaaaat 4y ago
It’s not just that ipv6 is publicly routable but rather the mistrust of ipv6 itself. There have been a multitude of remotely exploitable vulnerabilities with ipv6 many in embedded devices that are not getting patched. Turn on ipv6 and all of these vulnerabilities are instantly exploitable. It’s not a matter of filtering as some of these vulnerabilities are in parts of the icmpv6 required for configuration. For an alarming example check out some of the rtos vulns back in 2020.
zamadatix 4y ago
On the flip side I'm so regularly impressed by what random HNers know about networking (particularly due to containers) I sometimes wonder if there is a point in me being a network guy! I think a large part of the general attitude is IPv6 is a topic everyone is exposed to but few have really been expected to know so there is a lot of strong feelings about how it's crazy compared to the thing they've already spent 20 years getting familiar with. I think if everyone was exposed to NAT in the same fashion there would be a 10x stronger reaction against NAT than IPv6 but at this point everyone is used to NAT and IPv4 and forgets how weird/annoying they really are too.
- icedchai 4y ago
  I remember the early Internet, before NAT. Everyone had public IPs everywhere. Most universities had public IPs on the desktop (and dorm room.) My home network was a /24 with no NAT. NAT was supposed to be the exception, not the rule.
  - zamadatix 4y ago
    My first Networking job (2012-2015) was still like that! It was a regional health system that had a /16 from the early 90s (pre-ARIN). We were still using public IPs on printers and guest networks even. It was a bit of a pain going to the next place with 10x the devices and 1/10th the IP space. Funnily enough the first job with all public IPs was the one with some IPv6 deployed while the 2nd was the one without. Of course it was the same manager in the early 1990s that rolled out IPv4 there that rolled out IPv6 in the 2010s so maybe it's not so surprising.
tristanbvk 4y ago
I have devices on public v6 at home. When I hear people complain about these things I honestly ask them. What the hell are you running on your machine that you dont want anyone accessing? Bind it locally then or use an fwall. I am astounded by the lackadaisical stance of network admins in the pro-v4 camp.

by znpy 4y ago

FridgeSeal 4y ago

> I’ve seen many supposedly senior engineers that claimed they didn’t want to implement ipv6 because anyone could connect to hosts from “outside” I had this argument with the head of dev ops at my previous work. They claimed IPv6/dual stack networks were a security risk that couldn’t possibly be tolerated. The fact that they were going to be private sunsets, and would have a firewall, NACL’s, etc was lost on them.

jedberg 4y ago

Basic corporate and home networking with NAT and sane default firewalls have been solved for so long now that even senior engineers have never had to deal with it. I haven't had to deal with firewalls in 15 years now. So I can't entirely fault them for not understanding, but you're right, it's kinda nuts.

whatwhaaaaat 4y ago

It’s not just that ipv6 is publicly routable but rather the mistrust of ipv6 itself. There have been a multitude of remotely exploitable vulnerabilities with ipv6 many in embedded devices that are not getting patched. Turn on ipv6 and all of these vulnerabilities are instantly exploitable. It’s not a matter of filtering as some of these vulnerabilities are in parts of the icmpv6 required for configuration. For an alarming example check out some of the rtos vulns back in 2020.

zamadatix 4y ago

On the flip side I'm so regularly impressed by what random HNers know about networking (particularly due to containers) I sometimes wonder if there is a point in me being a network guy! I think a large part of the general attitude is IPv6 is a topic everyone is exposed to but few have really been expected to know so there is a lot of strong feelings about how it's crazy compared to the thing they've already spent 20 years getting familiar with. I think if everyone was exposed to NAT in the same fashion there would be a 10x stronger reaction against NAT than IPv6 but at this point everyone is used to NAT and IPv4 and forgets how weird/annoying they really are too.

icedchai 4y ago
I remember the early Internet, before NAT. Everyone had public IPs everywhere. Most universities had public IPs on the desktop (and dorm room.) My home network was a /24 with no NAT. NAT was supposed to be the exception, not the rule.
- zamadatix 4y ago
  My first Networking job (2012-2015) was still like that! It was a regional health system that had a /16 from the early 90s (pre-ARIN). We were still using public IPs on printers and guest networks even. It was a bit of a pain going to the next place with 10x the devices and 1/10th the IP space. Funnily enough the first job with all public IPs was the one with some IPv6 deployed while the 2nd was the one without. Of course it was the same manager in the early 1990s that rolled out IPv4 there that rolled out IPv6 in the 2010s so maybe it's not so surprising.

tristanbvk 4y ago

I have devices on public v6 at home. When I hear people complain about these things I honestly ask them. What the hell are you running on your machine that you dont want anyone accessing? Bind it locally then or use an fwall. I am astounded by the lackadaisical stance of network admins in the pro-v4 camp.