3 ms·

I am by trade a network administrator, and I run enterprise gear in my home. I am not running a home router or dd-wrt. But I am not a typlical user going down

I am by trade a network administrator, and I run enterprise gear in my home. I am not running a home router or dd-wrt. But I am not a typlical user going down to best buy to pick up the latest Belkin or Asus wireless AP / router combo they have on sale for $99 and hooking it up to my internet using default "wizard" settings from the mobile app... Nor I am I trusting Comcast, or ATT to configure their residental rented equipment properly with proper firewall rules My comment is not about me, I have enterprise grade nextgen firewalls that are $$ My comment is about Grandma that calls up comcast to have them set it all up, or Sally that is going into best buy for the "Geek Squad" so hook her up...

Symbiote 4y ago
Large ISPs like Comcast already have enormous IPv6 networks, and have appropriate, default-deny firewall configurations for them. I'm only familiar with the largest ISPs in Britain, but they also have default-deny configurations on the IPv6 routers they supply. Obviously. > Grandma / Sally Try avoiding the casual ageism and sexism.
- phpisthebest 4y ago
  >Try avoiding the casual ageism and sexism. Try not to find offense in all things, feel free to refer to my comment thread from the other day about offense being a you problem not a me problem ;)
KerrAvon 4y ago
If I’m following your logic, you’re saying you trust tplink etc to keep Grandma safe, but only for IPv4, and not IPv6? Why?
- phpisthebest 4y ago
  I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible ipv6 most configuration end up with all devices publically routable and must have a firewall deny policy inplace to block inbound connection Shodan is filled with people with misconfigured ipv4 routers that end up with all kinds of device that should not be on the public internet (webcams, printers etc) out there for anyone to connect to. This requires a user to actively do something on the device (most likely following a bad online tutorial) in order to port something though the NAT. with IPv6 this problem will get FAR FAR FAR FAR worse.
  - lmm 4y ago
    > I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible No they're not. They're by default obscured, but anyone can guess your internal IP and send a packet for it, and the router will happily forward it on unless its firewalling tells it not to. And that's without even even getting into all the extra attack surface opened up by legitimate and not-so-legitimate workarounds for the issues NAT causes.

Symbiote 4y ago

Large ISPs like Comcast already have enormous IPv6 networks, and have appropriate, default-deny firewall configurations for them. I'm only familiar with the largest ISPs in Britain, but they also have default-deny configurations on the IPv6 routers they supply. Obviously. > Grandma / Sally Try avoiding the casual ageism and sexism.

phpisthebest 4y ago
>Try avoiding the casual ageism and sexism. Try not to find offense in all things, feel free to refer to my comment thread from the other day about offense being a you problem not a me problem ;)

KerrAvon 4y ago

If I’m following your logic, you’re saying you trust tplink etc to keep Grandma safe, but only for IPv4, and not IPv6? Why?

phpisthebest 4y ago
I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible ipv6 most configuration end up with all devices publically routable and must have a firewall deny policy inplace to block inbound connection Shodan is filled with people with misconfigured ipv4 routers that end up with all kinds of device that should not be on the public internet (webcams, printers etc) out there for anyone to connect to. This requires a user to actively do something on the device (most likely following a bad online tutorial) in order to port something though the NAT. with IPv6 this problem will get FAR FAR FAR FAR worse.
- lmm 4y ago
  > I am not trusting them, behind a ipv4 nat inbound connections are by default inaccessible No they're not. They're by default obscured, but anyone can guess your internal IP and send a packet for it, and the router will happily forward it on unless its firewalling tells it not to. And that's without even even getting into all the extra attack surface opened up by legitimate and not-so-legitimate workarounds for the issues NAT causes.