3 ms·

As far as I know, many IPv4 internet gateways, if not nearly all, have gateway UPNP support. The issue is the browser unable to deal with gateway UPNP... well

As far as I know, many IPv4 internet gateways, if not nearly all, have gateway UPNP support. The issue is the browser unable to deal with gateway UPNP... well since the web engines are now real cluster f*ks of everything, they could add a DOM interface for it.

crazygringo 3y ago
The main problem is that malware can leverage UPNP to do real harm. A smaller secondary problem is that UPNP doesn't work well on large corporate networks (something about the "chattiness" of so many messages). Browser permissions to open up a port through UPNP is the "easy" part. The hard part is how your router will distinguish that as a legitimate request, versus local botnet malware opening up a request. There are some extensions around UPNP to add user authentication as part of the process, but they don't seem to be widely adopted. To the contrary, general security recommendations are usually to disable UPNP. I had thought that videoconferencing would indeed finally be the impetus to solve this in a secure way, but meetings with much more than 2 participants require a centralized server anyways to prevent bandwidth from exploding, so relaying video calls through a server just became standard.
- sylware 3y ago
  We are talking about domestic usage, not corporate, and in my country nearly all domestic internet users have ipv6, hence no NAT or similar abomination. It is even bigger: major mobile internet provider provides ipv6 by default. It has been like that for years. We are talking tens of millions of people with native IPv6, mobile and domestic. NAT is something which should not have existed in the first place.
  - aragilar 3y ago
    Not here, and the majority of ISPs have no real interest in IPv6 unfortunately.
    - sylware 3y ago
      Above all, it means IPv6 or IPv4/UPNP(gateway) are very same same.
      - crazygringo 3y ago
        With the security risks of both as well.
        sylware 3y ago
        The moment you are online, you are done for. Security does not exist, on HN we all know that. What worries me is the following: how "convenient" this "security risk" is in favor of big tech centralized services... yes, how convenient... Guess what: I will gladely take "this security risk" on top of the already tons we already have, that, to open the gate to indenpendence from big tech centralized services. And as I said, in my country, it has been years with tens of millions of people on ipv6, mobile and domestic. "Security" is just police in the digital world. Police is a permanent process. Without digital police, we'll get digital anarchy.
        crazygringo 3y ago
        Security isn't binary, on HN we all know that. Firewalls prevent a lot of attacks, and they have nothing whatsoever to do with police departments. You're free to not use a firewall but you'll certainly understand why most people aren't going to follow your example.
        sylware 3y ago
        Security is a process, not a deliverable in the digital world. You cannot ask domestic users to deal with a firewall. It's beyond them, this is quite unreasonable actually. Most people don't even know what is a firewall. We are talking about a digital freedom space which has to be protected by digital police or we'll end up with digital arnachy and in the filthy hands of the digital mafia which is big tech (seems to be already the case though). The other way around is digital dictatorship, which is no better. And as I said, it is much better to go p2p and federated than to be jailed in big tech centralized services. But I don't see big tech to let that happen, they'll probably hire some hackers in order to sabotage it. firewalls would actually serve them well: anything beyond centralized services would be "blocked". As I said, convenient, very convenient... way too much actually. In my country tens of millions of people have IPv6, not to mention that gateway UPNP for IPv4 is almost everywhere too, then ten of millions of people have been "following my example" for years. Of course, without an efficient digital police, this will turn to an omega sh*t show. People who work for centralized services which could be threaten by p2p protocols are more likely to try to scare away people from them.
  - crazygringo 3y ago
    > We are talking about domestic usage, not corporate No we're not, nobody said that. > NAT is something which should not have existed in the first place. It was an absolute necessity when it was introduced, since there are less IPv4 addresses than there are people on earth.
    - sylware 3y ago
      NAT is something which should not have existed in the first place: IPv6 should have.

crazygringo 3y ago

The main problem is that malware can leverage UPNP to do real harm. A smaller secondary problem is that UPNP doesn't work well on large corporate networks (something about the "chattiness" of so many messages). Browser permissions to open up a port through UPNP is the "easy" part. The hard part is how your router will distinguish that as a legitimate request, versus local botnet malware opening up a request. There are some extensions around UPNP to add user authentication as part of the process, but they don't seem to be widely adopted. To the contrary, general security recommendations are usually to disable UPNP. I had thought that videoconferencing would indeed finally be the impetus to solve this in a secure way, but meetings with much more than 2 participants require a centralized server anyways to prevent bandwidth from exploding, so relaying video calls through a server just became standard.

sylware 3y ago
We are talking about domestic usage, not corporate, and in my country nearly all domestic internet users have ipv6, hence no NAT or similar abomination. It is even bigger: major mobile internet provider provides ipv6 by default. It has been like that for years. We are talking tens of millions of people with native IPv6, mobile and domestic. NAT is something which should not have existed in the first place.
- aragilar 3y ago
  Not here, and the majority of ISPs have no real interest in IPv6 unfortunately.
  - sylware 3y ago
    Above all, it means IPv6 or IPv4/UPNP(gateway) are very same same.
    - crazygringo 3y ago
      With the security risks of both as well.
      - sylware 3y ago
        The moment you are online, you are done for. Security does not exist, on HN we all know that. What worries me is the following: how "convenient" this "security risk" is in favor of big tech centralized services... yes, how convenient... Guess what: I will gladely take "this security risk" on top of the already tons we already have, that, to open the gate to indenpendence from big tech centralized services. And as I said, in my country, it has been years with tens of millions of people on ipv6, mobile and domestic. "Security" is just police in the digital world. Police is a permanent process. Without digital police, we'll get digital anarchy.
        crazygringo 3y ago
        Security isn't binary, on HN we all know that. Firewalls prevent a lot of attacks, and they have nothing whatsoever to do with police departments. You're free to not use a firewall but you'll certainly understand why most people aren't going to follow your example.
        sylware 3y ago
        Security is a process, not a deliverable in the digital world. You cannot ask domestic users to deal with a firewall. It's beyond them, this is quite unreasonable actually. Most people don't even know what is a firewall. We are talking about a digital freedom space which has to be protected by digital police or we'll end up with digital arnachy and in the filthy hands of the digital mafia which is big tech (seems to be already the case though). The other way around is digital dictatorship, which is no better. And as I said, it is much better to go p2p and federated than to be jailed in big tech centralized services. But I don't see big tech to let that happen, they'll probably hire some hackers in order to sabotage it. firewalls would actually serve them well: anything beyond centralized services would be "blocked". As I said, convenient, very convenient... way too much actually. In my country tens of millions of people have IPv6, not to mention that gateway UPNP for IPv4 is almost everywhere too, then ten of millions of people have been "following my example" for years. Of course, without an efficient digital police, this will turn to an omega sh*t show. People who work for centralized services which could be threaten by p2p protocols are more likely to try to scare away people from them.
- crazygringo 3y ago
  > We are talking about domestic usage, not corporate No we're not, nobody said that. > NAT is something which should not have existed in the first place. It was an absolute necessity when it was introduced, since there are less IPv4 addresses than there are people on earth.
  - sylware 3y ago
    NAT is something which should not have existed in the first place: IPv6 should have.