5 ms·

Hah? I'm missing a step here. Why would they ship like that?

by anyfoo 3y ago

bombcar 3y ago
Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.
- throw0101b 3y ago
  > Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.
- anyfoo 3y ago
  > Because they did ship like that, years ago Yeah, years ago. Years ago there was no encryption whatsoever. "Host based" authentication was common. And not the type that used certificates (or, in fact, cryptography of any kind), but the kind where you would enter IP addresses, host names, or even just patterns of those into a file called ".rhosts", and those then were the hosts that were allowed to run commands as root completely without further authentication. When you shared a folder in Windows using SMB, you usually shared it to anyone, including the Internet. Windows did not even have a good concept of separate user accounts. This is not an exaggeration, a very significant portion of unsuspecting users had their hard disk made available to everyone because they intended to share it with their own little local network. No password, no nothing. The Internet was littered with public FTP servers, of which a lot, and a lot of very public ones, had a directory called "/incoming" where you could upload and make available things for everyone else. IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's right, you were chatting (or not chatting) to some "rando", and they not only had your IP address, they had the ability to send commands to your IRC client. WiFi, for a surprisingly long time, had encryption optional. And when it was turned on, it was easy to crack. The Internet was a very trusting place, and became gradually less so. With or without NAT, routers would have added strict, stateful firewalls, for the same reasons that everything else I've written above stopped.
  - kortilla 3y ago
    You’re way off on your comparisons. Routers that shipped with WPA3 had an IPv6 setting of “enable ipv6” and nothing else. Comparing it to a bygone era of no encryption is dumb.
    - anyfoo 3y ago
      I’m not sure what you’re saying. That that checkbox enabled IPv6 and made all IPv6 capable devices behind the router accessible without any filtering? You said “had”, so presumably people found out what a bad idea that is and routers added filtering without also introducing NAT for IPv6. Isn’t that exactly the point?
      - kortilla 3y ago
        Yes, that’s exactly what they did. The assumption (presumably) was that anyone smart enough to browse the router settings would know to put firewalls on everything. After all, the entire point of ipv6 was to allow connections to internal devices. If the router blocks it, what’s the fucking point? (See the dichotomy now between people who claim ipv6 stateful filtering for routers is obvious and the people who want ipv6?) They eventually added in a default stateful firewall as well for ipv6, which made it completely pointless to convert. Still can’t host games without STUN, etc.
    - vel0city 3y ago
      On a router I had back in the day that seemed to only offer IPv6 support with a toggle of "enable IPv6" it still had a stateful firewall of all out and no new in by default, you just couldn't add custom rules because its whole legacy firewall UI was based around the NAT port forwarding. I've never had a home router that just completely opened IPv6 to the world on my whole home network.
  - progval 3y ago
    > IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's DCC (Direct Client-to-Client). CTCP is another in-line protocol that allows things like /me or asking what software other clients run.
- vel0city 3y ago
  Gas back in the day was also shipped with lead additives. Things change. I don't think I've ever had a home router that didn't also advertise a stateful firewall and I've been buying home routers since 802.11b was a new thing. Are you sure you're not thinking of modems not shipping with a firewall? Because yeah, a pure modem probably doesn't have a firewall. I wouldn't want a modem with a firewall.

Hah? I'm missing a step here. Why would they ship like that?

by anyfoo 3y ago

Hah? I'm missing a step here. Why would they ship like that?

Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And even if the defaults were secure, I guarantee someone would "route all" when that was a known "fix it" issue - just like you used to find people who would forward 1-65535 to their PC to play Internet games. NAT is still annoying and wrong, perhaps, but it DOES provide something akin to a layer of security in some cases; just like security through obscurity DOES provide some security for many things.

throw0101b 3y ago
> Because they did ship like that, years ago - and some routers pretty recently would default "route all" unless they were in NAT mode. And guess what: people used to connect their PCs directly to their DSL/cable modems and run PPPoE (or DHCP) on their Windows PCs directly, and their Windows PCs used to get assigned public IP addresses. Times change. It's no longer 2003. We've learned things in both the IPv4 and IPv6 space over the decades.
anyfoo 3y ago
> Because they did ship like that, years ago Yeah, years ago. Years ago there was no encryption whatsoever. "Host based" authentication was common. And not the type that used certificates (or, in fact, cryptography of any kind), but the kind where you would enter IP addresses, host names, or even just patterns of those into a file called ".rhosts", and those then were the hosts that were allowed to run commands as root completely without further authentication. When you shared a folder in Windows using SMB, you usually shared it to anyone, including the Internet. Windows did not even have a good concept of separate user accounts. This is not an exaggeration, a very significant portion of unsuspecting users had their hard disk made available to everyone because they intended to share it with their own little local network. No password, no nothing. The Internet was littered with public FTP servers, of which a lot, and a lot of very public ones, had a directory called "/incoming" where you could upload and make available things for everyone else. IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's right, you were chatting (or not chatting) to some "rando", and they not only had your IP address, they had the ability to send commands to your IRC client. WiFi, for a surprisingly long time, had encryption optional. And when it was turned on, it was easy to crack. The Internet was a very trusting place, and became gradually less so. With or without NAT, routers would have added strict, stateful firewalls, for the same reasons that everything else I've written above stopped.
- kortilla 3y ago
  You’re way off on your comparisons. Routers that shipped with WPA3 had an IPv6 setting of “enable ipv6” and nothing else. Comparing it to a bygone era of no encryption is dumb.
  - anyfoo 3y ago
    I’m not sure what you’re saying. That that checkbox enabled IPv6 and made all IPv6 capable devices behind the router accessible without any filtering? You said “had”, so presumably people found out what a bad idea that is and routers added filtering without also introducing NAT for IPv6. Isn’t that exactly the point?
    - kortilla 3y ago
      Yes, that’s exactly what they did. The assumption (presumably) was that anyone smart enough to browse the router settings would know to put firewalls on everything. After all, the entire point of ipv6 was to allow connections to internal devices. If the router blocks it, what’s the fucking point? (See the dichotomy now between people who claim ipv6 stateful filtering for routers is obvious and the people who want ipv6?) They eventually added in a default stateful firewall as well for ipv6, which made it completely pointless to convert. Still can’t host games without STUN, etc.
  - vel0city 3y ago
    On a router I had back in the day that seemed to only offer IPv6 support with a toggle of "enable IPv6" it still had a stateful firewall of all out and no new in by default, you just couldn't add custom rules because its whole legacy firewall UI was based around the NAT port forwarding. I've never had a home router that just completely opened IPv6 to the world on my whole home network.
- progval 3y ago
  > IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's DCC (Direct Client-to-Client). CTCP is another in-line protocol that allows things like /me or asking what software other clients run.
vel0city 3y ago
Gas back in the day was also shipped with lead additives. Things change. I don't think I've ever had a home router that didn't also advertise a stateful firewall and I've been buying home routers since 802.11b was a new thing. Are you sure you're not thinking of modems not shipping with a firewall? Because yeah, a pure modem probably doesn't have a firewall. I wouldn't want a modem with a firewall.