5 ms·

Businesses and organizations are holding IPv6 back, not consumers. No one I talk to is prioritizing IPv6 migrations or spending money to upgrade gear that will

Businesses and organizations are holding IPv6 back, not consumers. No one I talk to is prioritizing IPv6 migrations or spending money to upgrade gear that will support it. Maybe some net new stuff might get it, but for most businesses IPv4 is and will be the default, simply because they can't be bothered to do something different.

0cf8612b2e1e 3y ago
Serious question, is there any enterprise gear made today which does not support IPv6? I have assumed that the natural hardware upgrade cycles made it so 99% of all active equipment could support the technology, even if it was not configured to do so.
- candiddevmike 3y ago
  That door alarm thing that has a Windows XP workstation VM the facilities team touches once a month probably doesn't support IPv6. Repeat that scenario across multiple BUs and multiple locations and no leader wants to commit to doing that kind of due diligence. What's wrong with our current IP?
  - GoblinSlayer 3y ago
    Windows XP supports IPv6.
- jandrese 3y ago
  Man in the middle certificate re-signing deep packet inspection firewalls are notorious for not supporting IPv6. Most everything else has switched, but many network admins fear IPv6 and don't want to have to learn something new.
- squeaky-clean 3y ago
  "Made today"? Probably not. "Still in operation today"? Definitely. My company makes what is essentially an enterprise IoT device. I'd guesstimate 10% of networks with our hardware in them have no ipv6 support at all. And these are businesses that are on the more tech savvy side (I would assume, since they're ordering our stuff).
- patrakov 3y ago
  It is not about the gear, it's about security people that force you to disable IPv6. "You do not have a valid technical or business reason to use it. And, as electricians say, a VISIBLE circuit break provides the best assurance that this circuit will not kill you. Lack of IPv6, as opposed to just firewalling it, is the equivalent of the visible circuit break. I would also enable a whitelist of permitted ethertypes on all switches, and not include IPv6 there." And let me quote from CIS SUSE Linux Enterprise 15 Benchmark v1.1.1 page 191: "3.1.1 Disable IPv6 (Automated). Profile Applicability: Level 2 - Server, Level 2 - Workstation."
  - champtar 3y ago
    Having an Allowlist of ethertype (ARP/IPv4/IPv6) is an extremely good idea IMO, as Windows and Linux are extremely permissive in what they accept on L2: https://blog.champtar.fr/VLAN0_LLC_SNAP/ https://blog.champtar.fr/VLAN0_LLC_SNAP/
- scott00 3y ago
  TP-Link enterprise wireless access points (the EAP line) don't support IPv6.
jiggawatts 3y ago
It’s worse than that: new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network. Not just unable to use it, but actively incompatible — failing to run if other devices use IPv6! This was an issue with Azure’s PostgreSQL service, which would fail if you deployed other unrelated IPv6 services in the same virtual network. We need a guild of software engineering so that the people responsible for this can be summarily ejected from it.
- endgame 3y ago
  > We need a guild of software engineering The threat of professional exclusion is one of the big levers provided by such a guild. Given the way tech companies behave, why do you believe that this lever will be left in the hands of good people, and not taken over (like the rest of the internet)?
  - candiddevmike 3y ago
    I think there are more developers opposed to the recent web attestation shenanigans than those for it (even those who might be coerced into being for it by their employer). A majority guild vote could stop everyone working on it and keep the web open.
    - LeafItAlone 3y ago
      Who accredits someone to join this guild? Who holds the keys?
    - endgame 3y ago
      Yes, and if you can hold and retain power over the guild then the power of professional exclusion exceeds the coercive power of any one employer. But when your threat model includes adversaries who are willing to subvert the entire open internet to get their way, how do you harden your guild against this attack?
- aoetalks 3y ago
  > new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network I would be shocked if this were true for hardware. Even for software, every major OS in the last 10 years as supported IPv6, and prefers it over IPv4 I’m sure there’s horror stories, but I doubt it’s systemic.
Aeolun 3y ago
Hmm, I use IPv4 mostly because nobody in their right mind can remember a IPv6 address…
- post-it 3y ago
  Who's out there remembering IPv4 addresses?
  - brickteacup 3y ago
    If only there were some sort of a system for translating human readable names to network addresses...
    - waithuh 3y ago
      damn, imagine if the buddies of the company that owns all of these IPs operated that system. The entire internet would be in their control. Wild dream.
  - gaudystead 3y ago
    /me slowly raises hand
  - capableweb 3y ago
    Plenty of people own ipv4 addresses (I mean, all of them are owned, but most by companies) and have been using the same addresses for a very long time, you start to remember some of them by heart after that :)
  - ricardo81 3y ago
    Not I. Any commonly accessed IP tends to be named in my SSH config.
- lucb1e 3y ago
  Have you tried? I knew my v6 block (and static addresses within that, which is like two: router and server) back when I used v6 ten years ago, same as I know my v4 address, without really actively learning either For sure this is a self-hoster thing, where you have pets not cattle, but so is memorizing your v4 address(es)
dheera 3y ago
IP addresses should never have had letters and double colons in them. What's Google's IPv4 DNS? 8.8.8.8. What SHOULD Google's IPv6 DNS be? 8.8.8.8.8.8. What SHOULD Google's IPv8 DNS be? 8.8.8.8.8.8.8.8. What IS Google's IPv6 DNS? 2001::some::shit::I::::can't::remember//::h0ff::affblah This is why I'm still stuck on IPv4. I'm a walking DNS server for all the instances I own, I can hammer out IPs when DNS fails me and that's a very useful feature, especially when idiot Wi-Fi hotspots try to DNS poison you when you're trying to SSH into something and the poisoned IPs stay cached even after you've accepted the stupid TOS.
- red_trumpet 3y ago
  If it is the use of colons instead of dots that prevents you from learning the adresses, then I'm not sure you can be helped. But that discussion aside, if you adopt the IPv4 naming scheme to the 128-bit IPv6 adresses, Google's DNS would be 8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8. I would never be confident that I put in the right number of 8's in that case. And I have a feeling that you being overwhelmed has more to do with the total increase of possibilities, than with hexadecimal notation. I guess it shows that IPv6 was designed for computers, not humans. Because we need a vast number if IP adressses. And that is fine for me.
  - dheera 3y ago
    > If it is the use of colons instead of dots Colons are inherently more frightening than dots, especially double colons, which seems like some badly written C++ class escaped from gaol. Dots feel friendly and cute, I would pet an IPv4 address. > then I'm not sure you can be helped Sure, and the rest of the planet hasn't adopted IPv6 either. It's a horrible UX.
    - red_trumpet 3y ago
      If I'm allowed to argue using unrelated topics and feelings, here you go ;) > Colons are inherently more frightening than dots I highly disagree. In traditional text usage, dots end a sentence. They are terminal. A symbol of stasis. Like death. Contrary to that, a colon always refers to something that comes after: it transcends itself, and wakes my curiosity. It is a symbol of growth and learning.

0cf8612b2e1e 3y ago

Serious question, is there any enterprise gear made today which does not support IPv6? I have assumed that the natural hardware upgrade cycles made it so 99% of all active equipment could support the technology, even if it was not configured to do so.

candiddevmike 3y ago
That door alarm thing that has a Windows XP workstation VM the facilities team touches once a month probably doesn't support IPv6. Repeat that scenario across multiple BUs and multiple locations and no leader wants to commit to doing that kind of due diligence. What's wrong with our current IP?
- GoblinSlayer 3y ago
  Windows XP supports IPv6.
jandrese 3y ago
Man in the middle certificate re-signing deep packet inspection firewalls are notorious for not supporting IPv6. Most everything else has switched, but many network admins fear IPv6 and don't want to have to learn something new.
squeaky-clean 3y ago
"Made today"? Probably not. "Still in operation today"? Definitely. My company makes what is essentially an enterprise IoT device. I'd guesstimate 10% of networks with our hardware in them have no ipv6 support at all. And these are businesses that are on the more tech savvy side (I would assume, since they're ordering our stuff).
patrakov 3y ago
It is not about the gear, it's about security people that force you to disable IPv6. "You do not have a valid technical or business reason to use it. And, as electricians say, a VISIBLE circuit break provides the best assurance that this circuit will not kill you. Lack of IPv6, as opposed to just firewalling it, is the equivalent of the visible circuit break. I would also enable a whitelist of permitted ethertypes on all switches, and not include IPv6 there." And let me quote from CIS SUSE Linux Enterprise 15 Benchmark v1.1.1 page 191: "3.1.1 Disable IPv6 (Automated). Profile Applicability: Level 2 - Server, Level 2 - Workstation."
- champtar 3y ago
  Having an Allowlist of ethertype (ARP/IPv4/IPv6) is an extremely good idea IMO, as Windows and Linux are extremely permissive in what they accept on L2: https://blog.champtar.fr/VLAN0_LLC_SNAP/ https://blog.champtar.fr/VLAN0_LLC_SNAP/
scott00 3y ago
TP-Link enterprise wireless access points (the EAP line) don't support IPv6.

jiggawatts 3y ago

It’s worse than that: new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network. Not just unable to use it, but actively incompatible — failing to run if other devices use IPv6! This was an issue with Azure’s PostgreSQL service, which would fail if you deployed other unrelated IPv6 services in the same virtual network. We need a guild of software engineering so that the people responsible for this can be summarily ejected from it.

endgame 3y ago
> We need a guild of software engineering The threat of professional exclusion is one of the big levers provided by such a guild. Given the way tech companies behave, why do you believe that this lever will be left in the hands of good people, and not taken over (like the rest of the internet)?
- candiddevmike 3y ago
  I think there are more developers opposed to the recent web attestation shenanigans than those for it (even those who might be coerced into being for it by their employer). A majority guild vote could stop everyone working on it and keep the web open.
  - LeafItAlone 3y ago
    Who accredits someone to join this guild? Who holds the keys?
  - endgame 3y ago
    Yes, and if you can hold and retain power over the guild then the power of professional exclusion exceeds the coercive power of any one employer. But when your threat model includes adversaries who are willing to subvert the entire open internet to get their way, how do you harden your guild against this attack?
aoetalks 3y ago
> new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network I would be shocked if this were true for hardware. Even for software, every major OS in the last 10 years as supported IPv6, and prefers it over IPv4 I’m sure there’s horror stories, but I doubt it’s systemic.

Aeolun 3y ago

Hmm, I use IPv4 mostly because nobody in their right mind can remember a IPv6 address…

post-it 3y ago
Who's out there remembering IPv4 addresses?
- brickteacup 3y ago
  If only there were some sort of a system for translating human readable names to network addresses...
  - waithuh 3y ago
    damn, imagine if the buddies of the company that owns all of these IPs operated that system. The entire internet would be in their control. Wild dream.
- gaudystead 3y ago
  /me slowly raises hand
- capableweb 3y ago
  Plenty of people own ipv4 addresses (I mean, all of them are owned, but most by companies) and have been using the same addresses for a very long time, you start to remember some of them by heart after that :)
- ricardo81 3y ago
  Not I. Any commonly accessed IP tends to be named in my SSH config.
lucb1e 3y ago
Have you tried? I knew my v6 block (and static addresses within that, which is like two: router and server) back when I used v6 ten years ago, same as I know my v4 address, without really actively learning either For sure this is a self-hoster thing, where you have pets not cattle, but so is memorizing your v4 address(es)

dheera 3y ago

IP addresses should never have had letters and double colons in them. What's Google's IPv4 DNS? 8.8.8.8. What SHOULD Google's IPv6 DNS be? 8.8.8.8.8.8. What SHOULD Google's IPv8 DNS be? 8.8.8.8.8.8.8.8. What IS Google's IPv6 DNS? 2001::some::shit::I::::can't::remember//::h0ff::affblah This is why I'm still stuck on IPv4. I'm a walking DNS server for all the instances I own, I can hammer out IPs when DNS fails me and that's a very useful feature, especially when idiot Wi-Fi hotspots try to DNS poison you when you're trying to SSH into something and the poisoned IPs stay cached even after you've accepted the stupid TOS.

red_trumpet 3y ago
If it is the use of colons instead of dots that prevents you from learning the adresses, then I'm not sure you can be helped. But that discussion aside, if you adopt the IPv4 naming scheme to the 128-bit IPv6 adresses, Google's DNS would be 8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8. I would never be confident that I put in the right number of 8's in that case. And I have a feeling that you being overwhelmed has more to do with the total increase of possibilities, than with hexadecimal notation. I guess it shows that IPv6 was designed for computers, not humans. Because we need a vast number if IP adressses. And that is fine for me.
- dheera 3y ago
  > If it is the use of colons instead of dots Colons are inherently more frightening than dots, especially double colons, which seems like some badly written C++ class escaped from gaol. Dots feel friendly and cute, I would pet an IPv4 address. > then I'm not sure you can be helped Sure, and the rest of the planet hasn't adopted IPv6 either. It's a horrible UX.
  - red_trumpet 3y ago
    If I'm allowed to argue using unrelated topics and feelings, here you go ;) > Colons are inherently more frightening than dots I highly disagree. In traditional text usage, dots end a sentence. They are terminal. A symbol of stasis. Like death. Contrary to that, a colon always refers to something that comes after: it transcends itself, and wakes my curiosity. It is a symbol of growth and learning.