5 ms·
Super cool! I tried doing a pure IPv6 network a little over a decade ago; Maybe I’ll try it again. Though, my cheap IoT devices likely still need IPv4… but perh
by imoverclocked 3y ago
Super cool! I tried doing a pure IPv6 network a little over a decade ago; Maybe I’ll try it again. Though, my cheap IoT devices likely still need IPv4… but perhaps not internet connectivity. It might be fun to explore just how much IPv4 continues to be ingrained into cheap Things (eg: Arduino WiFI?) There always seems to be a long tail of small places where IPv4 pops straight back into the equation.
- red_trumpet 3y agoSmall places? When I disabled IPv4 a few weeks ago, I couldn't use: HN, GitHub, Reddit, Discord, Duckduckgo.
- broeng 3y agoAlmost sounds like a productivity enhancement.
- roygbiv2 3y agoAlso Android doesn't support DHCPv6
- piperswe 3y agoWhat's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)
- chungy 3y agoYou can do finer-grained subnets with DHCP than SLAAC will give you.
- darkr 3y agoAs a general rule, if you're deploying IPv6 subnets sized as anything other than /64, you're doing it wrong
- tsimionescu 3y agoThe only reason for that "rule" is SLAAC.
- darkr 3y agoActually it's primarily due to NDP and EUI-64. Eliminating ARP is a very good thing for reasons of scalability, reliability and security.
- tsimionescu 3y agoNDP doesn't impose any restrictions on IP addresses, it uses special prefixes anyway. EUI-64 is a part of SLAAC, not NDP. Finally, NDP is not really any more secure at least than ARP (at least not if you don't implement SEND as well, which I'm not sure if anyone does, at least in consumer networks). Not sure about reliability or scalability either.
- p1mrx 3y agoI think SLAAC's /64 limit functions as a "trojan horse" forcing ISPs to give everyone at least 64 bits of address space. Most would allocate /112-/128 per customer if it were slightly easier. Designing the internet with lots of unused space at the edges will probably be useful in 100 years.
- tsimionescu 3y agoRegardless of the /64 limit, I expect DHCPv6 will win out in the consumer side (with ISPs giving customers pre-configured wifi routers with DHCPv6 already configured). SLAAC is both very complicated, and its privacy extensions are anyway not something ISPs have been friendly to even if it weren't such an extra hassle.
- p1mrx 3y ago> and its privacy extensions are anyway not something ISPs have been friendly to That is an argument for forcing ISPs to support SLAAC, so it's difficult to bill a customer based on the number of devices in their home. ISP-friendly often means user-hostile. If ISPs can deploy device-counting DHCPv6, then router manufacturers will respond with IPv6 NAT, and then the IPv6 landscape will be as shitty as IPv4.
- sgjohnson 3y agoall of the DHCP options, for example. SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.
- MayeulC 3y agoCan't you provide DNS servers as part of router advertisement packets ? RFC8106
- sgjohnson 3y agoI stand corrected, but I haven't seen this in practice yet.
- magicalhippo 3y agoThis requires client support though, which isn't a given.
- stephen_g 3y agoI expect basically anything that supports SLAAC would have supported DNS advertisements for at least a few years…
- ArchOversight 3y agoThat is most operating systems and devices these days.
- rnhmjoj 3y agoThe DNS bit it's not true: there's RFC8106 [1] for this and it's widely supported. You can set a list of DNS servers to use (RDNSS) and a domain suffix for resolving unqualified hostnames (DNSSL), exactly as for DHCP. [1]: https://datatracker.ietf.org/doc/html/rfc8106 https://datatracker.ietf.org/doc/html/rfc8106
- throw0101a 3y ago> What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all) In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself. One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).
- aidenn0 3y agoThe primary advantage is you can delegate prefixes over DHCP, but that probably doesn't matter for most Android devices There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.
- Dagger2 3y agoThose all work for me, on my v6-only desktop. (I don't use Discord, but their homepage loads at least.) None of those sites have v6 though, so you'll need some form of backwards compatibility running to reach them. Presumably you were missing that.
- shapefrog 3y agoDocker hub was the one that pushed me over the edge, so I just paid the extra 50c a month per server for ipv4 on cloud servers. Update - 23 Aug 2023 — Today, we are pleased to announce the general availability of IPv6 support for the Docker Hub Registry Apparently it can be done now, I wont be finding out in a hurry.
- hkgjjgjfjfjfjf 3y ago[dead]
- dehrmann 3y agoI don't have IPv6 enabled. Literally everything works.
- BenjiWiebe 3y agoCongrats on having a non-CGNAT Internet connection available.
- nelgaard 3y agoplus these individual devices will live for a long time. I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS. IPv4 on local networks will probably exist for a very long time.
- dspillett 3y ago> I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS. That sounds like they haven't been updated for TLS>1.1 – if that is the case then rather than going all the way down the HTTP you could enable TLS1.1 (and maybe 1.0). It is open to POODLE/BEAST/others that way, but still have some protection and the site's configuration differs less from the rest of your infrastructure. Unless the site is completely internal only of course, in which case just sticking with HTTP may be less faf.
- tsimionescu 3y agoIs there any way to get a certificate that these old devices would trust and that would work over TLS < 1.2?
- nelgaard 3y agoNo, that is the problem. They worked with less and less websites until there were none left. I needed to install some packages, which I could just put on my own server. And I have an old Blackberry Bold that now show current electricity prices, so I know when to starte my washing machine. That can also run on own webserver. https://gitlab.com/nelgaard/elpriser https://gitlab.com/nelgaard/elpriser
- toast0 3y agoTechnically the certificate issues are separate from the protocol versioning. It's just that clients that don't support TLS 1.2 often also don't support sha2 certificates or may not have a path to validate certificates from currently available CAs (although you can usually push through that; no protocol support and no cert signature support is not a user bypass prompt) As a side note, barely anything supports TLS 1.1 but not TLS 1.2