21 ms·
Czech republic sets IPv4 end date
- captainkrtek 3y agoFor 2032… we got a minute
- bombcar 3y agoRight before unix time_t eh.
- kristopolous 3y agoMight as well blow it all up at once
- autoexecbat 3y agoan 8 year gap
- BizarroLand 3y agoI wonder how this will go? 8 years is plenty of time to make the transition even for a government, right?
- promiseofbeans 3y agoFor governments maybe, but for banks? They're still desperately trying to transition to IBM databases that were deprecated slightly more recently than their current one.
- marcosdumay 3y agoThey only have to transition their external communications, they can keep their 90's DB2 databases that cost millions/(MB*year) just fine.
- 0cf8612b2e1e 3y agoProbably easier to start a new bank.
- bombcar 3y agoEight years is forever, we can wait. Five years is a long time, let’s work on other things. Three years isn’t terribly soon, it’ll probably be fine. Two years is getting close, let’s consider checking. One year is too close, let’s ask for an extension.
- labster 3y agoI would name that poem “The Ballad of REAL ID”
- nxobject 3y agoStrangely enough, though, it seems to be working in everyone's favor in this case.
- stcredzero 3y agoEight years is forever, we can wait. I've heard that under 10 years is the optimal for a long term government project. Anything longer, and it's equal to "forever," and it's never done. This was the rationale for setting the goal of landing on the Moon to within the decade.
- p_l 3y agoWhich is why this time US government for example is only allowing extensions to government agencies on case by case basis, but not to vendors. AFAIK they allowed extensions for vendors in 1990 and that's why original EOL date for IPv4 continuously slipped until success by Network Translation and its PIX devices helped kill the attempt completely.
- p_l 3y agoThe "ancient" code probably already speaks IPv6 due to whatever method used to hook IP connectivity to its VTAM interfaces. Or due to its age it has multiprotocol support anyway. It's the BSD Sockets using code that is a problem - the OSes has supported v6 for a long time now.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- xyst 3y agogood - it’s time to put ipv4 to pasture
- squarefoot 3y agoOr maybe keep it only for local networks?
- qwertox 3y agoWon't you always be able to use it for local networks? I like NAT and regardless of IPv6, I think I'll keep my home network as IPv4 in a NAT and completely block outgoing and incoming per-device-IPv6.
- TacticalCoder 3y ago> Won't you always be able to use it for local networks? Well for me until Linux shall support IPv4 my machines shall be on IPv4 behind NAT. And yet I'm enjoying IPv6 with my ISP-provider router transparently doing the heavy lifting and using IPv6. > and completely block outgoing and incoming per-device-IPv6. Same. I do just that: it's disable by a kernel parameter, in sysctl and in the firewall, just in case I'd mess up and re-enable one or two of these. You can pry IPv4 on my LAN from my cold dead hands.
- X-Istence 3y agoHow is your isp provided router doing the heavy lifting? You’ve turned off IPv6… you won’t be able to reach IPv6 resources.
- qwertox 3y agoIn my case I run a double NAT. I don't consider the subnet which the ISP's router offers to me as something belonging to me, but something the ISP owns. In that subnet I have one honeypot (old Raspi) and a router which treats that subnet as the internet and offers me my own subnet which I call home. I don't care what the ISP does with the router it provides to me. If it uses IPv6 or whatever. In my case their router will only see another device which is only capable of using IPv4, so it better deal with it.
- autoexecbat 3y agoThis is great, I hope we have more organizations follow. Not that I think we should entirely/forcefully remove ipv4, but saying that it's going away will force ipv6 migrations
- 2024throwaway 3y agoI personally don't think making a very large amount of devices completely obsolete is the best thing, from an environmental standpoint. Call me a dumb hippie.
- colechristensen 3y agoPass laws requiring long term hardware support and open source code for unsupported devices.
- kazinator 3y ago... and unlimited flash space for forever upgrades!
- kazinator 3y ago... and unlimited flash space for accepting larger and larger upgrades, forever!
- BenjiWiebe 3y agoIf it's open source I'll delete 90% of the manufacturer provided telemetry/tracking/anti-features and use 1/20th of that free space to add the feature I want.
- supertrope 3y agoOne response to EU recycling mandates is to just pull out of those markets. Some website operators just block the EU as it's easier than complying with privacy regulations. When new regulations per the USA's Americans with Disabilities Act mandated captions, a few MOOCs just yanked their videos.
- deadbunny 3y agoWhich devices don't support IPv6 at this point?
- 2024throwaway 3y ago
- deleted 3y ago[deleted]
- DarkmSparks 3y agoI cant imagine how much "fun" its going to be trying to lock down a governments systems when every single device on their network is potentially reachable directly from China...
- MOARDONGZPLZ 3y agoThis feels like FUD. You can still assign a block of ipv6 as internal to your network and put it behind a bastion. Forcing ipv6 isn’t the same as going zero trust or something where now everything is publicly routable.
- DarkmSparks 3y agoand whats stopping an intruder reassigning that block to something that can be publically accessed and how will that be monitored?
- cyberax 3y agoUhhh... Whut? You obviously need to use a ULA prefix, they are not routed (just like RFC1918 space in IPv4). Or you can just use your allocated IPv6 space, and firewall at the border. And you hopefully have BGP hijack monitoring set up anyway.
- DarkmSparks 3y agoyou do know single network devices can have more than one ip address? afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks.
- greyface- 3y ago> afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks. This is not unique to IPv6. ARP spoofing is the v4 version of this attack. RA spoofing is the v6 version of the attack. In both cases, the solution is the same: lock down your L2 by enabling MAC / ARP / RA filtering on your switch.
- Alupis 3y agoI'm ignorant on these things, so please inform me - but given IPv6's awful adoption rate, and given how foreign it's numbering scheme is to many, why can't we introduce IPv7 and just extend the IPv4 scheme with additional octets? Something like 0.0.0.0.0.0.0 and everything without the correct number of octets just gets filled with zeros. So 192.168.0.1 becomes 0.0.0.0.192.168.0.1. Then also don't give out /8's to universities and the like (repeating old mistakes). This is probably naive, but it seems it would be easier for people to use vs. 2661:919a:023e:911a:44dc:f656:233e:8816
- Macha 3y agoBecause the problem is not the numeric representation. The problem is when you get a message from 1.0.0.0.1.1.1.1 to 0.0.0.0.192.168.0.1, and 192.168.0.1 is an IPv4 only device, what are you going to tell 192.168.0.1 about the source address? There's only a 32 bit field in the protocol. Are you going to lie and tell it it's 1.1.1.1? Congrats, you've just reinvented NAT. Enjoy your stateful boundary system and all that complexity again. Are you going to add some extension to IPv4 and try convince everyone to upgrade all their hardware, software and configurations? Then you have the exact same problem IPv6 adoption had, except IPv6 adoption is at like 45% globally and your new scheme is at 0%: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html If you have some other idea, make sure to check it against the list of IPv6 transition mechanisms before commenting - it probably exists for IPv6, and ultimately all of them have been displaced by dual stacking: https://en.wikipedia.org/wiki/IPv6_transition_mechanism https://en.wikipedia.org/wiki/IPv6_transition_mechanism
- Alupis 3y ago> There's only a 32 bit field in the protocol IPv6 is 128 bits... so we already made a change. Why can IPv7 not be 128 bits as well, but vastly more readable/recognizable than IPv6. Hex is hard on the eyes, especially for those who don't stare at it all day.
- NoZebra120vClip 3y ago> Hex is hard on the eyes Thankfully there is near-100% compliance with PTR reverse-dns for IPv6 addresses and networks. /s
- hasty_pudding 3y agoI wish the US had balls like that.
- wmf 3y agoUS DOD started transitioning to IPv6-only in 2021. I wonder how it's going so far. https://media.defense.gov/2021/Jul/13/2002761414/-1/-1/0/DOD-MEMORANDUM-DEPARTMENT-OF-DEFENSE-IMPLEMENTATION-OF-INTERNET-PROTOCOL-VERSION-6.PDF https://media.defense.gov/2021/Jul/13/2002761414/-1/-1/0/DOD...
- thfuran 3y agoI predict they'll be just about done by the time 2038 rolls around.
- zokier 3y agoUS gov has been actively pushing for IPv6. You can question the efficacy of their efforts, but the intent is there. Of course I suspect there is lot more inertia of all sorts in US gov compared to CZ, just due size and history. Read for example https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-0... (does anyone have more recent ref?)
- a1o 3y agoMinor question, does using IPv6 makes it easier to track people than when using IPv4?
- wmf 3y agoIPv6 privacy addressing reduces tracking.
- j16sdiz 3y ago... within the same prefix.
- deleted 3y ago[deleted]
- rijx 3y agoFor some people, but most people are very easily trackable using IPv4 + user agent. There are even better JS fingerprints that don’t use your IP.
- chungy 3y agoIn general, no. All operating systems default to using random host bits in SLAAC addresses, each bootup (or change of network interface) will instantiate a new address. More than that though, IP addresses in both v4 and v6 varieties are unreliable sources for tracking and basically no actor you'd want to guard against depends on them anyway. With mobile phones being common, your public addresses are changing all the time anyway. On IPv4, CGNAT is becoming increasingly more common so that you might share a public IPv4 address with thousands of other people at the same time.
- comex 3y ago> On IPv4, CGNAT is becoming increasingly more common so that you might share a public IPv4 address with thousands of other people at the same time. Which is an advantage from an anti-tracking perspective — an advantage you won’t get with IPv6, no?
- decasia 3y agoOK so — I just migrated my personal website to use IPv6 only. It runs on AWS EC2, and my motivation was purely to save on paying the IPv4 fee that AWS is introducing next week. I put it behind Cloudflare which can provide an IPv4 proxy address for site visitors. But the thing is, even though IPv6 is such well established tech, it was not a great migration experience. I'm not a network engineer, and you have to figure out how to update a bunch of networking configuration to make this switch on an existing instance, with lots of potential footguns. Even after I got the IPv6 address provisioned and the virtual networking correctly configured, the connectivity was still broken until I found an obscure security group setting that was still set to allow only IPv4 traffic. A lot of basic debugging tools like curl are designed to use IPv4 by default. You have to figure out how to get your webserver (nginx in my case) to listen on the IPv6 interface, which is fiddly. And it's easy to inadvertently break ssh connectivity, which turns out to also be set up to expect IPv4 traffic only... In the end, it took about 90 minutes of fiddling, including migrating to Cloudflare, fixing DNS, etc. I mean, it's fine. I learned some things. But if we're all going to switch to an IPv6 world, it would really be nice if the systems and tooling made it slightly easier, somehow.
- jeroenhd 3y agoThe thing is, with my mediocre $5 VPS, all I needed to do was copy four lines of config files (as documented by the VPS provider) and open a port in the firewall on the server itself, just like on IPv4. Amazon is horribly behind on a lot of things (just look how long it took them to get DNSSEC working, and it took them a couple of tries to not break entire domains for people using it!). They're ahead of Azure, but that's about the best you can say about that. I suppose it makes sense, IPv4 addressing is now an additional method to make money for Amazon, so why make it easy for customers to migrate?
- decasia 3y agoYep, it crossed my mind that AWS has no incentive to optimize this particular process since they have planned to monetize it :/
- 3y ago
- ChrisArchitect 3y ago[dupe] More last week: https://news.ycombinator.com/item?id=39060187 https://news.ycombinator.com/item?id=39060187
- senectus1 3y agoClick saver: On 17 January 2024, the Government of the Czech Republic approved the material "Restarting the implementation of DNSSEC and IPv6 technologies in the state administration". On the basis of this decision, the Czech state administration will stop providing its services over IPv4 on 6 June 2032. Thus, the Czech Republic knows its IPv4 shutdown
- mito88 3y agowho will check the IP addresses?
- Animats 3y agoConversion to IPv6 is an item in the 14th Five Year Plan (2021-2025) of the People's Republic of China.[1] "We will accelerate the large-scale deployment of 5G networks, increase the user penetration rate to 56%, and promote the upgrade of gigabit optical fiber networks. We will build up technology reserves for the future deployment of 6G network technology. We will expand backbone network interconnection nodes, set up a number of new international communication gateways, and comprehensively promote the commercial deployment of Internet Protocol Version 6 (IPv6)." There is a migration schedule.[2][3] As of this month, there are supposed to be no new IPv4 services. The goal is IPv6 only by 2030. Actual adoption in China is reportedly only 25-30%, though. [1] https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Five_Year_Plan_EN.pdf https://cset.georgetown.edu/wp-content/uploads/t0284_14th_Fi... [2] https://blog.apnic.net/2019/06/06/100-by-2025-china-getting-serious-about-ipv6/ https://blog.apnic.net/2019/06/06/100-by-2025-china-getting-... [3] https://www.theregister.com/2023/04/28/china_ipv6_control_adoption/ https://www.theregister.com/2023/04/28/china_ipv6_control_ad...
- bdd8f1df777b 3y agoI grow up in China seeing news about the policy of IPv6 adoption every year, but the real adoption rate is still abysmal here.
- nijave 3y agoIn the U.S. I run into issues most commonly with businesses. Consumer ISPs and mobile operators all seem to have IPv6. Hosting providers (and recently cloud providers...) all have dual stack or v6 only. However I don't think I've ever worked anywhere that actually had an IPv6 network (at least on the office side)
- omeid2 3y agoSomething that isn't talked much about IPv6 and I believe has subtle and indirect influence on it's adoption is that it is far far far less human-readable than IPv4. You can't find me a single sysadmin or casual user who would look at an IPv6 and say, nice, I prefer that one over an IPv4 or find it easier to type or communicate. You can argue about merits of IPv6 and very reasonably so all day long, but this fact remains. I don't think governments or other institutions can strong-arm IPv4 out of existence. I don't know what the long term solution would look like, but I strongly doubt it will be IPv6-only. Ever.
- notatoad 3y ago"IPv6 addresses are ugly" is only an argument for as long as ipv4 addresses don't cost anything. as soon as they put a price on it, nobody's going to care.
- omeid2 3y agoArguing that "we can price IPv4 out" only reinforces my point; of course, ignoring the fact that it is a pipe-dream. But the fact remains, no one really prefers IPv6 over IPv4.
- imoverclocked 3y agoI do.
- Faark 3y agoJust like users prefer domain names over ip's. But they are necessary.
- timthelion 3y agoI started to prefer it after I foundout that with IPv6 every Docker container can have its own IP address and this can be used to solve the hairpin NAT problem.
- crotchfire 3y agoThat happened a long time ago. And yet still, nobody cares.
- tomjen3 3y agoThis really needs to be an EU-wide thing, and a lot sooner. Two years till it becomes illegal to offer something on IPv4 for the general public and not offer it on IPv6, two more years and no ISP may route IPv4. Also no ISP NAT bullshit. A default enabled firewall refusing incoming connections is fine, but the internet should be a network of machines that can talk to each other, and for that to happen it must be possible for owners to accept incoming connections, even if it is for nothing more than remote access to their PCs.
- ikt 3y ago> Two years till it becomes illegal to offer something on IPv4 for the general public and not offer it on IPv6 Why? Is there any pressing need for ipv6 only connectivity that you'd make ipv4 only illegal?
- loup-vaillant 3y agoBecause this of course: > the internet should be a network of machines that can talk to each other, and for that to happen it must be possible for owners to accept incoming connections The importance of this is quite obvious if you’re politicised enough. Stuff like Free Speech.
- vdaea 3y agoFrom the perspective of the US that makes sense. It's legal to say practically everything but hostings will kick you out if they don't like you. But in the EU speech is restricted and hostings won't kick you out unless you say something illegal... and at that point you'll be in trouble hosting stuff using your home connection.
- tomjen3 3y agoIts not just that - if we want to be competitive then it should be possible for a hacker to offer a new type of idea and let the world try it out - perhaps a decentralized web, or planet scale IPFS, or something that yet only exists in the head of some 17 year old nerd. And while Europe is more restricted than the US, it is not like we are the Soviet union.
- nikita14 3y agoGood move.
- radiator 3y agoTangentially, I thought Czechia is the modern and practical name for the country. "Czech republic" was used for many years, for reasons which I never understood, even though nobody says "Italian republic" or "German federal republic". If you insist on using an old name, you might as well chose "Bohemia".
- tomashubelbauer 3y agoBohemia is one of three historical states comprising the Czech Republic, the other two being Moravia and Silesia. I can't speak for all Czech people, but I can tell you there is a sizable group who don't like the name Czechia because its Czech equivalent "Cesko" while nowadays officially recognized as a short version of the country's name was originally only a conversational short name and it feels far from proper and official both as the Czech version, "Cesko", and in the English translation, "Czechia". I would be interested in a poll of the Czech public quantifying people's preferences towards which name they prefer to see how small a hill I am choosing to die on actually. BTW the full name includes the definite article, so it is "the Czech Republic".
- omnimus 3y agoThe reason is very similar to why people from United Kingdom get upset when you call it England. Czechia is at same time name of the main region and (now) the country as a whole. Funnily enough the distinction between regions exists in english language - Bohemia being the name of the region. So Czechia as name for country could work. But in czech language word for Bohemia region is "Czechia" (there is no Bohemia). So thats why for years you had people insisting on the Czech Republic. Because you don't want to overlook the other two regions Moravia and Silesia.
- Jenda_ 3y ago> But in czech language word for Bohemia region is "Czechia" (there is no Bohemia). No. Bohemia is Čechy, Czechia is Česko. Yes, they are sometimes confused, and maybe people are unhappy with Česko because it's just too similar to Čechy. People from Moravia and Silesia feel underrepresented when someone mistakenly uses "Čechy" (Bohemia) for the entire Česko (Czechia; Bohemia+Moravia+Silesia).
- typh00n 3y agoWhat I worry about in a fully adopted IPv6 world, are the old Games that run on IPv4 p2p. (like C&C3) Sure, you can do a IPv4 VPN with your friends, but that means no more games with strangers over the internet.
- Gormo 3y agoAdoption of IPv6 by large organizations for their services doesn't make IPv4 go away. And even if ISPs stopped issuing IPv4 addresses to end users, there's nothing stopping anyone from setting up a public VPN into an IPv4-based virtual LAN -- if there was demand for it, it could easily be offered by the same services you're currently using to find "strangers over the internet" right now.
- freedude 3y agoThis is good since their adoption rates are low compared to other nearby countries (France, Germany, Austria). Oh, for all of those that keep saying it will take forever for the USA to switch to IPv6 follow the link with your cell phone. https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
- itsTyrion 3y agoNo more GitHub?