6 ms·

Let's just get this out of the way before the debate commences: DNS was invented in 1985 so that you don't have to memorise IP addresses. DHCP was invented in

Let's just get this out of the way before the debate commences: DNS was invented in 1985 so that you don't have to memorise IP addresses. DHCP was invented in 1984 so that you don't have to allocate IP addresses manually. You can allocate nice short IPv6 addresses if you like to memorise hundreds of numbers as a hobby instead of letting the computer do that for you. NAT is a hack for getting past the address-space limitations of IPv4. NAT provides security as a side-effect. Firewalls provide the same security. Every router has a firewall built in now, whether they use NAT or not. IPv6 has the same security as IPv4 whether or not you use NAT. There are no "privacy issues" with IPv6. All modern clients randomise the host part of the address. You "look the same" to the rest of the Internet whether your unique address is a single IPv4 address or a /64 prefix. It's a unique identifier in both cases. People that want to track you can use a hundred other techniques, most of which are more robust than your IP address. You're tracked anyway. Giving up on the future of the Internet in a futile attempt to stop your porn habits being tracked is not a valid argument against IPv6.

trvr 3y ago
Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? I've always been under the impression that it is actually easier to track an individual user on IPv6 because each device now has a unique address. Example Company could now tell the difference between 2 users in a home, for example, instead of just a single NAT'd IPv4 address. Is that not true?
- tolien 3y ago
  How frequently the randomisation happens is configurable but the expectation is it should be ~daily. The thing you’re looking for is the SLAAC Privacy Extensions [1] 1: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...
- ianburrell 3y ago
  IPv6 host can change its address as much as it wants. In fact, it can have as many addresses as it wants. It could use a different address for every outgoing connection. Nothing goes that far. Most modern OSes change IPv6 every hour to once per day. The result is that any tracker can't tell if two IPv6 addresses in the same subnet are two hosts or one that changed its address.
- arccy 3y ago
  you get a randomized address for the network, but then also temporary addresses that are cycled on reboot / netstack restarts for outgoing connections
- burnerthrow008 3y ago
  > Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? In practice, most OSes generate a new address once per day, but more significantly, it is completely normal for an IPv6 host to have multiple addresses per interface at the same time. In fact, it is effectively mandatory to have at least two: First, you must have a link-local address (fe80::/10), which is non-routable. This is required for SLAAC and DHCPv6 to work. Second, if you want to talk to the rest of internet, you need a routable address (from SLAAC or DHCPv6). In practice, it's even more than that: The computer I'm writing this on currently has 12 IPv6 addresses on one ethernet interface. Besides the link-local address, it has as a bunch of routable addresses on the prefix delegated by my ISP. All but one of the routable are "deprecated" which means that they won't be used for new outgoing connections, but remain active for existing connections. So not only do you get a new randomized address every 24 hours, you may have an arbitrary number of randomized addresses active at any given time. There's nothing stopping a privacy-focused Linux distro from generating a new address for every outgoing connection, and having them all active at once.
  - ikekkdcjkfke 3y ago
    How do the switches handle potentially that many addressess?
    - greyface- 3y ago
      Non–multicast-aware switches don't care; there aren't any additional unicast MAC addresses on the wire. Multicast-aware switches will incur multicast table growth, except in cases where multiple addresses on the same host share the same final 24 bits, which will cause them to share the same solicited-node multicast address (and therefore the same multicast MAC).
justsomehnguy 3y ago
> NAT provides security as a side-effect. sigh NAT provides a false sense of security as a side-effect. There is nothing in NAT what couldn't be done with DENY rule in the firewall.
- TheLoafOfBread 3y ago
  Misconfigured NAT is not working on either side. Misconfigured firewall is a gaping hole into the local network.
  - yesco 3y ago
    A misconfigured firewall is a gaping hole in your network regardless of whether NAT is involved. This means someone could brute force access into the configuration interface of your router and configure your network however they like. NAT security is a dangerous illusion that people just can't seem to stop falling for.
    - LegionMammal978 3y ago
      Are you saying that every firewall misconfiguration that exposes any one host to the public Internet necessarily exposes control over the router configuration to the public Internet? I don't see how that follows.
      - yesco 3y ago
        No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. If you mean to imply that what I'm saying here is ridiculous because a "firewall misconfiguration that exposes any one (non-router) host to the public Internet" is only possible with a IPv6 or a NAT-less IPv4 network then you would be wrong (unless you were just being pedantic that I excluded such an example). A misconfigured firewall that exposes an internal host to the Internet would just look slightly different with NAT, since hosts are usually exposed via the firewall's port forwarding rules instead of the full featured allow/deny rules. There are technically going to be more firewall configuration options in NAT-less networks, but the risk of a misconfiguration accidentally exposing a host is not going to be any greater here. If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. Ideally internal networks should be configured to only allow inbound connections to specific host:ports from trusted external IPs/IP-ranges, but NAT makes this more complicated to do, so people get complacent with just exposing all inbound connections to specific host:ports because that is what port forwarding is usually going to default to absent of any other configuration.
cyberax 3y ago
> You can allocate nice short IPv6 addresses if you like to memorise hundreds of numbers as a hobby instead of letting the computer do that for you. You can not. Stateful DHCPv6 is poorly supported. In particular, Android doesn't support it, and I had problems with it on iOS. It's so niche at this point, that many companies (Mikrotik, I'm looking at you) don't even bother with it. Moreover, even stateful DHCPv6 is a regression compared to V4 because it misses the host name. I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6.
- ninkendo 3y ago
  > I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6. I can do the same thing with mDNS, there’s no need to run a stateful DHCP server. avahi-browse -at Done.
  - cyberax 3y ago
    Sigh. No. mDNS is not mandatory (e.g. my TrippLite UPS management card doesn't support it), and it requires active device participation. If a device is busy or slow to respond, you'll miss it. DHCPv4 leases are authoritative, and they don't require device participation for discovery.
    - ninkendo 3y ago
      Sending hostnames isn’t required for DHCPv4 either. If we want to talk about ill-behaved clients, I don’t see why you can count this as a negative for mDNS but not stateful DHCP.
      - cyberax 3y ago
        In practice, hostnames are sent by most clients, because it requires pretty much zero effort from the device. mDNS requires a complicated service that needs to be always on.
- 3y ago
kortilla 3y ago
> NAT provides security as a side-effect. > IPv6 has the same security as IPv4 whether or not you use NAT. Both of these cannot be true.
- jiggawatts 3y ago
  They are if you have a firewall, which is the default for all routers and most host devices.
- orangeboats 3y ago
  Most modern home routers have their IPv6 firewall enabled by default. (I am ignoring enterprise because the networking people there should already know firewalling) In that context, the second statement can be true.
guilhas 3y ago
> "Giving up on the future of the Internet in a futile attempt to stop your porn habits being tracked is not a valid argument against IPv6." Is the network admin version of "If you have nothing to hide, you have nothing to fear?"
- jiggawatts 3y ago
  The loudest people arguing against IPv6 are often hiding the kind of behaviour I really don’t care to protect. Drug purchases on the dark web or exchanging child porn are common reasons to be this paranoid. Normal people just use a VPN or a cloud proxy and move on with their lives. It’s all academic anyway. It’s hilariously easy and effective to build up an identity via browser fingerprinting, or similar techniques. Ironically, the more crazy “protections” you layer on, the more special and distinct that fingerprint becomes. As a case in point: running a Tor client makes you a high priory target for the NSA and similar state agencies. To the point that something like half of all Tor nodes are rumored to be compromised! PS: IPv6 is such a vast number space that brute force scanning the Internet to look for vulnerabilities will go from a “hilariously simple Python script” to “literally impossible”! People worried about security and privacy should be rushing to switch to IPv6 because it’ll permanently block all drive-by attacks!
  - drtgh 3y ago
    > The loudest people arguing against IPv6 are often hiding the kind of behaviour I really don’t care to protect. Drug purchases on the dark web or exchanging child porn are common reasons to be this paranoid. > Normal people just use a VPN or a cloud proxy [...] Ad hominem << The most common form of this fallacy is "A" makes a claim of "fact," to which "B" asserts that "A" has a personal trait, quality or physical attribute that is repugnant thereby going entirely off-topic [...] >> https://en.wikipedia.org/wiki/Ad_hominem https://en.wikipedia.org/wiki/Ad_hominem
    - jiggawatts 3y ago
      Unfortunately, this is the sad reality of the situation. I've seen a number of online arguments where someone was "fighting the good fight" against corporate censorship, getting their account locked for "no reason", or whatever. In a few such cases the site admin responded with "you're a relentless spammer, that is why you were banned". Or in one such case, "you were sending unsolicited dick picks to underage girls". Not everyone is nice. Some people's ideal for the Internet is not my ideal for the Internet. I don't have to agree with everyone, and I don't think infinite protections should be granted to people like that at great cost to everyone else.
mannyv 3y ago
BOOTP came before DHCP but was a bit too limited.

trvr 3y ago

Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? I've always been under the impression that it is actually easier to track an individual user on IPv6 because each device now has a unique address. Example Company could now tell the difference between 2 users in a home, for example, instead of just a single NAT'd IPv4 address. Is that not true?

tolien 3y ago
How frequently the randomisation happens is configurable but the expectation is it should be ~daily. The thing you’re looking for is the SLAAC Privacy Extensions [1] 1: https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac/ https://www.internetsociety.org/resources/deploy360/2014/pri...
ianburrell 3y ago
IPv6 host can change its address as much as it wants. In fact, it can have as many addresses as it wants. It could use a different address for every outgoing connection. Nothing goes that far. Most modern OSes change IPv6 every hour to once per day. The result is that any tracker can't tell if two IPv6 addresses in the same subnet are two hosts or one that changed its address.
arccy 3y ago
you get a randomized address for the network, but then also temporary addresses that are cycled on reboot / netstack restarts for outgoing connections
burnerthrow008 3y ago
> Can you expand on the "All modern clients randomise the host part of the address" statement. Do they randomize this host part for every session or just once per network? In practice, most OSes generate a new address once per day, but more significantly, it is completely normal for an IPv6 host to have multiple addresses per interface at the same time. In fact, it is effectively mandatory to have at least two: First, you must have a link-local address (fe80::/10), which is non-routable. This is required for SLAAC and DHCPv6 to work. Second, if you want to talk to the rest of internet, you need a routable address (from SLAAC or DHCPv6). In practice, it's even more than that: The computer I'm writing this on currently has 12 IPv6 addresses on one ethernet interface. Besides the link-local address, it has as a bunch of routable addresses on the prefix delegated by my ISP. All but one of the routable are "deprecated" which means that they won't be used for new outgoing connections, but remain active for existing connections. So not only do you get a new randomized address every 24 hours, you may have an arbitrary number of randomized addresses active at any given time. There's nothing stopping a privacy-focused Linux distro from generating a new address for every outgoing connection, and having them all active at once.
- ikekkdcjkfke 3y ago
  How do the switches handle potentially that many addressess?
  - greyface- 3y ago
    Non–multicast-aware switches don't care; there aren't any additional unicast MAC addresses on the wire. Multicast-aware switches will incur multicast table growth, except in cases where multiple addresses on the same host share the same final 24 bits, which will cause them to share the same solicited-node multicast address (and therefore the same multicast MAC).

justsomehnguy 3y ago

> NAT provides security as a side-effect. sigh NAT provides a false sense of security as a side-effect. There is nothing in NAT what couldn't be done with DENY rule in the firewall.

TheLoafOfBread 3y ago
Misconfigured NAT is not working on either side. Misconfigured firewall is a gaping hole into the local network.
- yesco 3y ago
  A misconfigured firewall is a gaping hole in your network regardless of whether NAT is involved. This means someone could brute force access into the configuration interface of your router and configure your network however they like. NAT security is a dangerous illusion that people just can't seem to stop falling for.
  - LegionMammal978 3y ago
    Are you saying that every firewall misconfiguration that exposes any one host to the public Internet necessarily exposes control over the router configuration to the public Internet? I don't see how that follows.
    - yesco 3y ago
      No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. If you mean to imply that what I'm saying here is ridiculous because a "firewall misconfiguration that exposes any one (non-router) host to the public Internet" is only possible with a IPv6 or a NAT-less IPv4 network then you would be wrong (unless you were just being pedantic that I excluded such an example). A misconfigured firewall that exposes an internal host to the Internet would just look slightly different with NAT, since hosts are usually exposed via the firewall's port forwarding rules instead of the full featured allow/deny rules. There are technically going to be more firewall configuration options in NAT-less networks, but the risk of a misconfiguration accidentally exposing a host is not going to be any greater here. If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. Ideally internal networks should be configured to only allow inbound connections to specific host:ports from trusted external IPs/IP-ranges, but NAT makes this more complicated to do, so people get complacent with just exposing all inbound connections to specific host:ports because that is what port forwarding is usually going to default to absent of any other configuration.

cyberax 3y ago

> You can allocate nice short IPv6 addresses if you like to memorise hundreds of numbers as a hobby instead of letting the computer do that for you. You can not. Stateful DHCPv6 is poorly supported. In particular, Android doesn't support it, and I had problems with it on iOS. It's so niche at this point, that many companies (Mikrotik, I'm looking at you) don't even bother with it. Moreover, even stateful DHCPv6 is a regression compared to V4 because it misses the host name. I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6.

ninkendo 3y ago
> I can do a rough inventory of my IPv4 home network (120 devices) by looking at hostnames for DHCPv4 leases, no such thing exists for IPv6. I can do the same thing with mDNS, there’s no need to run a stateful DHCP server. avahi-browse -at Done.
- cyberax 3y ago
  Sigh. No. mDNS is not mandatory (e.g. my TrippLite UPS management card doesn't support it), and it requires active device participation. If a device is busy or slow to respond, you'll miss it. DHCPv4 leases are authoritative, and they don't require device participation for discovery.
  - ninkendo 3y ago
    Sending hostnames isn’t required for DHCPv4 either. If we want to talk about ill-behaved clients, I don’t see why you can count this as a negative for mDNS but not stateful DHCP.
    - cyberax 3y ago
      In practice, hostnames are sent by most clients, because it requires pretty much zero effort from the device. mDNS requires a complicated service that needs to be always on.
3y ago

kortilla 3y ago

> NAT provides security as a side-effect. > IPv6 has the same security as IPv4 whether or not you use NAT. Both of these cannot be true.

jiggawatts 3y ago
They are if you have a firewall, which is the default for all routers and most host devices.
orangeboats 3y ago
Most modern home routers have their IPv6 firewall enabled by default. (I am ignoring enterprise because the networking people there should already know firewalling) In that context, the second statement can be true.

guilhas 3y ago

> "Giving up on the future of the Internet in a futile attempt to stop your porn habits being tracked is not a valid argument against IPv6." Is the network admin version of "If you have nothing to hide, you have nothing to fear?"

jiggawatts 3y ago
The loudest people arguing against IPv6 are often hiding the kind of behaviour I really don’t care to protect. Drug purchases on the dark web or exchanging child porn are common reasons to be this paranoid. Normal people just use a VPN or a cloud proxy and move on with their lives. It’s all academic anyway. It’s hilariously easy and effective to build up an identity via browser fingerprinting, or similar techniques. Ironically, the more crazy “protections” you layer on, the more special and distinct that fingerprint becomes. As a case in point: running a Tor client makes you a high priory target for the NSA and similar state agencies. To the point that something like half of all Tor nodes are rumored to be compromised! PS: IPv6 is such a vast number space that brute force scanning the Internet to look for vulnerabilities will go from a “hilariously simple Python script” to “literally impossible”! People worried about security and privacy should be rushing to switch to IPv6 because it’ll permanently block all drive-by attacks!
- drtgh 3y ago
  > The loudest people arguing against IPv6 are often hiding the kind of behaviour I really don’t care to protect. Drug purchases on the dark web or exchanging child porn are common reasons to be this paranoid. > Normal people just use a VPN or a cloud proxy [...] Ad hominem << The most common form of this fallacy is "A" makes a claim of "fact," to which "B" asserts that "A" has a personal trait, quality or physical attribute that is repugnant thereby going entirely off-topic [...] >> https://en.wikipedia.org/wiki/Ad_hominem https://en.wikipedia.org/wiki/Ad_hominem
  - jiggawatts 3y ago
    Unfortunately, this is the sad reality of the situation. I've seen a number of online arguments where someone was "fighting the good fight" against corporate censorship, getting their account locked for "no reason", or whatever. In a few such cases the site admin responded with "you're a relentless spammer, that is why you were banned". Or in one such case, "you were sending unsolicited dick picks to underage girls". Not everyone is nice. Some people's ideal for the Internet is not my ideal for the Internet. I don't have to agree with everyone, and I don't think infinite protections should be granted to people like that at great cost to everyone else.

mannyv 3y ago

BOOTP came before DHCP but was a bit too limited.