8 ms·

APNIC: Big Tech’s use of carrier-grade NAT is holding back internet innovation

121 points by aragonite 2y ago

nickburns 2y ago
"let them use IPv6!" -Marie Antoinette a/k/a your ISP that hasn't even rolled it out yet.
- IvanAchlaqullah 2y ago
  Or refuse to implement IPv6. (At least here in Indonesia with only 14% adoption rate) Why? Because for residential user that want low latency internet & low packet drop (CGNAT increase both), ISP can charge "business price" for dedicated IPv4 that aren't behind CGNAT. With IPv6, CGNAT is not needed. Considering ISP/Telco in here is very scummy (they even perform MITM to inject ads, use Class 0 message / AMBER Alert for ads, etc.) I won't be surprised if that's the only reason why they didn't rolled out IPv6.
canistel 2y ago
I have been averse to IPv6 until recently,and used to disable IPv6 altogether. Couple of weeks back, the ISP silently shifted to CGNAT, and I could no longer forward ports. Out of sheer desperation, I gave IPv6 a try and was shocked to find that the demon which I had feared all along, was in fact the solution to most of the concerns. A few things to note though:- 1. Default router settings - as configured by the ISP - defaulted to IPv4 only. I had to change it to enable IPv6 too in the WAN settings. 2. Had to lower Firewall security levels (which in fact makes sense). 3. In firewalld, had to enable ipv6-icmp protocol 4. Technologies such as IRC (to take an example), does not support IPv6, but many torrent clients do.
- birdiesanders 2y ago
  Most IRC clients happily accept a properly encoded v6 address.
- notpushkin 2y ago
  > Had to lower Firewall security levels (which in fact makes sense). Sounds suspicious to be honest. If you get a direct IPv6 address to your computer (as opposed to an IPv4 behind a NAT), shouldn't you raise firewall instead of lowering?
  - nickburns 2y ago
    some components, like RA and SLAAC, require specific ICMP to function properly. a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default. the only actually suspicious part of the original comment is... Default router settings - as configured by the ISP
    - notpushkin 2y ago
      Makes sense, thanks!
    - cesarb 2y ago
      > a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default. A properly configured IPv4 firewall would allow at least the "destination unreachable - fragmentation needed and DF set" inbound ICMP, otherwise path MTU discovery will break; it probably should also allow the rest of the "destination unreachable" inbound ICMP, and probably also the "time exceeded" inbound ICMP, so that connection failures are instantaneous instead of having to wait for a timeout. Allowing no inbound ICMP at all is always an incorrect firewall configuration.
      - nickburns 2y ago
        a properly configured (stateful) firewall permits replies to unfiltered outbound connections. you've made no corrections to anything i said, but merely added context to "filter most outbound connections" and with fair points. but reasonable plumbers could and certainly do disagree on whether to allow any ICMP connections initiated from outside the firewall whatsoever.
- getwiththeprog 2y ago
  With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address. Then I also get millions of IPv6 addresses that are not CGNAT, so it is a real win as far as I am concerned.
  - GoblinSlayer 2y ago
    For this you can just have a socks proxy instead of NAT. Works with ip6 too.
  - nickburns 2y ago
    ISP still has CGNAT logs and can presumably still be lawfully subpoenaed. it's a false cloak. and in terms of identity tracking—all teh marketeers (who sleep with the CGNAT ISPs mind you) can still exceedingly accurately profile you and keep tabs on what you're up to whether behind your CGNAT ISP or CGNAT telecom alike. it's a false sense of privacy.
    - sp332 2y ago
      Making attackers get a subpoena is actually a huge barrier. Especially compared to just handing it out to every server you make a request to.
      - nickburns 2y ago
        that level of sophisticated target likely doesn't rely upon nor hang its hat on lawful controls, either.
  - WarOnPrivacy 2y ago
    > With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address. It can become an issue when sites like The Economist don't vet their blocklists - and then someone behind the NAT does something that makes the list-author grumpy.
  - WarOnPrivacy 2y ago
    > see CGNAT as a feature as it obfuscates my IPv4 address - then get millions of IPv6 addresses that are not CGNAT It's tough trying to connect to home IPv6 services - when all the locations you visit are served by an ISP that doesn't support IPv6. That's the scenario here.
- seba_dos1 2y ago
  What makes you think that IRC doesn't support IPv6?
  - lathiat 2y ago
    Many IRC networks were early to IPv6
    - throw0101c 2y ago
      E.g.: > The project had its highlight in 1999, when the first-ever production-stage IRC6 server was featured on IRCnet by Project IRC6 of Europe. This resulted in a movement for more rapid evolution and evaluation of IPv6 services by IRC-users, which can still be seen as a rather interesting effect of the nature of competition in advances in technology... * http://www.irc.org/irc6.html http://www.irc.org/irc6.html
- LargoLasskhyfv 2y ago
  4. Hm. Must be a strange network, or bad client. Even (most of what remains of) EFNET supports v6 and TLS. Imagine...
FujiApple 2y ago
This Tailscale blog [1] from 2020 has been posted on HN many times before I’m sure but is worth highlighting again as it does a great job outlining the technical complexities that CGNAT (and NAT in general) introduce. I have my head in this space at the moment as I’m trying to implement NAT detection (as pioneered by Dublin traceroute [2]) into Trippy [3]. [1] https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works [2] https://dublin-traceroute.net/ https://dublin-traceroute.net/ [3] https://github.com/fujiapple852/trippy/issues/1104 https://github.com/fujiapple852/trippy/issues/1104
- mcmcmc 2y ago
  I already love Trippy but that would be an awesome addition! Big thanks from a satisfied user!
- nickburns 2y ago
  could you say a little bit more about the design and/or purpose of NAT detection in this context? i'm unfamiliar but see what the service generally does in lay terms. curious more about the technical necessity.
beagle3 2y ago
I vastly prefer CGNAT to IPv6, because CGNAT preserves my privacy by default, and IPv6 eliminates it by default. It’s that simple. While it’s possible for an ISP to unmask me on CGNAT (Verizon and AT&T did in the early smartphone days)- and it’s possible for an ISP to NAT/Wildcard my IPv6 address for privacy - it’s the default in 99% of the cases; and I prefer default privacy to the ability to be directly addressable at home.
- seanlinmt 2y ago
  But how do you host services through CGNAT though?
  - msk-lywenn 2y ago
    You can’t. When my ISP switched me to CGNAT, I spent days upgrading everything to IPv6, only to discover that gmail didn’t even support it! (Mail Server to mail server, not the web app) I gave up, asked my ISP IPv4 back and, fortunately, got back a new IPv4. But I fear the day that option will disappear…
    - hlandau 2y ago
      My mail server has been known to deliver mail to Gmail using IPv6 if I don't tell it not to. Not sure if Gmail will use IPv6 for incoming mail though.
    - tambre 2y ago
      What year was this? While I can't find a source I believe Gmail has supported IPv6 for sending and receiving since the World IPv6 day back in 2011. I've certainly been doing it since 2017. Your issue might be rather that Gmail actually enforces all their guidelines on IPv6 instead of silently degrading your reputation behind the scenes like they do for IPv4. So proper RDNS, SPF and DKIM are tablestakes with DMARC and MTA-STS strongly recommended.
      - msk-lywenn 2y ago
sambazi 2y ago
tbf cgnat is fine for the majority of consumers. a solution to get public v4 on the cpe could be a deeply burried "advanced-expert iknowwhatiamdoing" checkbox in the isp portal
hlandau 2y ago
CGNAT should be illegal. Or at least it should be illegal to advertise a CGNAT service as an "Internet connection". It's not an Internet connection, you can't use it to send or receive arbitrary IP packets, only TCP/UDP.
- patrakov 2y ago
  Just as well, it should be illegal to advertise a connection with only a single dynamic /64 of IPv6 as an "Internet connection".
- Latty 2y ago
  Yeah, I like to compare it to the old "Party Line" phone lines people used to have, where you shared a single phone line with multiple houses and only one person could talk at a time. Sure, it gives you some of the functionality of a phone line, but it is not a phone line, and shouldn't be sold as the same thing. Honestly, I'm genuinely surprised no ISP has started doing "gamer" marketing as it seems to be so effective elsewhere, "We give you real public IPs so you can connect directly to your opponents for lower latency, get on the internet fast lane!".
  - Gigachad 2y ago
    Games have largely moved away from direct connections and user hosted servers though. The players and companies prefer the modern match making system. Its easier to use, more reliable, and gives the company greater control over the experience.
    - Latty 2y ago
      How much of that is because of (CG)NAT though? You can still do matchmaking and have direct connections. Yeah, there are trade-offs, but when you look at for example the fighting game crowd where latency is a big deal, consumers may massively prefer it. (Either way, a "gamer" branded product that is unlikely to actually help in most real gaming scenarios is 95% of "gamer" branded products.)
  - wjholden 2y ago
lambdaone 2y ago
This article is two years old. I don't think things as as dire as they seem, just a bit more boring than people might like. I can't see any sign that long-term IPv6 growth has stopped, it's just ceased to accelerate. Looking at Google's IPv6 traffic graph (https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html), this is entirely consistent with being the first half of a classic logistic curve, with growth now linear as it approaches the 50% point after 15 years. If this is actually a logistic growth curve, we will presumably see the end of IPv4 sometime around 2040. Even if we take a more optimistic view and assume linear growth continues, it will still take until about 2035. And that's fine. Old technlogies tend to wither away, not go out with a bang.
- CrLf 2y ago
  The issue with looking at IPv6 adoption from that point of view is that it only shows half of the picture. It shows the percentage of IPv6-enabled clients, which has been growing steadily. On the other side there are still major services that are IPv4-only, and growth is not uniform. This means the combined situation is not as cheerful. It's hard to arrive at definitive conclusions, but IPv6 traffic(1) may be as low as 15% when considering this mismatch. https://blog.cloudflare.com/ipv6-from-dns-pov/ https://blog.cloudflare.com/ipv6-from-dns-pov/ Without stronger incentives, IPv6 may be an eternal runner up. At least it looks like it will take quite a few decades more to make IPv4 obsolete. (1) By connections or requests. By bytes transferred, IPv6 might have already overtaken IPv4 for all we know (I'm not aware of a broad enough study on this, so I'm open to this possibility). The largest streaming providers are IPv6 enabled.
  - jofla_net 2y ago
    Another good reason for slow adoption is that the pushers of V6 herald it as the death of all nat, and i wager there are certain types of net admins who really like at least SOME nat. I have a longer writeup here http://www.jofla.net/?p=00000113#00000113 http://www.jofla.net/?p=00000113#00000113 granted i would love for more v6, if it yielded a 1 for 1 repacement, with all features .
can16358p 2y ago
I could easily access my computer from the internet when I'm not home back in the days... all the ISPs in my country have moved to CGNAT and there is no v6 support, probably because of lack of demand and ridiculous "static IP" pricing. Result: I'm constantly checked by Cloudflare etc. and sometimes blocked altogether by some hosts as I'm probably in the same public facing IP with many non-savvy people whose devices are infected with botnets.
- anonym29 2y ago
  [flagged]
  - erikerikson 2y ago
    > In a just world concerned with real human rights (restrictions on evildoers from harming you, not entitlements like free X, free Y, and free Z), every Cloudflare employee would go to bed every night fearing whether or not they will wake up alive the next morning. Your claim is that in a just world Cloudflare employees would fear for their lives?
James_K 2y ago
GCNAT is truly one of the ugliest pieces of technology ever created. It is incompetence and bad planning made manifest into software.
magicalhippo 2y ago
Maybe it's more like IPv6 is the solution we got, rather than the solution we want. Not unlike Wayland vs X11. Both over-corrections to the problems they set out to fix. Then again, my code doesn't get good until the third time I rewrite it... As someone with a small home lab, IPv6 feels much more complex compared to IPv4. And it's still in significant flux despite decades old, while IPv4 hasn't changed significantly since I deployed my own m0n0wall box back before y2k. It also requires more infra. DNS for everything is non-optional due to long addresses and dynamic prefixes. DHCPv6 is needed for all configuration settings to be set on clients. And there's still software that doesn't play well with IPv6. It's just too much hassle for my home lab for now. Maybe in another decade.
- nickburns 2y ago
  over-corrections to the problems they set out to fix. IPv4 space will—not a matter of if, it will eventually be exhausted. given that i don't know if IPv6 could reasonably be considered an 'over-correction' in the context of needing a larger address space, unless you strictly refer to complexity of the successor analogies (i.e. IPv6 and Wayland). a comment elsewhere in this post makes some informed projections about when the transition will go from being gradual to necessarily fully (at least for IPv4) co-operational.
  - sp332 2y ago
    IPv6 has changed a lot over the years, mostly to simplify it. IPsec used to be mandatory, for example.
- jcarrano 2y ago
  Every time I used IPv6 I found it solved more problems than it created. E.g. with v6 you can make sure a VPN addresses will not collide with the user's actual address. No more nats or port forwadings, etc. The main problem is that v4 has not yet been retired and that means many times you have to support both.
  - patrakov 2y ago

121 points by aragonite 2y ago

nickburns 2y ago

"let them use IPv6!" -Marie Antoinette a/k/a your ISP that hasn't even rolled it out yet.

IvanAchlaqullah 2y ago
Or refuse to implement IPv6. (At least here in Indonesia with only 14% adoption rate) Why? Because for residential user that want low latency internet & low packet drop (CGNAT increase both), ISP can charge "business price" for dedicated IPv4 that aren't behind CGNAT. With IPv6, CGNAT is not needed. Considering ISP/Telco in here is very scummy (they even perform MITM to inject ads, use Class 0 message / AMBER Alert for ads, etc.) I won't be surprised if that's the only reason why they didn't rolled out IPv6.

canistel 2y ago

I have been averse to IPv6 until recently,and used to disable IPv6 altogether. Couple of weeks back, the ISP silently shifted to CGNAT, and I could no longer forward ports. Out of sheer desperation, I gave IPv6 a try and was shocked to find that the demon which I had feared all along, was in fact the solution to most of the concerns. A few things to note though:- 1. Default router settings - as configured by the ISP - defaulted to IPv4 only. I had to change it to enable IPv6 too in the WAN settings. 2. Had to lower Firewall security levels (which in fact makes sense). 3. In firewalld, had to enable ipv6-icmp protocol 4. Technologies such as IRC (to take an example), does not support IPv6, but many torrent clients do.

birdiesanders 2y ago
Most IRC clients happily accept a properly encoded v6 address.
notpushkin 2y ago
> Had to lower Firewall security levels (which in fact makes sense). Sounds suspicious to be honest. If you get a direct IPv6 address to your computer (as opposed to an IPv4 behind a NAT), shouldn't you raise firewall instead of lowering?
- nickburns 2y ago
  some components, like RA and SLAAC, require specific ICMP to function properly. a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default. the only actually suspicious part of the original comment is... Default router settings - as configured by the ISP
  - notpushkin 2y ago
    Makes sense, thanks!
  - cesarb 2y ago
    > a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default. A properly configured IPv4 firewall would allow at least the "destination unreachable - fragmentation needed and DF set" inbound ICMP, otherwise path MTU discovery will break; it probably should also allow the rest of the "destination unreachable" inbound ICMP, and probably also the "time exceeded" inbound ICMP, so that connection failures are instantaneous instead of having to wait for a timeout. Allowing no inbound ICMP at all is always an incorrect firewall configuration.
    - nickburns 2y ago
      a properly configured (stateful) firewall permits replies to unfiltered outbound connections. you've made no corrections to anything i said, but merely added context to "filter most outbound connections" and with fair points. but reasonable plumbers could and certainly do disagree on whether to allow any ICMP connections initiated from outside the firewall whatsoever.
getwiththeprog 2y ago
With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address. Then I also get millions of IPv6 addresses that are not CGNAT, so it is a real win as far as I am concerned.
- GoblinSlayer 2y ago
  For this you can just have a socks proxy instead of NAT. Works with ip6 too.
- nickburns 2y ago
  ISP still has CGNAT logs and can presumably still be lawfully subpoenaed. it's a false cloak. and in terms of identity tracking—all teh marketeers (who sleep with the CGNAT ISPs mind you) can still exceedingly accurately profile you and keep tabs on what you're up to whether behind your CGNAT ISP or CGNAT telecom alike. it's a false sense of privacy.
  - sp332 2y ago
    Making attackers get a subpoena is actually a huge barrier. Especially compared to just handing it out to every server you make a request to.
    - nickburns 2y ago
      that level of sophisticated target likely doesn't rely upon nor hang its hat on lawful controls, either.
- WarOnPrivacy 2y ago
  > With my ISP, I see CGNAT as a feature as it obfuscates my IPv4 address. It can become an issue when sites like The Economist don't vet their blocklists - and then someone behind the NAT does something that makes the list-author grumpy.
- WarOnPrivacy 2y ago
  > see CGNAT as a feature as it obfuscates my IPv4 address - then get millions of IPv6 addresses that are not CGNAT It's tough trying to connect to home IPv6 services - when all the locations you visit are served by an ISP that doesn't support IPv6. That's the scenario here.
seba_dos1 2y ago
What makes you think that IRC doesn't support IPv6?
- lathiat 2y ago
  Many IRC networks were early to IPv6
  - throw0101c 2y ago
    E.g.: > The project had its highlight in 1999, when the first-ever production-stage IRC6 server was featured on IRCnet by Project IRC6 of Europe. This resulted in a movement for more rapid evolution and evaluation of IPv6 services by IRC-users, which can still be seen as a rather interesting effect of the nature of competition in advances in technology... * http://www.irc.org/irc6.html http://www.irc.org/irc6.html
LargoLasskhyfv 2y ago
4. Hm. Must be a strange network, or bad client. Even (most of what remains of) EFNET supports v6 and TLS. Imagine...

FujiApple 2y ago

This Tailscale blog [1] from 2020 has been posted on HN many times before I’m sure but is worth highlighting again as it does a great job outlining the technical complexities that CGNAT (and NAT in general) introduce. I have my head in this space at the moment as I’m trying to implement NAT detection (as pioneered by Dublin traceroute [2]) into Trippy [3]. [1] https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works [2] https://dublin-traceroute.net/ https://dublin-traceroute.net/ [3] https://github.com/fujiapple852/trippy/issues/1104 https://github.com/fujiapple852/trippy/issues/1104

mcmcmc 2y ago
I already love Trippy but that would be an awesome addition! Big thanks from a satisfied user!
nickburns 2y ago
could you say a little bit more about the design and/or purpose of NAT detection in this context? i'm unfamiliar but see what the service generally does in lay terms. curious more about the technical necessity.

beagle3 2y ago

I vastly prefer CGNAT to IPv6, because CGNAT preserves my privacy by default, and IPv6 eliminates it by default. It’s that simple. While it’s possible for an ISP to unmask me on CGNAT (Verizon and AT&T did in the early smartphone days)- and it’s possible for an ISP to NAT/Wildcard my IPv6 address for privacy - it’s the default in 99% of the cases; and I prefer default privacy to the ability to be directly addressable at home.

seanlinmt 2y ago
But how do you host services through CGNAT though?
- msk-lywenn 2y ago
  You can’t. When my ISP switched me to CGNAT, I spent days upgrading everything to IPv6, only to discover that gmail didn’t even support it! (Mail Server to mail server, not the web app) I gave up, asked my ISP IPv4 back and, fortunately, got back a new IPv4. But I fear the day that option will disappear…
  - hlandau 2y ago
    My mail server has been known to deliver mail to Gmail using IPv6 if I don't tell it not to. Not sure if Gmail will use IPv6 for incoming mail though.
  - tambre 2y ago
    What year was this? While I can't find a source I believe Gmail has supported IPv6 for sending and receiving since the World IPv6 day back in 2011. I've certainly been doing it since 2017. Your issue might be rather that Gmail actually enforces all their guidelines on IPv6 instead of silently degrading your reputation behind the scenes like they do for IPv4. So proper RDNS, SPF and DKIM are tablestakes with DMARC and MTA-STS strongly recommended.
    - msk-lywenn 2y ago

sambazi 2y ago

tbf cgnat is fine for the majority of consumers. a solution to get public v4 on the cpe could be a deeply burried "advanced-expert iknowwhatiamdoing" checkbox in the isp portal

hlandau 2y ago

CGNAT should be illegal. Or at least it should be illegal to advertise a CGNAT service as an "Internet connection". It's not an Internet connection, you can't use it to send or receive arbitrary IP packets, only TCP/UDP.

patrakov 2y ago
Just as well, it should be illegal to advertise a connection with only a single dynamic /64 of IPv6 as an "Internet connection".
Latty 2y ago
Yeah, I like to compare it to the old "Party Line" phone lines people used to have, where you shared a single phone line with multiple houses and only one person could talk at a time. Sure, it gives you some of the functionality of a phone line, but it is not a phone line, and shouldn't be sold as the same thing. Honestly, I'm genuinely surprised no ISP has started doing "gamer" marketing as it seems to be so effective elsewhere, "We give you real public IPs so you can connect directly to your opponents for lower latency, get on the internet fast lane!".
- Gigachad 2y ago
  Games have largely moved away from direct connections and user hosted servers though. The players and companies prefer the modern match making system. Its easier to use, more reliable, and gives the company greater control over the experience.
  - Latty 2y ago
    How much of that is because of (CG)NAT though? You can still do matchmaking and have direct connections. Yeah, there are trade-offs, but when you look at for example the fighting game crowd where latency is a big deal, consumers may massively prefer it. (Either way, a "gamer" branded product that is unlikely to actually help in most real gaming scenarios is 95% of "gamer" branded products.)
- wjholden 2y ago

lambdaone 2y ago

This article is two years old. I don't think things as as dire as they seem, just a bit more boring than people might like. I can't see any sign that long-term IPv6 growth has stopped, it's just ceased to accelerate. Looking at Google's IPv6 traffic graph (https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html), this is entirely consistent with being the first half of a classic logistic curve, with growth now linear as it approaches the 50% point after 15 years. If this is actually a logistic growth curve, we will presumably see the end of IPv4 sometime around 2040. Even if we take a more optimistic view and assume linear growth continues, it will still take until about 2035. And that's fine. Old technlogies tend to wither away, not go out with a bang.

CrLf 2y ago
The issue with looking at IPv6 adoption from that point of view is that it only shows half of the picture. It shows the percentage of IPv6-enabled clients, which has been growing steadily. On the other side there are still major services that are IPv4-only, and growth is not uniform. This means the combined situation is not as cheerful. It's hard to arrive at definitive conclusions, but IPv6 traffic(1) may be as low as 15% when considering this mismatch. https://blog.cloudflare.com/ipv6-from-dns-pov/ https://blog.cloudflare.com/ipv6-from-dns-pov/ Without stronger incentives, IPv6 may be an eternal runner up. At least it looks like it will take quite a few decades more to make IPv4 obsolete. (1) By connections or requests. By bytes transferred, IPv6 might have already overtaken IPv4 for all we know (I'm not aware of a broad enough study on this, so I'm open to this possibility). The largest streaming providers are IPv6 enabled.
- jofla_net 2y ago
  Another good reason for slow adoption is that the pushers of V6 herald it as the death of all nat, and i wager there are certain types of net admins who really like at least SOME nat. I have a longer writeup here http://www.jofla.net/?p=00000113#00000113 http://www.jofla.net/?p=00000113#00000113 granted i would love for more v6, if it yielded a 1 for 1 repacement, with all features .

can16358p 2y ago

I could easily access my computer from the internet when I'm not home back in the days... all the ISPs in my country have moved to CGNAT and there is no v6 support, probably because of lack of demand and ridiculous "static IP" pricing. Result: I'm constantly checked by Cloudflare etc. and sometimes blocked altogether by some hosts as I'm probably in the same public facing IP with many non-savvy people whose devices are infected with botnets.

anonym29 2y ago
[flagged]
- erikerikson 2y ago
  > In a just world concerned with real human rights (restrictions on evildoers from harming you, not entitlements like free X, free Y, and free Z), every Cloudflare employee would go to bed every night fearing whether or not they will wake up alive the next morning. Your claim is that in a just world Cloudflare employees would fear for their lives?

James_K 2y ago

GCNAT is truly one of the ugliest pieces of technology ever created. It is incompetence and bad planning made manifest into software.

magicalhippo 2y ago

Maybe it's more like IPv6 is the solution we got, rather than the solution we want. Not unlike Wayland vs X11. Both over-corrections to the problems they set out to fix. Then again, my code doesn't get good until the third time I rewrite it... As someone with a small home lab, IPv6 feels much more complex compared to IPv4. And it's still in significant flux despite decades old, while IPv4 hasn't changed significantly since I deployed my own m0n0wall box back before y2k. It also requires more infra. DNS for everything is non-optional due to long addresses and dynamic prefixes. DHCPv6 is needed for all configuration settings to be set on clients. And there's still software that doesn't play well with IPv6. It's just too much hassle for my home lab for now. Maybe in another decade.

nickburns 2y ago
over-corrections to the problems they set out to fix. IPv4 space will—not a matter of if, it will eventually be exhausted. given that i don't know if IPv6 could reasonably be considered an 'over-correction' in the context of needing a larger address space, unless you strictly refer to complexity of the successor analogies (i.e. IPv6 and Wayland). a comment elsewhere in this post makes some informed projections about when the transition will go from being gradual to necessarily fully (at least for IPv4) co-operational.
- sp332 2y ago
  IPv6 has changed a lot over the years, mostly to simplify it. IPsec used to be mandatory, for example.
jcarrano 2y ago
Every time I used IPv6 I found it solved more problems than it created. E.g. with v6 you can make sure a VPN addresses will not collide with the user's actual address. No more nats or port forwadings, etc. The main problem is that v4 has not yet been retired and that means many times you have to support both.
- patrakov 2y ago