3 ms·
> Temporary addresses are not enabled by default. Worse, the setting is ignored if it was enabled by sysctl during bootup. This is a major privacy issue. Yeah
by yjftsjthsd-h 2y ago
> Temporary addresses are not enabled by default. Worse, the setting is ignored if it was enabled by sysctl during bootup. This is a major privacy issue.
Yeah that's a hard pass.
> Adding IPv6PrivacyExtensions=yes to the above exposed another issue: instead of using the fe80 address generated by the kernel, networkd adds a new one.
But... I'm not sure this is a big problem? One of the big ideas of IPv6 is that you can have many IPs on an interface; throwing on one more isn't ideal, but I don't think it's a hard blocker.
- simoncion 2y agoFE80::/10 is the link-local space. It's fucking insane for systemd to be creating a second link-local address. Additionally, those addresses are only used on the local link, making any "privacy" address scrambling pretty silly.
- yjftsjthsd-h 2y agoTo be clear, I'm not saying I think this is a good idea, but it's legal. AFAIK, you can assign a single machine 192.168.1.2 and 192.168.1.3 at the same time, and you can likewise give a single machine/interface multiple fe80:: addresses. As to privacy... yeah, probably not super useful, but I don't see it hurting anything and if you're implementing IPv6 assignment logic it's probably just as well to always default to privacy protection.