12 ms·

I was curious why the article didn't mention IPv6 at all, since Tailscale does support it. IPv6 -together with WireGuard- gives privacy, security, and performa

by Fnoord 2y ago

I was curious why the article didn't mention IPv6 at all, since Tailscale does support it. IPv6 -together with WireGuard- gives privacy, security, and performance. The downside is the complexity to set it up. Tailscale builds on the shoulder of giants. IPv4, WireGuard, Samy Kamkar NAT punching, OpenSSH, and probably many more. One of the upsides is the combination of these, and that the management interface in general is easy. But what counts for CA is also true for Tailscale: both are using FOSS to in the end deliver a (proprietary) service. But because almost everything is build on top of FOSS and there's Headscale (and they're cool with it), this isn't a major issue to me. Like, it is a downside, but not a major one, as vendor lock-in is practically non-existent. In fact, it is likely an upside from a business/support PoV.

wmf 2y ago
Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.
- Bluecobra 2y ago
  There are some very valid points here though: https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
  - deleted 2y ago
    [deleted]
  - throw0101d 2y ago
    Here is a list of of proposals for what could have replaced IPv4: * https://www.rfc-editor.org/rfc/rfc1454.html https://www.rfc-editor.org/rfc/rfc1454.html Here are the technical criteria for choosing the (then-labelled) IPng: * https://datatracker.ietf.org/doc/html/rfc1726 https://datatracker.ietf.org/doc/html/rfc1726 And finally the evaluation of the available candidates and why the winner was chosen: * https://datatracker.ietf.org/doc/html/rfc1752 https://datatracker.ietf.org/doc/html/rfc1752 If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. > There's one thing I forgot to mention in that big long story above: somewhere in that whole chain of events, we completely stopped using bus networks. Ethernet is not actually a bus anymore. It just pretends to be a bus. Basically, we couldn't get ethernet's famous CSMA/CD to keep working as speeds increased, so we went back to the good old star topology. Except for 802.11 Wifi.
    - yjftsjthsd-h 2y ago
      > If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. Although I've heard some ideas for a IPv4.1 that suffer from the obvious problem, I think the far more common view is rather that v4 is fine and its only problem is solved by NAT. Which I agree isn't actually a long term solution, but let's try to meet the stronger argument.
      - throw0101d 2y ago
        > […] I think the far more common view is rather that v4 is fine and its only problem is solved by NAT. The only reason why NAT is "solving" the problem is because IPv6 is taking some of the pressure off. T-Mobile US has 120M subscribers: * https://www.statista.com/statistics/219577/total-customers-of-t-mobile-usa-by-quarter/ https://www.statista.com/statistics/219577/total-customers-o... And they went to IPv6-only: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE There's no way that would work in a no-IPv6 / IPv4-only world. Comcast ran out of 10/8 address space to manage their cable modems: how would that work without IPv6? Google says India is 74% IPv6: * https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... How would that work with only IPv4? Even on smaller scales, without IPv6, supporting IPv4 with CG-NAT can get really expensive, real fast: > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices. * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * Discussion: https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624
  - wmf 2y ago
    Yeah, he's not wrong. I just found his take on IPv6 to be pretty pessimistic at that time. His manifesto from today is much more positive.
- throw0101d 2y ago
  > Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen. Well, T-Mobile US is 100% IPv6: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE Facebook is IPv6-only on their internal infrastructure: * https://www.internetsociety.org/resources/deploy360/2014/case-study-facebook-moving-to-an-ipv6-only-internal-network/ https://www.internetsociety.org/resources/deploy360/2014/cas... Microsoft has been moving to IPv6-only for their corporate network (so IPv4 address can be used for revenue-producing Azure): * https://www.arin.net/blog/2019/04/03/microsoft-works-toward-ipv6-only-single-stack-network/ https://www.arin.net/blog/2019/04/03/microsoft-works-toward-... So he better tell those folks that IPv6 is not a thing.
- Borg3 2y ago
  Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IPv6 was seriously immature yet to start migration. Additionaly, it was very different from IPv4 so was mostly ignored. What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. As bonus, they should think about some basic IPv6 -> IPv4 interop so clients would NOT need to be dual stack. And that could work back then. Now we are fucked.
  - zokier 2y ago
    The thing that you and all other ipv6 haters miss is that none of that matters. Ipv6 is happening, like it or not. And that had been the state already for 10-15 years. Maybe in the 00s there was window when there might have been true doubt if ipv6 was going to happen. But after that, it was just question of "when", not "if". Keeping on hating is simply not very productive. It's just much better to embrace ipv6, no matter it's possible flaws.
  - growse 2y ago
    > What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. Tell me you've never had to seriously design and operate networks at scale without telling me etc... This is a bit like Chesterton's fence - until you understand why (for example) ARP is a hilariously bad design and a major problem when trying to design networks at scale, then you can't understand why someone might want to replace it with something more effective. IPv6 doesn't get a lot of stuff right, but the motivation behind replacing v4 was much more than simply "more addresses pls". IPv4 was the mistake, Vint Cerf is on the record as saying so. Should never have been let out of the lab.
    - Borg3 2y ago
      Its not so easy. First, yeah I was operating networks, not maybe hyperscalers, but 200+ switches. Yes, ARP had a its problems, like ARP poisoning, but they are all sorted out already. IPv6 took its ND and bring a lot of other problems that we are solving AGAIN. Pure waste of time and effort. Also, please cut the crap about IoT and Hyper IP networks centrally managed. Thats just serveral huge corporations. Majority is Internet is small/medium shops doing it completly different. Yet, big boys pop in and say you do it wrong, you must do it our way or go away. Not nice. Yeah, that motivation become overengineering. They provided protocol that does NOT fit the needs it seems. IPv6 will probably happen indeed. I doubt someone will popin with great protocol that will make IP obsolete. Also, I wish IPv6 would really took off, because even if I personaly dont like IPv6, it success would provide me IPv4 address space for my retro networking projects.
thinkski 2y ago
I think there’s a common misunderstanding that with IPv6 anyone can connect to anyone else. That’s not true. My laptop has an IPv6 address, as does the router that routes its traffic. There’s no NAT, that’s true, but there’s still a firewall — only inbound packets from a destination host and port that have been sent to are allowed in. And in enterprise environments, from what I’ve seen, there’s a symmetric NAT on IPv6 anyway — packet comes from a different IPv6 address and randomized port than the one client sent it from, making peer connectivity impossible, as the source port varies by destination host and port.

by Fnoord 2y ago

wmf 2y ago

Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.

Bluecobra 2y ago
There are some very valid points here though: https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
- deleted 2y ago
  [deleted]
- throw0101d 2y ago
  Here is a list of of proposals for what could have replaced IPv4: * https://www.rfc-editor.org/rfc/rfc1454.html https://www.rfc-editor.org/rfc/rfc1454.html Here are the technical criteria for choosing the (then-labelled) IPng: * https://datatracker.ietf.org/doc/html/rfc1726 https://datatracker.ietf.org/doc/html/rfc1726 And finally the evaluation of the available candidates and why the winner was chosen: * https://datatracker.ietf.org/doc/html/rfc1752 https://datatracker.ietf.org/doc/html/rfc1752 If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. > There's one thing I forgot to mention in that big long story above: somewhere in that whole chain of events, we completely stopped using bus networks. Ethernet is not actually a bus anymore. It just pretends to be a bus. Basically, we couldn't get ethernet's famous CSMA/CD to keep working as speeds increased, so we went back to the good old star topology. Except for 802.11 Wifi.
  - yjftsjthsd-h 2y ago
    > If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. Although I've heard some ideas for a IPv4.1 that suffer from the obvious problem, I think the far more common view is rather that v4 is fine and its only problem is solved by NAT. Which I agree isn't actually a long term solution, but let's try to meet the stronger argument.
    - throw0101d 2y ago
      > […] I think the far more common view is rather that v4 is fine and its only problem is solved by NAT. The only reason why NAT is "solving" the problem is because IPv6 is taking some of the pressure off. T-Mobile US has 120M subscribers: * https://www.statista.com/statistics/219577/total-customers-of-t-mobile-usa-by-quarter/ https://www.statista.com/statistics/219577/total-customers-o... And they went to IPv6-only: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE There's no way that would work in a no-IPv6 / IPv4-only world. Comcast ran out of 10/8 address space to manage their cable modems: how would that work without IPv6? Google says India is 74% IPv6: * https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... How would that work with only IPv4? Even on smaller scales, without IPv6, supporting IPv4 with CG-NAT can get really expensive, real fast: > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices. * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * Discussion: https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624
- wmf 2y ago
  Yeah, he's not wrong. I just found his take on IPv6 to be pretty pessimistic at that time. His manifesto from today is much more positive.
throw0101d 2y ago
> Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen. Well, T-Mobile US is 100% IPv6: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE Facebook is IPv6-only on their internal infrastructure: * https://www.internetsociety.org/resources/deploy360/2014/case-study-facebook-moving-to-an-ipv6-only-internal-network/ https://www.internetsociety.org/resources/deploy360/2014/cas... Microsoft has been moving to IPv6-only for their corporate network (so IPv4 address can be used for revenue-producing Azure): * https://www.arin.net/blog/2019/04/03/microsoft-works-toward-ipv6-only-single-stack-network/ https://www.arin.net/blog/2019/04/03/microsoft-works-toward-... So he better tell those folks that IPv6 is not a thing.
Borg3 2y ago
Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IPv6 was seriously immature yet to start migration. Additionaly, it was very different from IPv4 so was mostly ignored. What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. As bonus, they should think about some basic IPv6 -> IPv4 interop so clients would NOT need to be dual stack. And that could work back then. Now we are fucked.
- zokier 2y ago
  The thing that you and all other ipv6 haters miss is that none of that matters. Ipv6 is happening, like it or not. And that had been the state already for 10-15 years. Maybe in the 00s there was window when there might have been true doubt if ipv6 was going to happen. But after that, it was just question of "when", not "if". Keeping on hating is simply not very productive. It's just much better to embrace ipv6, no matter it's possible flaws.
- growse 2y ago
  > What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. Tell me you've never had to seriously design and operate networks at scale without telling me etc... This is a bit like Chesterton's fence - until you understand why (for example) ARP is a hilariously bad design and a major problem when trying to design networks at scale, then you can't understand why someone might want to replace it with something more effective. IPv6 doesn't get a lot of stuff right, but the motivation behind replacing v4 was much more than simply "more addresses pls". IPv4 was the mistake, Vint Cerf is on the record as saying so. Should never have been let out of the lab.
  - Borg3 2y ago
    Its not so easy. First, yeah I was operating networks, not maybe hyperscalers, but 200+ switches. Yes, ARP had a its problems, like ARP poisoning, but they are all sorted out already. IPv6 took its ND and bring a lot of other problems that we are solving AGAIN. Pure waste of time and effort. Also, please cut the crap about IoT and Hyper IP networks centrally managed. Thats just serveral huge corporations. Majority is Internet is small/medium shops doing it completly different. Yet, big boys pop in and say you do it wrong, you must do it our way or go away. Not nice. Yeah, that motivation become overengineering. They provided protocol that does NOT fit the needs it seems. IPv6 will probably happen indeed. I doubt someone will popin with great protocol that will make IP obsolete. Also, I wish IPv6 would really took off, because even if I personaly dont like IPv6, it success would provide me IPv4 address space for my retro networking projects.

thinkski 2y ago

I think there’s a common misunderstanding that with IPv6 anyone can connect to anyone else. That’s not true. My laptop has an IPv6 address, as does the router that routes its traffic. There’s no NAT, that’s true, but there’s still a firewall — only inbound packets from a destination host and port that have been sent to are allowed in. And in enterprise environments, from what I’ve seen, there’s a symmetric NAT on IPv6 anyway — packet comes from a different IPv6 address and randomized port than the one client sent it from, making peer connectivity impossible, as the source port varies by destination host and port.