5 ms·

There is another reason: the addresses are long and impossible to remember and hard to type. I always bring this up and it’s always dismissed because tech peop

by api 2y ago

There is another reason: the addresses are long and impossible to remember and hard to type. I always bring this up and it’s always dismissed because tech people continue to dismiss usability concerns. Even “small” usability differences can have a huge effect on adoption.

throw0101d 2y ago
> There is another reason: the addresses are long and impossible to remember and hard to type. If only there was some mechanism in which we could use a human-friendly label and have that translated to a computer-usable address… > I always bring this up and it’s always dismissed because tech people continue to dismiss usability concerns. I don't bother remembering IPv4 addresses, so I'm not sure why I would bother to remember IPv6 addresses. Heck, phone numbers are generally short as well, and who remembers them nowadays? ("0118 999 881 999 119 725… 3") Maybe it's dismissed because people see it as a non-issue. I regularly work at OSI Layer 2 (and even 1, pulling fibres in a DC), and Layer 3, and am not sure what the concerns are about.
- api 2y ago
  The problem is that DNS is not zero configuration. ARP and NDP are which is why nobody complains about Ethernet being hard to type. DNS has to be “stood up” which is a whole extra deployment. In modern devops in particular it is common to create and tear down IP networks in seconds and sling stuff everywhere. The extra moving part is an extra thing to break. DNS also runs over IP which means if IP is down DNS doesn’t work. What do you have to do then? You have to debug IP without DNS. There is mDNS but it’s not reliable and doesn’t scale to large networks. It also runs on the IP layer so if there is a problem there it can break.
  - throw0101d 2y ago
    > The problem is that DNS is not zero configuration. Certainly it is not-zeroconf, but it is the same not-zeroconf for both IPv4 and IPv6. But extra work with DHCP is needed for IPv4, and extra-extra work if you need to do things like configure 'IP helper', whereas IPv6 can be configured using only a router (which you need regardless) and some on-link packets (RAs). > DNS also runs over IP which means if IP is down DNS doesn’t work. What do you have to do then? You have to debug IP without DNS. And? At least you have fe80/64 as a basic starting point. Run a tcpdump to see if you're on-link in any way (or in the correct VLAN), and if you are, you can then ping(6) ff02::2 to find if there any on-link routers. You've now debugged Layer 2 and Layer 3 connectivity. Tada. You're making IPv6 (sound) way more complicated than it is. It is no more or less complicated than IPv4 or IPX/SPX or …. It's protocol data units at OSI Layer 2 or 3 in different formats with different fields.
- louthy 2y ago
  > who remembers them nowadays? 0118 999 881 999 119 725… 3 Me, that’s the new number for the emergency services. Actually, that’s the only phone number I can remember :D
  - adolph 2y ago
    Eight six seven five three oh nine Eight six seven five three oh nine
teddyh 2y ago
Yes, like Ethernet addresses. Those are impossible to remember, too, so obviously Ethernet is no good. /s The solution for IPv6 addresses is the same for Ethernet addresses; don’t use them directly. Leave it to the name resolution system, and use host names.
- deleted 2y ago
  [deleted]
Gormo 2y ago
Also, NAT is desirable for security/network isolation reasons, and having no distinction between a local IP and a public IP has a lot of disadvantages. Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents.
- throw0101d 2y ago
  > Also, NAT is desirable for security/network isolation reasons […] This is security theatre. People have been saying that NAT is not a security feature for over a decade: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ but the message still has not sunk in. The "Zero Trust" paper was published by John Kindervag in 2010: * https://media.paloaltonetworks.com/documents/Forrester-No-More-Chewy-Centers.pdf https://media.paloaltonetworks.com/documents/Forrester-No-Mo... Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. The above is "castle-and-moat" thinking that tends to have weaker internal controls because it is thought the internal network is "hidden" from the dangerous outside network. Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. For most machines (and networks), most of the time, this is what's needed: the above is applicable for both IPv6 and IPv4 (with or without NAT). The protection comes from filtering (generally) and stateful packet inspection, not from hiding addresses. > […] and having no distinction between a local IP and a public IP has a lot of disadvantages. Just because something has a global addresses does not mean global reachability (see default deny above). Further you can layout your IPv6 address plan so that you can tell at a glance if hosts are externally accessible. Using a /48 a basis, you break out sixteen /52s, numbered $PREFIX:[0-f]000::/52. To make it easier to remember what is externally accessible, you put all of those hosts in $PREFIX:e000::/52, where e stands for external. That /52 can then be broken down into: * sixteen /56s * 256 /60s * 4096 /64s or any combination thereof. See Figure A-5 for various ways to slice and dice: * https://www.oreilly.com/library/view/ipv6-address-planning/9781491908211/apa.html https://www.oreilly.com/library/view/ipv6-address-planning/9... Everything in $PREFIX:[0-d,f]000::/52 is not externally reachable.
dilawar 2y ago
Thanks for pointing this out. It's hard to communicate ipv4 and I dread even reading ipv6. I don't understand why they didn't just add two or four more fields to ipv4 e.g. 0.91.127.0.0.1 is localhost where 0.91 can be omitted in the local context. PS: I don't understand how networking works. Feels very very complex and full of jargons.
- fragmede 2y ago
  if ipv4 is called that because there are 4 numbers in the IP address, what would you call your scheme with 6 of them?
- wolfendin 2y ago
  Because the fields are there for humans, in the packet itself it’s a 32bit integer, and you can’t just arbitrarily make the src/dest fields in the packet bigger— it stops being IPv4 then.
  - jkrejcha 2y ago
    I'm pretty sure the person you're replying to is saying that IPv6, should be IPv4 but longer, which is not at all an uncommon opinion, even if it's a breaking change to the IP protocol. And I'd argue there would've been incredibly strong benefits and much wider adoption if they did this. Sure, you'd still need new networking gear and software support to handle it, but the change is relatively simple (and potentially more easily backwards compatible), especially compared to all of the baggage that came with IPv6. It's a fact of life that working with networking that we'll have to work with IP addresses at some level. It's easy to tell someone, "hey try typing in 'ping 8.8.8.8' and tell me what you get". The readability of IPv6 is, in my opinion, worse with repeated symbols and more characters to remember. The symbols that were chosen were also poorly thought out. Colons are used in networking a lot of times when you want to connect to a service on a particular port, so if you want to visit 2001:4860:4860::8888 in your browser, you have to enclose the address in square brackets.
    - Lammy 2y ago
wolfendin 2y ago
That’s because nobody normal— anyone who isn’t a tech person— remembers IP addresses. Hell I can’t get tech people I work with to give me their public IP.
- tempcommenttt 2y ago
  Maybe young people can’t, but older folks can easily store phone numbers in their brains, so IP4 is easy.
gorgoiler 2y ago
In practice I haven’t ever had a problem memorising IPv6 addresses. The significant proportions of any address you might type manually are 48 bits long at one end and a few bits at the other. An example IPv4 address is 8 to 12 digits: 10.30.115.5 A memorable IPv6 address at a /56 site — the prefix and then one or two digits — isn’t much longer: 2001:db8:404:14::42 If you’re with a reasonably clued in ISP you probably get a /48 for your site by default: 2001:db8:404::42 If you’re enumerating your own /64 prefixes then it’s not much more complicated than: site 2001:db8:404:: net :14:: host ::42
- RulerOf 2y ago
  >the prefix and then one or two digits — isn’t much longer I'd argue it's just enough to make the difference though. The problem is that people got used to being able to rely on memorizing IP addresses. IPv6 does its best at making IP addresses both harder to memorize, and completely dynamic, going so far as to change the IP on a fairly regular basis. It's antithetical to some very core qualities that an IP address is supposed to have in the minds of many.
- tempcommenttt 2y ago
  This is the first time I read about someone actually trying to remember IP6 addresses, maybe I should try that, because it’s really easy to remember IP4. For me, the problem is that there’s hex numbers, which are harder to remember and missing zeros, so you need remember the colons. If IP6 would just be 6 decimal numbers and this would be the default way of writing them, this would not be a problem. But it feels to me that the cryptic way IP6 is written is to make it hard for humans to remember it.

by api 2y ago

throw0101d 2y ago

> There is another reason: the addresses are long and impossible to remember and hard to type. If only there was some mechanism in which we could use a human-friendly label and have that translated to a computer-usable address… > I always bring this up and it’s always dismissed because tech people continue to dismiss usability concerns. I don't bother remembering IPv4 addresses, so I'm not sure why I would bother to remember IPv6 addresses. Heck, phone numbers are generally short as well, and who remembers them nowadays? ("0118 999 881 999 119 725… 3") Maybe it's dismissed because people see it as a non-issue. I regularly work at OSI Layer 2 (and even 1, pulling fibres in a DC), and Layer 3, and am not sure what the concerns are about.

api 2y ago
The problem is that DNS is not zero configuration. ARP and NDP are which is why nobody complains about Ethernet being hard to type. DNS has to be “stood up” which is a whole extra deployment. In modern devops in particular it is common to create and tear down IP networks in seconds and sling stuff everywhere. The extra moving part is an extra thing to break. DNS also runs over IP which means if IP is down DNS doesn’t work. What do you have to do then? You have to debug IP without DNS. There is mDNS but it’s not reliable and doesn’t scale to large networks. It also runs on the IP layer so if there is a problem there it can break.
- throw0101d 2y ago
  > The problem is that DNS is not zero configuration. Certainly it is not-zeroconf, but it is the same not-zeroconf for both IPv4 and IPv6. But extra work with DHCP is needed for IPv4, and extra-extra work if you need to do things like configure 'IP helper', whereas IPv6 can be configured using only a router (which you need regardless) and some on-link packets (RAs). > DNS also runs over IP which means if IP is down DNS doesn’t work. What do you have to do then? You have to debug IP without DNS. And? At least you have fe80/64 as a basic starting point. Run a tcpdump to see if you're on-link in any way (or in the correct VLAN), and if you are, you can then ping(6) ff02::2 to find if there any on-link routers. You've now debugged Layer 2 and Layer 3 connectivity. Tada. You're making IPv6 (sound) way more complicated than it is. It is no more or less complicated than IPv4 or IPX/SPX or …. It's protocol data units at OSI Layer 2 or 3 in different formats with different fields.
louthy 2y ago
> who remembers them nowadays? 0118 999 881 999 119 725… 3 Me, that’s the new number for the emergency services. Actually, that’s the only phone number I can remember :D
- adolph 2y ago
  Eight six seven five three oh nine Eight six seven five three oh nine

teddyh 2y ago

Yes, like Ethernet addresses. Those are impossible to remember, too, so obviously Ethernet is no good. /s The solution for IPv6 addresses is the same for Ethernet addresses; don’t use them directly. Leave it to the name resolution system, and use host names.

deleted 2y ago
[deleted]

Gormo 2y ago

Also, NAT is desirable for security/network isolation reasons, and having no distinction between a local IP and a public IP has a lot of disadvantages. Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents.

throw0101d 2y ago
> Also, NAT is desirable for security/network isolation reasons […] This is security theatre. People have been saying that NAT is not a security feature for over a decade: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ https://blog.ipspace.net/2011/12/is-nat-security-feature/ but the message still has not sunk in. The "Zero Trust" paper was published by John Kindervag in 2010: * https://media.paloaltonetworks.com/documents/Forrester-No-More-Chewy-Centers.pdf https://media.paloaltonetworks.com/documents/Forrester-No-Mo... Most modern attacks start from a compromised internal host (e.g., from phishing), or through stolen credentials via a remote access method. The above is "castle-and-moat" thinking that tends to have weaker internal controls because it is thought the internal network is "hidden" from the dangerous outside network. Set your firewall to default deny, then add a rule for allow outgoing connections, followed by only allow incoming connections if they are replies. For most machines (and networks), most of the time, this is what's needed: the above is applicable for both IPv6 and IPv4 (with or without NAT). The protection comes from filtering (generally) and stateful packet inspection, not from hiding addresses. > […] and having no distinction between a local IP and a public IP has a lot of disadvantages. Just because something has a global addresses does not mean global reachability (see default deny above). Further you can layout your IPv6 address plan so that you can tell at a glance if hosts are externally accessible. Using a /48 a basis, you break out sixteen /52s, numbered $PREFIX:[0-f]000::/52. To make it easier to remember what is externally accessible, you put all of those hosts in $PREFIX:e000::/52, where e stands for external. That /52 can then be broken down into: * sixteen /56s * 256 /60s * 4096 /64s or any combination thereof. See Figure A-5 for various ways to slice and dice: * https://www.oreilly.com/library/view/ipv6-address-planning/9781491908211/apa.html https://www.oreilly.com/library/view/ipv6-address-planning/9... Everything in $PREFIX:[0-d,f]000::/52 is not externally reachable.

dilawar 2y ago

Thanks for pointing this out. It's hard to communicate ipv4 and I dread even reading ipv6. I don't understand why they didn't just add two or four more fields to ipv4 e.g. 0.91.127.0.0.1 is localhost where 0.91 can be omitted in the local context. PS: I don't understand how networking works. Feels very very complex and full of jargons.

fragmede 2y ago
if ipv4 is called that because there are 4 numbers in the IP address, what would you call your scheme with 6 of them?
wolfendin 2y ago
Because the fields are there for humans, in the packet itself it’s a 32bit integer, and you can’t just arbitrarily make the src/dest fields in the packet bigger— it stops being IPv4 then.
- jkrejcha 2y ago
  I'm pretty sure the person you're replying to is saying that IPv6, should be IPv4 but longer, which is not at all an uncommon opinion, even if it's a breaking change to the IP protocol. And I'd argue there would've been incredibly strong benefits and much wider adoption if they did this. Sure, you'd still need new networking gear and software support to handle it, but the change is relatively simple (and potentially more easily backwards compatible), especially compared to all of the baggage that came with IPv6. It's a fact of life that working with networking that we'll have to work with IP addresses at some level. It's easy to tell someone, "hey try typing in 'ping 8.8.8.8' and tell me what you get". The readability of IPv6 is, in my opinion, worse with repeated symbols and more characters to remember. The symbols that were chosen were also poorly thought out. Colons are used in networking a lot of times when you want to connect to a service on a particular port, so if you want to visit 2001:4860:4860::8888 in your browser, you have to enclose the address in square brackets.
  - Lammy 2y ago

wolfendin 2y ago

That’s because nobody normal— anyone who isn’t a tech person— remembers IP addresses. Hell I can’t get tech people I work with to give me their public IP.

tempcommenttt 2y ago
Maybe young people can’t, but older folks can easily store phone numbers in their brains, so IP4 is easy.

gorgoiler 2y ago

In practice I haven’t ever had a problem memorising IPv6 addresses. The significant proportions of any address you might type manually are 48 bits long at one end and a few bits at the other. An example IPv4 address is 8 to 12 digits: 10.30.115.5 A memorable IPv6 address at a /56 site — the prefix and then one or two digits — isn’t much longer: 2001:db8:404:14::42 If you’re with a reasonably clued in ISP you probably get a /48 for your site by default: 2001:db8:404::42 If you’re enumerating your own /64 prefixes then it’s not much more complicated than: site 2001:db8:404:: net :14:: host ::42

RulerOf 2y ago
>the prefix and then one or two digits — isn’t much longer I'd argue it's just enough to make the difference though. The problem is that people got used to being able to rely on memorizing IP addresses. IPv6 does its best at making IP addresses both harder to memorize, and completely dynamic, going so far as to change the IP on a fairly regular basis. It's antithetical to some very core qualities that an IP address is supposed to have in the minds of many.
tempcommenttt 2y ago
This is the first time I read about someone actually trying to remember IP6 addresses, maybe I should try that, because it’s really easy to remember IP4. For me, the problem is that there’s hex numbers, which are harder to remember and missing zeros, so you need remember the colons. If IP6 would just be 6 decimal numbers and this would be the default way of writing them, this would not be a problem. But it feels to me that the cryptic way IP6 is written is to make it hard for humans to remember it.