3 ms·

every time i have to deal with ice and webrtc, i wonder if it is easier to ship a mirai style bot which would hack the modems from the lan side which is even ea

every time i have to deal with ice and webrtc, i wonder if it is easier to ship a mirai style bot which would hack the modems from the lan side which is even easier than from the wan side, and and just add the portforwards.

Sean-Der 2y ago
My dream would be if WebRTC Agents would experiment with Port Control Protocol. I don't know if it is the answer, but a world without dependence on STUN servers sounds pretty amazing. I can see why it would feel like kludge, but how could would it be to remove that dependency. My other wishlist item is to allow mDNS for signaling. Something like https://github.com/pion/offline-browser-communication https://github.com/pion/offline-browser-communication. It is so silly that I need to exchange a Offer/Answer using a remote server to start a session with a IP Camera in my LAN.
- marcodiego 2y ago
  You can user Tor and expose a service running on your lan to the whole world.
  - noident 2y ago
    I can count to 30 before the onion service running my personal wiki loads. Tor is awesome but onion services are really, really slow!
- SahAssar 2y ago
  > My other wishlist item is to allow mDNS for signaling. If you load a webpage with from a mDNS address of the camera what other steps are needed? Your browser and the camera should be able to exchange SDP and connect without any third party.
- IgorPartola 2y ago
  You know what’s easier than all this happy crappy? Goddamn IPv6. How many engineer-hours have been spent trying to work around NAT and IPv4 which could have been spent implementing IPv6? Every browser tab could have its own publicly routable address if we wanted to. And the more work arounds we create the less pressure there is to get over the hump and treat IPv4 as the weird legacy protocol instead of treating IPv6 as the weird new protocol. I guess engineer activism is all there is really left to do. Enable dual stack, write your code to be IPv6-first (it can automatically do IPv4 connectivity if enabled so really you only need to support one stack and the OS will translate for you; this doesn’t mean you can avoid having IPv4 addresses if you want to have your service IPv4 accessible, just that your code can pretend like every address is an IPv6 address). Test your code without IPv4 connectivity. If you reference localhost, don’t use 127.0.0.1 preferring localhost instead. Don’t be the reason the next engineer has to say “well this codebase isn’t IPv6 compliant so we can’t enable it”.
  - dboreham 2y ago
    It would still block inbound connections.
    - IgorPartola 2y ago
      Your firewall doesn’t currently block WebRTC does it? It is perfectly able to be bypassed.
  - EGreg 2y ago
    Get around hole punching NATs with this one weird trick “they” they don’t want you to know about?
    - IgorPartola 2y ago
      NAT should have never been a thing. That should have been the moment of “oh yeah we need a different IP protocol.”
  - kelnos 2y ago
    My network's firewall doesn't let random incoming IPv6 connections come in, and I wouldn't change that even if I didn't need NAT for IPv4. Is there a safe protocol to allow applications inside a network to automatically ask edge firewalls for temporary port forwards (or port unblockings, which would be all that would be needed with routable IPv6)? I still can't see how that could be made safe, though: how would the firewall know that the request was coming from a user on the network, and not malware (or a user being duped by malware)?
    - LegionMammal978 2y ago
      As I understand it, that is basically the purpose of UPnP IGD [0], as well as the newer PCP [1]. But hardly anyone implements these protocols due to the usual concerns around incoming connections. [0] https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protocol https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protoc... [1] https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol
IgorPartola 2y ago
Ship one that uses Tunnel Broker to enable IPv6. Back when Teredo was a thing I wrote an article about how to turn a Raspberry Pi into an add on router for your IPv4 network. Essentially it would get a Toredo IPv6 prefix, then advertise the prefix to your LAN via radvd for stateless auto configuration. The effect would be that soon as you plugged one of these in it would instantly give every device on your LAN IPv6 connectivity without having to do a single thing besides finding a USB and CAT5e cable. Mostly was a proof of concept of course though I did run it like this for a bit. It worked quite well even if it didn’t give you your full bandwidth at all times.

Sean-Der 2y ago

My dream would be if WebRTC Agents would experiment with Port Control Protocol. I don't know if it is the answer, but a world without dependence on STUN servers sounds pretty amazing. I can see why it would feel like kludge, but how could would it be to remove that dependency. My other wishlist item is to allow mDNS for signaling. Something like https://github.com/pion/offline-browser-communication https://github.com/pion/offline-browser-communication. It is so silly that I need to exchange a Offer/Answer using a remote server to start a session with a IP Camera in my LAN.

marcodiego 2y ago
You can user Tor and expose a service running on your lan to the whole world.
- noident 2y ago
  I can count to 30 before the onion service running my personal wiki loads. Tor is awesome but onion services are really, really slow!
SahAssar 2y ago
> My other wishlist item is to allow mDNS for signaling. If you load a webpage with from a mDNS address of the camera what other steps are needed? Your browser and the camera should be able to exchange SDP and connect without any third party.
IgorPartola 2y ago
You know what’s easier than all this happy crappy? Goddamn IPv6. How many engineer-hours have been spent trying to work around NAT and IPv4 which could have been spent implementing IPv6? Every browser tab could have its own publicly routable address if we wanted to. And the more work arounds we create the less pressure there is to get over the hump and treat IPv4 as the weird legacy protocol instead of treating IPv6 as the weird new protocol. I guess engineer activism is all there is really left to do. Enable dual stack, write your code to be IPv6-first (it can automatically do IPv4 connectivity if enabled so really you only need to support one stack and the OS will translate for you; this doesn’t mean you can avoid having IPv4 addresses if you want to have your service IPv4 accessible, just that your code can pretend like every address is an IPv6 address). Test your code without IPv4 connectivity. If you reference localhost, don’t use 127.0.0.1 preferring localhost instead. Don’t be the reason the next engineer has to say “well this codebase isn’t IPv6 compliant so we can’t enable it”.
- dboreham 2y ago
  It would still block inbound connections.
  - IgorPartola 2y ago
    Your firewall doesn’t currently block WebRTC does it? It is perfectly able to be bypassed.
- EGreg 2y ago
  Get around hole punching NATs with this one weird trick “they” they don’t want you to know about?
  - IgorPartola 2y ago
    NAT should have never been a thing. That should have been the moment of “oh yeah we need a different IP protocol.”
- kelnos 2y ago
  My network's firewall doesn't let random incoming IPv6 connections come in, and I wouldn't change that even if I didn't need NAT for IPv4. Is there a safe protocol to allow applications inside a network to automatically ask edge firewalls for temporary port forwards (or port unblockings, which would be all that would be needed with routable IPv6)? I still can't see how that could be made safe, though: how would the firewall know that the request was coming from a user on the network, and not malware (or a user being duped by malware)?
  - LegionMammal978 2y ago
    As I understand it, that is basically the purpose of UPnP IGD [0], as well as the newer PCP [1]. But hardly anyone implements these protocols due to the usual concerns around incoming connections. [0] https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protocol https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protoc... [1] https://en.wikipedia.org/wiki/Port_Control_Protocol https://en.wikipedia.org/wiki/Port_Control_Protocol

IgorPartola 2y ago

Ship one that uses Tunnel Broker to enable IPv6. Back when Teredo was a thing I wrote an article about how to turn a Raspberry Pi into an add on router for your IPv4 network. Essentially it would get a Toredo IPv6 prefix, then advertise the prefix to your LAN via radvd for stateless auto configuration. The effect would be that soon as you plugged one of these in it would instantly give every device on your LAN IPv6 connectivity without having to do a single thing besides finding a USB and CAT5e cable. Mostly was a proof of concept of course though I did run it like this for a bit. It worked quite well even if it didn’t give you your full bandwidth at all times.