3 ms·
The premise is completely wrong here. IPv6 is not just an “incremental change” that would have represented an easy uptake. Instead, pretty much every practical
by skywhopper 2y ago
The premise is completely wrong here. IPv6 is not just an “incremental change” that would have represented an easy uptake. Instead, pretty much every practical detail of existing IPv4 infrastructure, both hardware and software, was broken. Massive swaths of extra management and security tools were rendered useless. It was a massive miscalculation.
In the meantime, we figured out how to make things work without the extra address space. And the dream of a point-to-point Internet turned out to be a terrible idea after all. IPv6 pushers love to hate on NAT, but it’s actually a really good design choice that’s fundamental to basic network security.
- xvilka 2y agoNAT doesn't ever provide security, only pretending to.
- iso8859-1 2y agoWhy is there a difference in captcha exposure between IPv4 and IPv6 then? Maybe there is no actual security, but the people deploying these captchas seem to think there is a need to deploy them for IPv6 users.
- einsteinx2 2y agoI’ve seen this sentiment repeated over and over in this thread without a single explanation. Please explain how NAT on IPv4, as used in practice, does not increase security vs connecting machines each directly to a publicly accessible Internet address? I’m having a hard time understanding how this statement can possible be true.
- xvilka 2y agoHere is the very simple but practical explanation why: https://0day.work/an-example-why-nat-is-not-security/ https://0day.work/an-example-why-nat-is-not-security/ And more high-level explanation as well: https://www.f5.com/resources/white-papers/the-myth-of-network-address-translation-as-security https://www.f5.com/resources/white-papers/the-myth-of-networ...
- otabdeveloper4 2y agoThat's bullshit. "Security" is not a binary switch. NAT is a useful tool in your security toolbox when you want a more nuanced take than either "ban all ports" or "let every port flap open on the internets, #yolo".
- Dagger2 2y agoNAT is useless for that. Firewalls are the tool for blocking connections.