18 ms·

IPv6 Is Hard

240 points by miyuru 2y ago

knorker 2y ago
This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. If anything, IPv4 is much harder. The Internet is in an abusive relationship with NAT, thinking it's normal. But we're in a world where if a service breaks IPv4, they lose a very large set of their customers and it's the service's fault. If they break IPv6, it's is perceived that if any customer fails to connect, then it's the customer's fault (or their ISPs fault).
- api 2y ago
  "Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect.
  - knorker 2y ago
    > "Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. Indeed. I meant that if evaluating the two de novo, IPv4+NAT is harder.
    - jeroenhd 2y ago
      I agree that NAT sucks but IPv6 having two different ways of assigning addresses (SLAAC and DHCPv6) with one of them being practically optional (Android doesn't do DHCPv6 for address assignment) does make IPv6 harder than it needs to be. Then there are crimes against network protocols like NAT66 that are borderline necessary in some situations because terrible ISPs have decided to dynamically alter IPv6 prefixes so they can charge extra for a static prefix. I still think NAT makes everything harder than it should be, but I get why some people struggle with IPv6 if their ISP is particularly terrible.
      - api 2y ago
        The sin of IPv6 was trying to do too much. They should have extended address sizes, period. SLAAC and most of the other extensions were a mistake. Everyone should bomb Android bug reports with complaints about lack of DHCPv6 until they fix it. Then people can de-facto deprecate SLAAC. AFAIK Android is the only major offender here. Some corporate networks already don't do SLAAC if they don't need Android to work on them.
        raron 2y ago
        In that case ISPs would give you a single /126 and ask more money for extra devices, eg. /124 for a "family plan".
      - kstrauser 2y ago
        I don't generally care for Android but I'm glad they chose not to support DHCPv6. It's a nice forcing function to make network admins actually learn how SLAAC works and why they should almost certainly prefer it to DHCP.
  - kstrauser 2y ago
    Maybe a long time ago, but just about everything I've used recently supports mDNS for LAN hostnames. If I add a computer named "foo" to the LAN, it's almost certain I can run "ping foo" on another computer 3 seconds later.
    - kllrnohj 2y ago
      that's not mDNS that's just dhcp+dns and it's something ipv6 actually breaks, which is part of the problem. DHCPv6 is optional, so local devices don't necessarily ever register their hostname nor do they necessarily ever consider your local DNS server.
      - amaccuish 2y ago
        >that's not mDNS that's just dhcp+dns Actually mDNS does exactly what they said just fine. You’re confusing it with the ability of a DHCP server to make updates in DNS on behalf of clients. There is more than one way to skin the cat. Both achieve the same affect, just differently. > nor do they necessarily ever consider your local DNS server. Hardcoded DNS servers are just as equally a thing with IPv4.
        kstrauser 2y ago
        That's right. I'm specifically talking about mDNS, not DHCP+DNS. It works out of the box nearly all the time that I've tried it.
        kllrnohj 2y ago
        mDNS would work just fine but the given command ('ping foo') wouldn't be using mDNS. That's just standard name resolution. `ping foo.local` would potentially use mDNS if you have a ping that does such a thing, but that's restricted to `.local` specifically. Rather, most routers add DHCP hostname requests to the local DNS routes. That doesn't require mDNS, nor would you want to replace it with mDNS as mDNS is more limited & flakier.
        2y ago
  - kllrnohj 2y ago
    > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Possibly, but I think it's also that some aspects of IPv6 are just badly designed, and subsequent updates only fixed some of the issues. SLAAC, for example, is godawful stupid. And while DHCPv6 exists to fix some of that, critical aspects of the protocol, like prefix delegation, are manually configured. This is beyond idiotic and makes things like subnets massively more difficult than they have any right to be. SLAAC and PD combine to create the worst sin of all - flakiness. It's hard to figure out why IPv6 isn't working because everything is telling you it is (it "auto configured" a valid IP despite not having any actual route to anywhere else, so helpful! /s). If IPv6 was literally just "IPv4 but 128-bit addresses instead of 32-bit ones" it almost certainly would have been adopted en masse by now. But it isn't, it made things more fragile and harder to configure for no goddamn reason. And of course you then have ISPs doing silly stuff, like my ISP only gives me a /64 so I literally can't use IPv6 on my network since I want VLAN isolation. 18446744073709551615 possible addresses are given to me yet dividing that up into 3-5 subnets is completely impossible. Fucking stupid protocol.
    - api 2y ago
      Why is delegating smaller addresses impossible? Kernels will totally take /72, /88, /96, etc. without issue... or at least any OS I've ever used will.
      - kllrnohj 2y ago
        It breaks SLAAC so routers won't do it. Or if they do, it's non-standard and they won't easily let you do it. /64 is the smallest PD by spec ( RFC 5375 )
        api 2y ago
        You can do it with DHCPv6, but of course there's Android. Android aside, it works fine. The core of V6 -- longer IPs -- is great. SLAAC and /64 being the smallest need to be deprecated. It's asinine. Really absolutely everything but longer IPs should be deprecated and was a mistake.
  - lowercased 2y ago
    > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect. I've been convinced of this since around 2000. Every network utility dealing with IPv4 had... dotted quad addresses. You could remember them, you could read them, you could speak them to someone else. Brainwise, we can remember 3-5 things - segments, digits, etc. Remembering more is harder for the average person. Having the 6 be literally dotted sextant(?) - 5.73.192.168.0.4 for example - would have been much much much easier to transition in to, and would have given us 64k x 4 billion addresses. Yes, it's not the near infinity we have with IPv6, where apparently every molecule in the universe can have multiple IP addresses or whatever the max number is. But it would have been much much easier to transition. 27 years later we're not transitioned from ipv4, and we've got another 27 years of dotted quad baked in to daily usage everywhere.
    - kstrauser 2y ago
      That would have required exactly as much work to transition, plus require computers to get good at 48-bit math. ("Why are the top 2 bytes always 0xFF?" "I don't know, grandson, but I'm sure it seemed like a great idea before Y248.")
      - lowercased 2y ago
        I'd imagine many countries would claim a top spot or two, and transition all canadian addresses to, say, 7.0.0.0.0.0. Big companies would probably get some of their own. Legacy/default stuff would have leading 0.0, sure, but... so what? No, it wouldn't have taken 'exactly as much work to transition'. See another reply. In 2024, I'm still reading about BGP/routing table issues, and hardware having problems keeping up with IPv6 networking - it's just too large. How was this supposed to work in 1999? A smaller stepped transition from 4 billion addresses to... 64k of those would have been an easier transition step, and the ease - mental, UI, training, testing, security, etc would have given everyone involved the confidence and positive feedback to tackle a next stage to IPv6 (eventually).
    - yrro 2y ago
- motorest 2y ago
  > This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. Last time I've checked, some telecoms such as Vodafone didn't even supported IPv6 yet.
  - baq 2y ago
    telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. b2b telecoms as a consequence also have at best zero incentive since if the consumer doesn't have ipv6, businesses don't need or want ipv6. the solution here, which will inevitably strike a nerve with some, is to have a regulatory mandate for ipv6. a soft version would start with 'government networks must run exclusively on ipv6, this applies to any and all contractors, including govclouds' and work upwards from there. I understand such policies were in place or at least planned; OTOH in the current political climate it'll be sort of a miracle if the existing ipv4 networks keep working.
    - yjftsjthsd-h 2y ago
      I was under the impression that cell carriers famously went all in on v6 because it saves them money?
      - kccqzy 2y ago
        Yes that don't have to allocate an IPv4 address for each customer or deploy ugly solutions like CGNAT. They simply cooperate with phone OS makers (Apple and Google) to make sure the OS and the apps work in an IPv6-only environment. Apple then forces app developers to make their app work in an IPv6+NAT64+DNS64 environment.
    - knorker 2y ago
      > telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. Not entirely true. 10/8 is only so big, so the management of addresses very much has a nonzero opex cost. And on top of that there's capex on "carrier grade NAT". For the biggest providers 10/8 is not even big enough for their production environment. And then they acquire some some company that (obviously) also uses 10/8. No, there's definitely incentive there. Just… not enough.
- cyberax 2y ago
  NAT is awesome. It automatically forces users to have a stateful border firewall that makes incoming connections impossible.
  - bobbob1921 2y ago
    I second this, it forces security by default (at least keeping devices from being directly exposed)
  - growse 2y ago
    NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.
    - cyberax 2y ago
      NAT _is_ a firewall. And it provides the same level of security as pretty much all of the "firewalls" marketed as such.
      - growse 2y ago
        No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.
        mixmastamyk 2y ago
        I’ve never seen one without the other, so while technically correct, not useful to debate.
        growse 2y ago
        shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
- johnea 2y ago
  I don't disagree, but I would point out that one upside to every LAN being behind NAT, is that those LANs are also inherently firewalled. This is dependent on the firewall features of the NAT router, but at least its something, and the router provides one centralized point of protection from interent traffic. In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall. This complicates some intra-LAN communications, and removes the feature of having the LAN be a walled garden, mostly isolated from the interent.
  - KAMSPioneer 2y ago
    Or you can implement a firewall on your gateway device with a default drop policy for inbound traffic. Essentially the same behavior as NAT in terms of unsolicited (usually malicious) inbound traffic, but without the downsides of one-to-many NAT. Which is, coincidentally, exactly how it works if your LAN is made up of devices with publicly-routable IPv4 addresses as well, which happens in business/academic/military networks all the time.
    - aboardRat4 2y ago
      But most users are not business academic military. They just want to watch some reels.
      - KAMSPioneer 2y ago
        And? Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. My point is that NAT isn't a security feature, and that firewalls in edge network equipment is table stakes these days.
        aboardRat4 2y ago
        >Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. No they don't. Most ISP boxes only implement the bare minimum of functions to make sure that youtube is available to the users. Which includes NAT, because otherwise youtube does not work, and does not include anything else.
Arnavion 2y ago
(Title is sort of clickbait. The body is about how it isn't hard, but certain misconfigurations make it appear hard.) Note that curl itself also implements Happy Eyeballs if you don't force a particular protocol via `-4` or `-6`. You can see it in action with `curl -vvvv https://opentalk.mailbox.org https://opentalk.mailbox.org`. So you shouldn't look at the author's example and extrapolate that `curl github.com` or `curl opentalk.mailbox.org` will fail in an IPv6 environment.
ninkendo 2y ago
IPv6 isn't hard, and as the article alludes to, it is different, but it's not even that different. What is hard, is dual stack networking. Dual stack networking absolutely sucks, it's twice the stuff you have to deal with, and the edge cases are exponentially more complex because if your setup isn't identical in both stacks, you're going to hit weird issues (like the article suggests) with one stack behaving one way and the other behaving another way. None of this is the fault of IPv6, it's a natural consequence of the strategy of having two internets during the transition period. A transition period which has now been going on longer than the internet existed when it started. Maybe 100 years from now we'll finally be able to shut off the last IPv4 system and the "dream" of IPv6 will become a reality, but until then, life is strictly more difficult on every network administrator because of dual stack. (Note: no, we could not have done it any other way. Any upgrade strategy to IPv4 that extended the address size would have necessitated having two internets. It just sucks that it's been this long and we're still not even at 50% IPv6 usage.)
- ninkendo 2y ago
  To add: The really sad thing about IPv6 is that it's a relic of a bygone era. The internet was envisioned as a thing where every device on every network could, in principle, initiate a connection to any other device on any other network. But then we started running out of addresses, ISP's wouldn't give you more than one for a household, so we started doing NAT, and that kind of sealed the internet's fate. Nowadays, we wouldn't want a world where everything was connectable, even if we had enough addresses. Everyone's network in essence has a firewall. If you run IPv4 and using NAT, you're going to be dropping unsolicited incoming packets no matter what (let alone that you wouldn't know where to route them even if you wanted to let them through) and with IPv6 you'd be insane to allow them. Devices have "grown up" in a world where we expect the router we're connecting to, to shield us from incoming unsolicited traffic. I certainly don't have the firewall enabled on my linux desktop. Windows I _think_ has it enabled by default, but I often turn it off because I want LAN connections to work. MacOS is probably similar. Suffice to say, if the IPv6 dream happened overnight and everyone's devices were instantly connectable, all hell would break loose. We need our routers to disallow traffic. (Edit: This wasn't all that clear, so let me restate: In both the IPv4 and IPv6 world, you'd be insane to disallow incoming unsolicited traffic, which is why basically everyone blocks it in IPv6 as well as IPv4. I'm not trying to say IPv6 can't do this... quite the contrary: IPv6 routers absolutely do, and should, block unsolicited incoming traffic. But my point is that this is what prevents the original vision of IPv6 from becoming a reality: We can't design software around the idea of direct peer-to-peer communication, without stuff like UPnP. Oh, and UPnP works with NAT and IPv4 anyway so, there's the rub.) So, even in a pure-IPv6 world, that instantly prevents any startup with an idea to allow true peer-to-peer communication using end-to-end routability. What are you going to do, train your users to log into their router and enable traffic? Approximately 0% of your customers know how to do that, even in a counterfactual universe where IPv6 happened and we all have routable IP's on our devices. Maybe in such a universe, people would be trained to use local firewalls on their device, and say "ok" to popups asking if you want to let software through. But I'd wager that a lot of people would prefer the simplicity of just having their gateway drop the traffic for them. No, the "all devices are routable" idea came from a naive world where there wasn't a financial incentive for malicious behavior at every turn. Where there aren't millions of hackers waiting for an open port to an exploitable service they can use to encrypt all your data and ransom it for bitcoin. The internet is a dark forest now. We don't _want_ end-to-end connectivity.
finnigja 2y ago
Not hard, just different. Maybe the "harder" bit is actually remembering any one address. My IPv6 connectivity tester at https://ready.chair6.net https://ready.chair6.net is still doing its thing, twelve years since https://news.ycombinator.com/item?id=2154124 https://news.ycombinator.com/item?id=2154124. Looks like Hacker News has added support in five years since https://news.ycombinator.com/item?id=21382275 https://news.ycombinator.com/item?id=21382275.
- miyuru 2y ago
  I built a bit similar simple tool which tracks failed HTTP domains. https://v6check.miyuru.lk/ https://v6check.miyuru.lk/ will add a link to your site on the failed domains page.
- remram 2y ago
  What is the "IPv4 Literals" test?
  - finnigja 2y ago
    Haven't look at that code for a while, but IIRC it does a simple HTTP request then checks the returned HTML for anything that looks like a v4 literal, eg. http://174.136.109.18 http://174.136.109.18.
api 2y ago
I am SO tired of "is hard." I cringe every time I see this boring cliche. It's a meaningless way of saying "look at me I'm smart." Everything is or is not hard depending on the audience and what it's being compared against. IPv6 is hard compared to Ethernet, but easy compared to managing a mess of NATs to handle V4 networks with conflicting addresses at different locations. All of this is a lot easier than understanding the leading proposed theories of quantum gravity.
cyberax 2y ago
IPv6 is really an example of a second-system syndrome. It really _is_ hard because it makes a lot of IPv4 conventions inapplicable. For example, if you want to do multi-homing with IPv6 for an SMB, you need to either do NAT (not great), or have your router advertise/whithdraw prefixes dynamically. If you do the prefix withdrawal, you can end up in a situation where your devices have _no_ prefixes. So even your internal functionality like printing or VoIP starts breaking. Great. Then there's ULA that is mis-prioritized. You'd think that simply adding a stable ULA prefix to all devices would solve the issue above, but that's not the case. The devices will prioritize the global IPv6 source address, so stuff can _still_ break.
- chgs 2y ago
  IPv4 and nat solved the problem quite nicely in the real world. IPv6 just yelled at people and said it wasn’t a problem.
- nucleardog 2y ago
  I have three connections at home both as a way to increase available bandwidth and also to provide some redundancy since I work from home and my ability to earn income is tied to my internet being up. I have two primary connections that I load balance between, each providing a /56. If either fails, all traffic goes to the other. I have a third connection that is used only as a backup in the event that both the other connections go down, providing a /64. So simple case, I assign an address from each connection out to each device. Except, whoops--the backup ISP only provides a /64 and despite that containing something like 18.5 quintillion addresses (a number so large my spell check is telling me it's not a real word), I can't actually split those up in any meaningful way so I can only allow _one_ subnet to access the internet via that connection. And then I'm pushing responsibility for load balancing between the two primary connections out to each client. You know, to the place with the _least_ useful information for making decisions in this situation. And then I need to figure out how to convince each device to make these decisions individually. (As far as I can tell, with an equal cost, Linux will simply use the most recently added address. So in the event that one of the primary connections is having issues and bouncing up and down, that's going to be the one that all the Linux devices choose to use preferentially. Absolutely what I'd want!) So I give everything a ULA (which I'd want to do anyway so my internet going down doesn't mean my TV can no longer stream media from the server across the house, since that's a reasonable thing to expect to happen) and then look at doing some sort of prefix translation. Except since nobody's using this stuff because it's so very not hard, I hit a bunch of weird edge cases in my network gear trying to do that. Not the least of which is that I need to statically configure the prefix I'm translating _to_ except that's not provided to me statically so now I need to set up some sort of script to monitor the prefix on the external interface and dynamically update my firewall rules? Oh, except apparently the RFC was only updated like a year and a half ago to prefer IPv6 ULA addresses over IPv4 so most devices would end up just using IPv4 anyway and the IPv6 deployment would be little more than a box checking exercise until everything's updated. (Though it looks like that change may never have been adopted anyway?) Last time I was digging in to this, I ended up down a path of starting to file forms with IANA to get a IPv6 block directly allocated so I could use a GUA internally (avoiding the preference issue), do prefix translation for load balancing, and announce the IP range from AWS and tunnel it to my router to work around the /64 issue on the backup connection. Or, or, or... hear me out... I can just... _not_. Nothing is broken right now. I derive no personal value or enjoyment from stacking up a house of cards I'll have to keep standing back up so my toaster can have a globally reachable internet address. People can tell me it's "not hard" all they want, but after... oh hell, 30 years of bending computers and networks to my will, I feel pretty confident in saying either: 1. It is hard; or 2. IPv6 is fundamentally unfit for purpose. I'd be happy for someone to come along and tell me I'm an idiot and _precisely why_ though. Really. Somebody. Please do. Tell me how I am supposed to make this work. I know it's a thing I _should_ be doing but I really can't figure out how.
thrdbndndn 2y ago
> So in the case of the toot mentioned above there is an AAAA for the FQDN. But the connection doesn’t work. But the end user doesn’t notice. Because there is a browser feature called Happy Eyeballs (HE). Basically: A browser tries both protocols and uses the faster on. In case of non-working IPv6 IPv4 is always faster. I mean even if there is no "Happy Eyeballs", it would still work for end users, no? Unlike `curl`, you don't specify -4 or -6 with browsers. Without HE, wouldn't (shouldn't?) it just try both in sequence? > HE can have some funny side effects. In a project a connection to a development web server sometimes worked and sometimes didn’t. The solution was quite simple. The customer used a split VPN tunnel. IPv4 was routed via the VPN tunnel and those IPv4 addresses were allowed in the web servers access list. IPv6 was routed via the normal Internet connection and those addresses weren’t allowed. This following sentence makes no sense, when the author literally said HE help it work when one IP family was broken and the other is not. So why would it work sometimes if IPv6 is consistently broken and IPv4 is not? (I'm not saying it won't happen; just that it shouldn't be "caused by HE" -- HE literally is the solution to this issue in general as the author said themselves!)
- quuxberlin 2y ago
  > I mean even if there is no "Happy Eyeballs", it would still work for end users, > no? No browsers and other clients prefer IPv6 and there would be a rather long timeout till the client falls back and tries IPv4. If it falls back. > So why would it work sometimes if IPv6 is consistently broken and IPv4 is not? > (I'm not saying it won't happen; just that it shouldn't be "caused by HE" -- HE > literally is the solution to this issue in general as the author said > themselves!) IPv6 wasn't broken. For HE, an HTTP 403 is a valid connection. TCP handshake works, IPv6 works. I had another case where the TCP handshake worked, and the browser decided to use IPv6 is good, but then came the TLS handshake, and it failed because PMTUD (Path MTU Discovery) was broken.
johnklos 2y ago
The "IPv6 is Hard" source seems to be sarcastic, not serious. IPv6 is ridiculously easy, in the grand scheme of things. What's hard is getting people who should know better to do what they're supposed to do, without playing games. The very fact that there are people who will argue why IPv6 is unnecessary tells us everything we need to know, because occasionally those people are in the path of deployment of something public. They don't write software which works agnostically with IPv6, they don't implement addressing that's stack agnostic, they don't bother taking the extra five minutes to test with IPv6. Then you have a corporation that requires manager types to have enough "justification" to actually fix whatever Mr.-IPv4-is-good-enough, and because they don't understand that their own phone uses IPv6 all the time, they don't see a "business case" for it. The title would be longer, but perhaps more accurate, if it were "Getting know-it-alls to stop stubbornly clinging to IPv4-is-good-enough and getting managers to realize that IPv6 is not only inevitable, but ubiquitous, are hard". This article's conclusion isn't totally off, but in this case it's something that could easily be fixed by having a junior network admin just simply set things up. It's a trivial problem that's probably there because someone thinks they know better.
- kllrnohj 2y ago
  > IPv6 is ridiculously easy, in the grand scheme of things. How do I do a guest wifi network with isolation? On ipv4 I just flip a switch and thanks to NATs it just works, always. With ipv6? First I have to figure out what prefix delegation my ISP gives me. How do I do that? Manually, somehow, and hope it never changes. Already not "ridiculously easy" at the first step. Oops, turns out I was given a /64. So now what? Please explain this "ridiculously easy" thing to me, thanks.
  - kccqzy 2y ago
    Guest WiFi network isolation happens below the IP layer: you would use VLANs for that. Setting up a VLAN for the first time isn't ridiculously easy, but it's the same whether you are using IPv4 or IPv6.
    - kllrnohj 2y ago
sfblah 2y ago
I thought traceroute always used icmp.
- wmf 2y ago
  In theory it can use any protocol since TTL exceeded should work with any IP packet. I don't know if there's consistency between traceroute implementations so maybe some use ICMP and some use UDP.
  - Hikikomori 2y ago
    Windows tracert uses icmp.
- tremon 2y ago
  Depends on whether you mean the tool of the technology. Yes, the common traceroute uses icmp, but since it has become very popular for transit networks to ignore echo requests, there's also tcp (e.g. lft) and udp (e.g. Cisco's default) traceroute tools.
betaby 2y ago
CGNAT is hard at scale, although very few operate it. On other hand IPv6 is easy.
- stevenhuang 2y ago
  What are you talking about? Tons of smaller isps use cgnat here in Canada.
  - raaron773 2y ago
    Same in India.
  - betaby 2y ago
    No, not really. Please name those ISPs specifically in Canada. Also my key point is 'hard at scale', in contrast to yours 'smaller isps'.
    - stevenhuang 2y ago
      Try all major isps for one. Bell Telus Rogers. Just Google it and you'll find tons of people dealing with this problem as they discover they can't host anything because they're natted and unreachable. I've lived in Canada for > 20 years in several cities and provinces. I'm telling you that CGNAT is extremely common. I don't think you have any idea what you're talking about.
      - betaby 2y ago
        Neither Bell,Rogers or Videotron use NAT for residential internet - one is getting a global unicast IPv4 on their home routers. (Some locations are dual stack, like mine residential connection) For mobile Bell uses 464XLAT. Bell mobility is IPv6 only network, also MPLS free, they are SRv6 early adopters, impressive! Rogers, Videotron mobile use NAT44 for IPv6. IPv6 is native on Rogers.
        stevenhuang 2y ago
zerof1l 2y ago
I think that the main challenge people face with IPv6 is that they try to deal with it in the same way as with IPv4. IPv6 is not just a longer address, it's a completely different technology. It took me a very long time to figure out how to configure my docker containers on my home server to have global IPv6 addresses. But I did it, and it taught me a lot about IPv6. I would personally prefer for the internet to be IPv6 only. It would make certain things much easier like firewall rules, IP whitelisting, and no more stupid CGNAT.
akdor1154 2y ago
> So please: If you do IPv6 take it seriously. If you don’t take it seriously, don’t do IPv6. Amen - replace IPv6 in the above aphorism with $anything, and it's a great rule for running projects.
JoshTriplett 2y ago
The biggest piece of annoyance I have with IPv6: it's really hard to tell the OS "here's your IPv6 address, here's your gateway, here are your routes, now don't mess with any of it!". With IPv4 it's easy to set up a static configuration. With IPv6, the Linux kernel is eager to listen to all sorts of advertisements from the network, and it's hard to say "no, stop, don't ever ever listen to anything except my static configuration". I can bring up IPv4 networking in a tiny fraction of a second. IPv6 networking sometimes takes seconds to settle down and be reliable. (I'd be interested in any suggestions for how to improve this.)
- teddyh 2y ago
  In your /etc/sysctl.d/local.conf: net.ipv6.conf.default.accept_dad=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.default.autoconf=0 Or, in your network startup script (like Debian’s /etc/network/interfaces): sysctl -w net.ipv6.conf.default.accept_dad=0 sysctl -w net.ipv6.conf.default.accept_ra=0 sysctl -w net.ipv6.conf.default.autoconf=0 Or, in your /etc/systemd/network/en0whatever.network: [Network] IPv6AcceptRA=false IPv6DuplicateAddressDetection=0
  - Dagger2 2y ago
    Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.
    - JoshTriplett 2y ago
      For most cases I agree that automatic configuration is the right answer. In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.
acedTrex 2y ago
The github curl worked for me? curl -6 https://github.com -o /dev/null % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 273k 0 273k 0 0 957k 0 --:--:-- --:--:-- --:--:-- 956k
- aboardRat4 2y ago
  That's the worst part of the problem. Sometimes it works, sometimes it doesn't.
- tambre 2y ago
  You're on an network with DNS64 and NAT64 as its IPv4 compatibility mechanism probably.
- raaron773 2y ago
  It didnt work for me.
Havoc 2y ago
I’ve taken to just disabling it. I’d prefer to keep it on but every time I try it I run into a bunch of odd bugs. Silly stuff like GitHub container registry pulls being dialup speeds but docker.io being fine. Disable ipv6 and both at gigabit speeds. Bizarre stuff like that which I just don’t have the time and energy to go spelunking into the mysteries of dual stack to untangle. (Out of the box opnsense)
- miyuru 2y ago
  you might be having issues connecting to faslty. afk ghcr uses fastly and docker uses cloudflare.
donor20 2y ago
The big issue I've seen is that there are not clear wins for all the pain of IPv6. And the failure to provide a much much better ipv4 interop story out the gate (vs just trying to yell at everyone to switch) was a big big loss. So that means folks ended up having to run ipv4 to end devices in many cases and we have dual stack hell across the network. For the 90%+ of network clients on-prem that play by the rules you are often supporting both DHCP and SLAAC on IPv6 networks (unless android has figured out DHCP). Dual WAN redundancy on IPv6 in SMB settings is actually worse relative to a NAT and ipv6. The subnet size /64 is stupidly large, and the number of available subnets you can easily get annoyingly small from most upstream providers. Firewall filtering has to be modified or you get weird errors. People don't always like ICMP coming through the firewall. It's does lots of things differently, but for what? We do prefix delegation with DHCP but can't use DHCP to assign address (we are supposed to use SLAAC) but still need DHCP for lots of other stuff? It's nonsensical - you end up with just way too much garbage. The privacy extension stuff hits IPv6 hard. You have lots of auto-rotating addresses. The number of times turning of IPv6 fixes weird glitches / timeouts / stalls etc is still crazy too me. ATT (massive corp) requires end user devices request /64 subnets one by one - which most end user gear does not support. Getting static ipv6 IP's (despite claims there are lots of them) is seriously hard from upstream providers in many cases - but IPv4 is trivial by comparison. The list goes on. I would have made the subnet size 32 bits. Expanded the network part. Maybe even reduced the overall size - 128 bits feel dumb with /64's as the smallest subnet? Then just go super high interop / overlay to IPv4 with great suggestions so folks could ship ipv6 only stuff (even with on device bridge to ipv4 so outbound interface is ipv6) and no new concepts unless clearly justified.
muhammadn 2y ago
As per the article mentions of resolving AAAA IPv6 records, a feature was just merged into Linux's systemd-resolved last week. https://github.com/systemd/systemd/pull/34165 https://github.com/systemd/systemd/pull/34165 So you can do. RefuseRecordTypes=AAAA So there, your DNS won't ever query for IPv6 AAAA records. (in fact you can refuse any DNS questions like MX, SRV, TXT as well with: RefuseRecordTypes=MX SRV TXT) Note - I started adding that feature because some applications were "misbehaving" and querying AAAA records when IPv6 stack was disabled.
- miyuru 2y ago
  can it do `RefuseRecordTypes=A` as well?
AtlasBarfed 2y ago
So is CGNAT "real" ipv6? Asking for a friend, like, what all the ipv6 use in the world is. I'm curious. On the other side of CGNAT, you know, the mobiles, can they individually address each other, or can they only talk to each other through the CGNAT? I honestly don't know.
UltraSane 2y ago
One thing I like about IPv6 is the lack of CIDR so that every IPv6 address always has the same 48 bit site prefix and then 16 bits of subnets and than 64 bits of host. It is easy to remember the 48 bit prefix and then you can actually just sequentially number subnets and hosts if you want so an address can be prefix:1:1 if you want. One thing I hate about it is that they used 64 bits for host which is just absurd. 32 bits or even 16 bits would have been plenty for a single broadcast domain.
- Dagger2 2y ago
  The 64-bit host space is used by SEND to hold a cryptographic key as part of a method of securing neighbor discovery. 16 or 32 bits would be laughably inadequate for that. It's also used as a passive defence against IP scanning, making it significantly harder for worms to spread by brute-force scanning. I admit it does make the address space look a bit lop-sided, but taking bits away from the host side (where they're being used) and giving them to the network side (where we should already have enough space anyway) wouldn't be a sensible trade.
  - UltraSane 2y ago
    That is a clever hack made necessary by the lack of crypto as part of the IPv6 protocol like it should have been. If they were more ambitious they would have built something like the Locator/ID Separation Protocol (LISP) (RFC 6830) directly into IPv6 but used public keys as the ID.
qwertox 2y ago
> If you don’t take it seriously, don’t do IPv6. Which is why I deactivated IPv6 on almost every device in my network. My main issue is that the router/gateway provided by my ISP does not support DHCPv6 prefix delegation, which causes a couple of issues in my setup. Sometimes you can try really hard to archive a goal, but when the workarounds to simple problems become new problems, it's time to say "no".
wink 2y ago
If everyone supported it, IPv6 wouldn't be hard. Working with IPv6 if you are not entitled to switch out every vendor, every piece of hardware, every piece of software that is lacking.. that's the hard part. In short: reality is hard.
lakomen 2y ago
[dead]
lofaszvanitt 2y ago
ipv6 has this bullshit smell. bullshit, because it has this fucking useless naming convention (it's not for humans...) and overly complicated. like it was invented to muddle things about the internet, to raise the bar to understand it and hence coerce control. it resembles something that is not man made or deliberately made to be hard to use.
roody15 2y ago
In my career I have found IPv6 simply to be unnecessary. Running a network of 7 buildings with approximately 2,300 computers for now almost 2 decades and this is still true. Setting edge routers to simply drop all ipv6 packets and running only ipv4 works, is simpler, is faster (than dual stack) and easier to troubleshoot. I don’t have any inheritant issues with IPv6 other than is has failed to make a case for why people like me should bother rolling it out.
- UltraSane 2y ago
  I've worked at companies big enough to start running out of private IPs. That isn't fun.
- akvadrako 2y ago
  Although it sounds like keeping IPv4 is a reasonable choice in your situation, if you merge with another company (or otherwise connect your networks) that uses overlapping private IPs it will cause issues.
  - diggan 2y ago
    > , if you merge with another company (or otherwise connect your networks) that uses overlapping private IPs it will cause issues. Wouldn't this be true with IPv6 as well, assuming that both companies happened to have chosen some overlapping ranges?
    - remram 2y ago
      You don't "choose" your IPv6, they are assigned to you. Even if you used private IPs (ULA) for whatever reason, there are enough of those too not to conflict. By comparison my company uses the entirety of the private IPv4 space. `docker compose up` often fails because there is no private IP range left that is not directed through the VPN.
- impeplague 2y ago
  For your use case is fine today IPv4. In my case, I would love to get rid of my CGNAT IPv4 ISP address and use only IPv6.
citrin_ru 2y ago
It's surprising to that all comments (except a few) state that IPv6 is not hard. I'm not an IPv6 expert but I did spend time learning it (may be even more than I spent on IPv4 but with v4 I have more practical experience). I used v6 for a few years at home / home lab (and for a side project). I think IPv6 is hard - there is much more one needs to know to use it well than in case of v4. Any deviation from a happy path (a non-standard configuration / use case) is a pain (or at least it was 10 years ago, don't think it is much better now except now we likely have even more RFC to learn). Not used IPv6 recently so cannot name specific problems but I didn't enjoy working with it at all. Will do it again only if it will be well compensated.
- nottorp 2y ago
  > Any deviation from a happy path (a non-standard configuration / use case) is a pain I've posted here before about my home network with two internet connections. Not going to whine about it again, except restate that i basically have no idea what to do about it with ipv6.
- magicalhippo 2y ago
  I think there's a big difference between enterprise IT folks who can specify hardware with good IPv6 support, and which are able to switch internet providers if they don't support IPv6 well. It's entirely a different thing for home users which get handed some shitty router from the only ISP around. My options are cable or long-distance ADSL. The cable ISP has dynamic prefix, so I get a new prefix every week or so. If you contact them regarding IPv6 there's zero support, I had to find the prefix length by trial and error. So much software relies on the prefix being fixed, so this can lead to a lot of frustration. On the bright side I actually get a prefix, some just get a /64. IPv6 might not be hard, but using IPv6 might indeed be hard.
  - cylemons 2y ago
    > On the bright side I actually get a prefix, some just get a /64 what's the difference?
kpcyrd 2y ago
I run a ghcr proxy server to avoid having to rent an ipv4 address just to pull the container images I build with github actions: docker pull ghcr.proxy.orca.toys/kpcyrd/apt-swarm:edge My services are often run behind cloudflare, who does ipv4 for me and proxies to my ipv6-only vps. Should you use this? Well docker's security model is pretty much only https, so it's like using a proxy server from some random hackernews comment for your `curl|sh` needs, without end-to-end encryption. I wish github would just step up their game, at least for ghcr.io.
JansjoFromIkea 2y ago
Considering in the UK you can get sim cards with 10GB or so of data for pennies I'm a bit surprised I don't hear much about people doing old school self hosted direct access stuff over ipv6. Would there be much of a security risk if you had a dedicated device on its own network that doesn't actually directly communicate with anything else in your home?
1970-01-01 2y ago
The issue with IPv6 is that it's just too big; IETF overcompensated. Exponential growth really didn't occur "as planned" and addresses are barely readable to humans. 2^64 would have been better. That's something you can code using just 0-9 and no human will be forced to recite a never ending hexadecimal string.
- vaylian 2y ago
  > 2^64 would have been better. That's something you can code using just 0-9 That doesn't make any sense. 0-9 is base ten while 2^64 is base two.
deleted 2y ago
[deleted]
selfhoster 2y ago
IPv6 is mainly only wanted by people whose job it is to track people. In any IPv6 discussion they yell, flap their virtual arms and gums and attack any non-IPv6 true believers.
sujaldev 2y ago
Off-topic but I'm curious why would someone purposely left-align a website? It makes no sense unless you're _really_ trying to avoid css which is not the case here.

240 points by miyuru 2y ago

This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. If anything, IPv4 is much harder. The Internet is in an abusive relationship with NAT, thinking it's normal. But we're in a world where if a service breaks IPv4, they lose a very large set of their customers and it's the service's fault. If they break IPv6, it's is perceived that if any customer fails to connect, then it's the customer's fault (or their ISPs fault).

api 2y ago
"Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect.
- knorker 2y ago
  > "Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. Indeed. I meant that if evaluating the two de novo, IPv4+NAT is harder.
  - jeroenhd 2y ago
    I agree that NAT sucks but IPv6 having two different ways of assigning addresses (SLAAC and DHCPv6) with one of them being practically optional (Android doesn't do DHCPv6 for address assignment) does make IPv6 harder than it needs to be. Then there are crimes against network protocols like NAT66 that are borderline necessary in some situations because terrible ISPs have decided to dynamically alter IPv6 prefixes so they can charge extra for a static prefix. I still think NAT makes everything harder than it should be, but I get why some people struggle with IPv6 if their ISP is particularly terrible.
    - api 2y ago
      The sin of IPv6 was trying to do too much. They should have extended address sizes, period. SLAAC and most of the other extensions were a mistake. Everyone should bomb Android bug reports with complaints about lack of DHCPv6 until they fix it. Then people can de-facto deprecate SLAAC. AFAIK Android is the only major offender here. Some corporate networks already don't do SLAAC if they don't need Android to work on them.
      - raron 2y ago
        In that case ISPs would give you a single /126 and ask more money for extra devices, eg. /124 for a "family plan".
    - kstrauser 2y ago
      I don't generally care for Android but I'm glad they chose not to support DHCPv6. It's a nice forcing function to make network admins actually learn how SLAAC works and why they should almost certainly prefer it to DHCP.
- kstrauser 2y ago
  Maybe a long time ago, but just about everything I've used recently supports mDNS for LAN hostnames. If I add a computer named "foo" to the LAN, it's almost certain I can run "ping foo" on another computer 3 seconds later.
  - kllrnohj 2y ago
    that's not mDNS that's just dhcp+dns and it's something ipv6 actually breaks, which is part of the problem. DHCPv6 is optional, so local devices don't necessarily ever register their hostname nor do they necessarily ever consider your local DNS server.
    - amaccuish 2y ago
      >that's not mDNS that's just dhcp+dns Actually mDNS does exactly what they said just fine. You’re confusing it with the ability of a DHCP server to make updates in DNS on behalf of clients. There is more than one way to skin the cat. Both achieve the same affect, just differently. > nor do they necessarily ever consider your local DNS server. Hardcoded DNS servers are just as equally a thing with IPv4.
      - kstrauser 2y ago
        That's right. I'm specifically talking about mDNS, not DHCP+DNS. It works out of the box nearly all the time that I've tried it.
      - kllrnohj 2y ago
        mDNS would work just fine but the given command ('ping foo') wouldn't be using mDNS. That's just standard name resolution. `ping foo.local` would potentially use mDNS if you have a ping that does such a thing, but that's restricted to `.local` specifically. Rather, most routers add DHCP hostname requests to the local DNS routes. That doesn't require mDNS, nor would you want to replace it with mDNS as mDNS is more limited & flakier.
        2y ago
- kllrnohj 2y ago
  > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Possibly, but I think it's also that some aspects of IPv6 are just badly designed, and subsequent updates only fixed some of the issues. SLAAC, for example, is godawful stupid. And while DHCPv6 exists to fix some of that, critical aspects of the protocol, like prefix delegation, are manually configured. This is beyond idiotic and makes things like subnets massively more difficult than they have any right to be. SLAAC and PD combine to create the worst sin of all - flakiness. It's hard to figure out why IPv6 isn't working because everything is telling you it is (it "auto configured" a valid IP despite not having any actual route to anywhere else, so helpful! /s). If IPv6 was literally just "IPv4 but 128-bit addresses instead of 32-bit ones" it almost certainly would have been adopted en masse by now. But it isn't, it made things more fragile and harder to configure for no goddamn reason. And of course you then have ISPs doing silly stuff, like my ISP only gives me a /64 so I literally can't use IPv6 on my network since I want VLAN isolation. 18446744073709551615 possible addresses are given to me yet dividing that up into 3-5 subnets is completely impossible. Fucking stupid protocol.
  - api 2y ago
    Why is delegating smaller addresses impossible? Kernels will totally take /72, /88, /96, etc. without issue... or at least any OS I've ever used will.
    - kllrnohj 2y ago
      It breaks SLAAC so routers won't do it. Or if they do, it's non-standard and they won't easily let you do it. /64 is the smallest PD by spec ( RFC 5375 )
      - api 2y ago
        You can do it with DHCPv6, but of course there's Android. Android aside, it works fine. The core of V6 -- longer IPs -- is great. SLAAC and /64 being the smallest need to be deprecated. It's asinine. Really absolutely everything but longer IPs should be deprecated and was a mistake.
- lowercased 2y ago
  > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect. I've been convinced of this since around 2000. Every network utility dealing with IPv4 had... dotted quad addresses. You could remember them, you could read them, you could speak them to someone else. Brainwise, we can remember 3-5 things - segments, digits, etc. Remembering more is harder for the average person. Having the 6 be literally dotted sextant(?) - 5.73.192.168.0.4 for example - would have been much much much easier to transition in to, and would have given us 64k x 4 billion addresses. Yes, it's not the near infinity we have with IPv6, where apparently every molecule in the universe can have multiple IP addresses or whatever the max number is. But it would have been much much easier to transition. 27 years later we're not transitioned from ipv4, and we've got another 27 years of dotted quad baked in to daily usage everywhere.
  - kstrauser 2y ago
    That would have required exactly as much work to transition, plus require computers to get good at 48-bit math. ("Why are the top 2 bytes always 0xFF?" "I don't know, grandson, but I'm sure it seemed like a great idea before Y248.")
    - lowercased 2y ago
      I'd imagine many countries would claim a top spot or two, and transition all canadian addresses to, say, 7.0.0.0.0.0. Big companies would probably get some of their own. Legacy/default stuff would have leading 0.0, sure, but... so what? No, it wouldn't have taken 'exactly as much work to transition'. See another reply. In 2024, I'm still reading about BGP/routing table issues, and hardware having problems keeping up with IPv6 networking - it's just too large. How was this supposed to work in 1999? A smaller stepped transition from 4 billion addresses to... 64k of those would have been an easier transition step, and the ease - mental, UI, training, testing, security, etc would have given everyone involved the confidence and positive feedback to tackle a next stage to IPv6 (eventually).
  - yrro 2y ago
motorest 2y ago
> This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. Last time I've checked, some telecoms such as Vodafone didn't even supported IPv6 yet.
- baq 2y ago
  telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. b2b telecoms as a consequence also have at best zero incentive since if the consumer doesn't have ipv6, businesses don't need or want ipv6. the solution here, which will inevitably strike a nerve with some, is to have a regulatory mandate for ipv6. a soft version would start with 'government networks must run exclusively on ipv6, this applies to any and all contractors, including govclouds' and work upwards from there. I understand such policies were in place or at least planned; OTOH in the current political climate it'll be sort of a miracle if the existing ipv4 networks keep working.
  - yjftsjthsd-h 2y ago
    I was under the impression that cell carriers famously went all in on v6 because it saves them money?
    - kccqzy 2y ago
      Yes that don't have to allocate an IPv4 address for each customer or deploy ugly solutions like CGNAT. They simply cooperate with phone OS makers (Apple and Google) to make sure the OS and the apps work in an IPv6-only environment. Apple then forces app developers to make their app work in an IPv6+NAT64+DNS64 environment.
  - knorker 2y ago
    > telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. Not entirely true. 10/8 is only so big, so the management of addresses very much has a nonzero opex cost. And on top of that there's capex on "carrier grade NAT". For the biggest providers 10/8 is not even big enough for their production environment. And then they acquire some some company that (obviously) also uses 10/8. No, there's definitely incentive there. Just… not enough.
cyberax 2y ago
NAT is awesome. It automatically forces users to have a stateful border firewall that makes incoming connections impossible.
- bobbob1921 2y ago
  I second this, it forces security by default (at least keeping devices from being directly exposed)
- growse 2y ago
  NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.
  - cyberax 2y ago
    NAT _is_ a firewall. And it provides the same level of security as pretty much all of the "firewalls" marketed as such.
    - growse 2y ago
      No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.
      - mixmastamyk 2y ago
        I’ve never seen one without the other, so while technically correct, not useful to debate.
        growse 2y ago
        shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
johnea 2y ago
I don't disagree, but I would point out that one upside to every LAN being behind NAT, is that those LANs are also inherently firewalled. This is dependent on the firewall features of the NAT router, but at least its something, and the router provides one centralized point of protection from interent traffic. In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall. This complicates some intra-LAN communications, and removes the feature of having the LAN be a walled garden, mostly isolated from the interent.
- KAMSPioneer 2y ago
  Or you can implement a firewall on your gateway device with a default drop policy for inbound traffic. Essentially the same behavior as NAT in terms of unsolicited (usually malicious) inbound traffic, but without the downsides of one-to-many NAT. Which is, coincidentally, exactly how it works if your LAN is made up of devices with publicly-routable IPv4 addresses as well, which happens in business/academic/military networks all the time.
  - aboardRat4 2y ago
    But most users are not business academic military. They just want to watch some reels.
    - KAMSPioneer 2y ago
      And? Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. My point is that NAT isn't a security feature, and that firewalls in edge network equipment is table stakes these days.
      - aboardRat4 2y ago
        >Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. No they don't. Most ISP boxes only implement the bare minimum of functions to make sure that youtube is available to the users. Which includes NAT, because otherwise youtube does not work, and does not include anything else.

Arnavion 2y ago

(Title is sort of clickbait. The body is about how it isn't hard, but certain misconfigurations make it appear hard.) Note that curl itself also implements Happy Eyeballs if you don't force a particular protocol via `-4` or `-6`. You can see it in action with `curl -vvvv https://opentalk.mailbox.org https://opentalk.mailbox.org`. So you shouldn't look at the author's example and extrapolate that `curl github.com` or `curl opentalk.mailbox.org` will fail in an IPv6 environment.

ninkendo 2y ago

IPv6 isn't hard, and as the article alludes to, it is different, but it's not even that different. What is hard, is dual stack networking. Dual stack networking absolutely sucks, it's twice the stuff you have to deal with, and the edge cases are exponentially more complex because if your setup isn't identical in both stacks, you're going to hit weird issues (like the article suggests) with one stack behaving one way and the other behaving another way. None of this is the fault of IPv6, it's a natural consequence of the strategy of having two internets during the transition period. A transition period which has now been going on longer than the internet existed when it started. Maybe 100 years from now we'll finally be able to shut off the last IPv4 system and the "dream" of IPv6 will become a reality, but until then, life is strictly more difficult on every network administrator because of dual stack. (Note: no, we could not have done it any other way. Any upgrade strategy to IPv4 that extended the address size would have necessitated having two internets. It just sucks that it's been this long and we're still not even at 50% IPv6 usage.)

ninkendo 2y ago
To add: The really sad thing about IPv6 is that it's a relic of a bygone era. The internet was envisioned as a thing where every device on every network could, in principle, initiate a connection to any other device on any other network. But then we started running out of addresses, ISP's wouldn't give you more than one for a household, so we started doing NAT, and that kind of sealed the internet's fate. Nowadays, we wouldn't want a world where everything was connectable, even if we had enough addresses. Everyone's network in essence has a firewall. If you run IPv4 and using NAT, you're going to be dropping unsolicited incoming packets no matter what (let alone that you wouldn't know where to route them even if you wanted to let them through) and with IPv6 you'd be insane to allow them. Devices have "grown up" in a world where we expect the router we're connecting to, to shield us from incoming unsolicited traffic. I certainly don't have the firewall enabled on my linux desktop. Windows I _think_ has it enabled by default, but I often turn it off because I want LAN connections to work. MacOS is probably similar. Suffice to say, if the IPv6 dream happened overnight and everyone's devices were instantly connectable, all hell would break loose. We need our routers to disallow traffic. (Edit: This wasn't all that clear, so let me restate: In both the IPv4 and IPv6 world, you'd be insane to disallow incoming unsolicited traffic, which is why basically everyone blocks it in IPv6 as well as IPv4. I'm not trying to say IPv6 can't do this... quite the contrary: IPv6 routers absolutely do, and should, block unsolicited incoming traffic. But my point is that this is what prevents the original vision of IPv6 from becoming a reality: We can't design software around the idea of direct peer-to-peer communication, without stuff like UPnP. Oh, and UPnP works with NAT and IPv4 anyway so, there's the rub.) So, even in a pure-IPv6 world, that instantly prevents any startup with an idea to allow true peer-to-peer communication using end-to-end routability. What are you going to do, train your users to log into their router and enable traffic? Approximately 0% of your customers know how to do that, even in a counterfactual universe where IPv6 happened and we all have routable IP's on our devices. Maybe in such a universe, people would be trained to use local firewalls on their device, and say "ok" to popups asking if you want to let software through. But I'd wager that a lot of people would prefer the simplicity of just having their gateway drop the traffic for them. No, the "all devices are routable" idea came from a naive world where there wasn't a financial incentive for malicious behavior at every turn. Where there aren't millions of hackers waiting for an open port to an exploitable service they can use to encrypt all your data and ransom it for bitcoin. The internet is a dark forest now. We don't _want_ end-to-end connectivity.

finnigja 2y ago

Not hard, just different. Maybe the "harder" bit is actually remembering any one address. My IPv6 connectivity tester at https://ready.chair6.net https://ready.chair6.net is still doing its thing, twelve years since https://news.ycombinator.com/item?id=2154124 https://news.ycombinator.com/item?id=2154124. Looks like Hacker News has added support in five years since https://news.ycombinator.com/item?id=21382275 https://news.ycombinator.com/item?id=21382275.

miyuru 2y ago
I built a bit similar simple tool which tracks failed HTTP domains. https://v6check.miyuru.lk/ https://v6check.miyuru.lk/ will add a link to your site on the failed domains page.
remram 2y ago
What is the "IPv4 Literals" test?
- finnigja 2y ago
  Haven't look at that code for a while, but IIRC it does a simple HTTP request then checks the returned HTML for anything that looks like a v4 literal, eg. http://174.136.109.18 http://174.136.109.18.

api 2y ago

I am SO tired of "is hard." I cringe every time I see this boring cliche. It's a meaningless way of saying "look at me I'm smart." Everything is or is not hard depending on the audience and what it's being compared against. IPv6 is hard compared to Ethernet, but easy compared to managing a mess of NATs to handle V4 networks with conflicting addresses at different locations. All of this is a lot easier than understanding the leading proposed theories of quantum gravity.

cyberax 2y ago

IPv6 is really an example of a second-system syndrome. It really _is_ hard because it makes a lot of IPv4 conventions inapplicable. For example, if you want to do multi-homing with IPv6 for an SMB, you need to either do NAT (not great), or have your router advertise/whithdraw prefixes dynamically. If you do the prefix withdrawal, you can end up in a situation where your devices have _no_ prefixes. So even your internal functionality like printing or VoIP starts breaking. Great. Then there's ULA that is mis-prioritized. You'd think that simply adding a stable ULA prefix to all devices would solve the issue above, but that's not the case. The devices will prioritize the global IPv6 source address, so stuff can _still_ break.

chgs 2y ago
IPv4 and nat solved the problem quite nicely in the real world. IPv6 just yelled at people and said it wasn’t a problem.
nucleardog 2y ago
I have three connections at home both as a way to increase available bandwidth and also to provide some redundancy since I work from home and my ability to earn income is tied to my internet being up. I have two primary connections that I load balance between, each providing a /56. If either fails, all traffic goes to the other. I have a third connection that is used only as a backup in the event that both the other connections go down, providing a /64. So simple case, I assign an address from each connection out to each device. Except, whoops--the backup ISP only provides a /64 and despite that containing something like 18.5 quintillion addresses (a number so large my spell check is telling me it's not a real word), I can't actually split those up in any meaningful way so I can only allow _one_ subnet to access the internet via that connection. And then I'm pushing responsibility for load balancing between the two primary connections out to each client. You know, to the place with the _least_ useful information for making decisions in this situation. And then I need to figure out how to convince each device to make these decisions individually. (As far as I can tell, with an equal cost, Linux will simply use the most recently added address. So in the event that one of the primary connections is having issues and bouncing up and down, that's going to be the one that all the Linux devices choose to use preferentially. Absolutely what I'd want!) So I give everything a ULA (which I'd want to do anyway so my internet going down doesn't mean my TV can no longer stream media from the server across the house, since that's a reasonable thing to expect to happen) and then look at doing some sort of prefix translation. Except since nobody's using this stuff because it's so very not hard, I hit a bunch of weird edge cases in my network gear trying to do that. Not the least of which is that I need to statically configure the prefix I'm translating _to_ except that's not provided to me statically so now I need to set up some sort of script to monitor the prefix on the external interface and dynamically update my firewall rules? Oh, except apparently the RFC was only updated like a year and a half ago to prefer IPv6 ULA addresses over IPv4 so most devices would end up just using IPv4 anyway and the IPv6 deployment would be little more than a box checking exercise until everything's updated. (Though it looks like that change may never have been adopted anyway?) Last time I was digging in to this, I ended up down a path of starting to file forms with IANA to get a IPv6 block directly allocated so I could use a GUA internally (avoiding the preference issue), do prefix translation for load balancing, and announce the IP range from AWS and tunnel it to my router to work around the /64 issue on the backup connection. Or, or, or... hear me out... I can just... _not_. Nothing is broken right now. I derive no personal value or enjoyment from stacking up a house of cards I'll have to keep standing back up so my toaster can have a globally reachable internet address. People can tell me it's "not hard" all they want, but after... oh hell, 30 years of bending computers and networks to my will, I feel pretty confident in saying either: 1. It is hard; or 2. IPv6 is fundamentally unfit for purpose. I'd be happy for someone to come along and tell me I'm an idiot and _precisely why_ though. Really. Somebody. Please do. Tell me how I am supposed to make this work. I know it's a thing I _should_ be doing but I really can't figure out how.

thrdbndndn 2y ago

> So in the case of the toot mentioned above there is an AAAA for the FQDN. But the connection doesn’t work. But the end user doesn’t notice. Because there is a browser feature called Happy Eyeballs (HE). Basically: A browser tries both protocols and uses the faster on. In case of non-working IPv6 IPv4 is always faster. I mean even if there is no "Happy Eyeballs", it would still work for end users, no? Unlike `curl`, you don't specify -4 or -6 with browsers. Without HE, wouldn't (shouldn't?) it just try both in sequence? > HE can have some funny side effects. In a project a connection to a development web server sometimes worked and sometimes didn’t. The solution was quite simple. The customer used a split VPN tunnel. IPv4 was routed via the VPN tunnel and those IPv4 addresses were allowed in the web servers access list. IPv6 was routed via the normal Internet connection and those addresses weren’t allowed. This following sentence makes no sense, when the author literally said HE help it work when one IP family was broken and the other is not. So why would it work sometimes if IPv6 is consistently broken and IPv4 is not? (I'm not saying it won't happen; just that it shouldn't be "caused by HE" -- HE literally is the solution to this issue in general as the author said themselves!)

quuxberlin 2y ago
> I mean even if there is no "Happy Eyeballs", it would still work for end users, > no? No browsers and other clients prefer IPv6 and there would be a rather long timeout till the client falls back and tries IPv4. If it falls back. > So why would it work sometimes if IPv6 is consistently broken and IPv4 is not? > (I'm not saying it won't happen; just that it shouldn't be "caused by HE" -- HE > literally is the solution to this issue in general as the author said > themselves!) IPv6 wasn't broken. For HE, an HTTP 403 is a valid connection. TCP handshake works, IPv6 works. I had another case where the TCP handshake worked, and the browser decided to use IPv6 is good, but then came the TLS handshake, and it failed because PMTUD (Path MTU Discovery) was broken.

johnklos 2y ago

The "IPv6 is Hard" source seems to be sarcastic, not serious. IPv6 is ridiculously easy, in the grand scheme of things. What's hard is getting people who should know better to do what they're supposed to do, without playing games. The very fact that there are people who will argue why IPv6 is unnecessary tells us everything we need to know, because occasionally those people are in the path of deployment of something public. They don't write software which works agnostically with IPv6, they don't implement addressing that's stack agnostic, they don't bother taking the extra five minutes to test with IPv6. Then you have a corporation that requires manager types to have enough "justification" to actually fix whatever Mr.-IPv4-is-good-enough, and because they don't understand that their own phone uses IPv6 all the time, they don't see a "business case" for it. The title would be longer, but perhaps more accurate, if it were "Getting know-it-alls to stop stubbornly clinging to IPv4-is-good-enough and getting managers to realize that IPv6 is not only inevitable, but ubiquitous, are hard". This article's conclusion isn't totally off, but in this case it's something that could easily be fixed by having a junior network admin just simply set things up. It's a trivial problem that's probably there because someone thinks they know better.

kllrnohj 2y ago
> IPv6 is ridiculously easy, in the grand scheme of things. How do I do a guest wifi network with isolation? On ipv4 I just flip a switch and thanks to NATs it just works, always. With ipv6? First I have to figure out what prefix delegation my ISP gives me. How do I do that? Manually, somehow, and hope it never changes. Already not "ridiculously easy" at the first step. Oops, turns out I was given a /64. So now what? Please explain this "ridiculously easy" thing to me, thanks.
- kccqzy 2y ago
  Guest WiFi network isolation happens below the IP layer: you would use VLANs for that. Setting up a VLAN for the first time isn't ridiculously easy, but it's the same whether you are using IPv4 or IPv6.
  - kllrnohj 2y ago

sfblah 2y ago

I thought traceroute always used icmp.

wmf 2y ago
In theory it can use any protocol since TTL exceeded should work with any IP packet. I don't know if there's consistency between traceroute implementations so maybe some use ICMP and some use UDP.
- Hikikomori 2y ago
  Windows tracert uses icmp.
tremon 2y ago
Depends on whether you mean the tool of the technology. Yes, the common traceroute uses icmp, but since it has become very popular for transit networks to ignore echo requests, there's also tcp (e.g. lft) and udp (e.g. Cisco's default) traceroute tools.

betaby 2y ago

CGNAT is hard at scale, although very few operate it. On other hand IPv6 is easy.

stevenhuang 2y ago
What are you talking about? Tons of smaller isps use cgnat here in Canada.
- raaron773 2y ago
  Same in India.
- betaby 2y ago
  No, not really. Please name those ISPs specifically in Canada. Also my key point is 'hard at scale', in contrast to yours 'smaller isps'.
  - stevenhuang 2y ago
    Try all major isps for one. Bell Telus Rogers. Just Google it and you'll find tons of people dealing with this problem as they discover they can't host anything because they're natted and unreachable. I've lived in Canada for > 20 years in several cities and provinces. I'm telling you that CGNAT is extremely common. I don't think you have any idea what you're talking about.
    - betaby 2y ago
      Neither Bell,Rogers or Videotron use NAT for residential internet - one is getting a global unicast IPv4 on their home routers. (Some locations are dual stack, like mine residential connection) For mobile Bell uses 464XLAT. Bell mobility is IPv6 only network, also MPLS free, they are SRv6 early adopters, impressive! Rogers, Videotron mobile use NAT44 for IPv6. IPv6 is native on Rogers.
      - stevenhuang 2y ago

zerof1l 2y ago

I think that the main challenge people face with IPv6 is that they try to deal with it in the same way as with IPv4. IPv6 is not just a longer address, it's a completely different technology. It took me a very long time to figure out how to configure my docker containers on my home server to have global IPv6 addresses. But I did it, and it taught me a lot about IPv6. I would personally prefer for the internet to be IPv6 only. It would make certain things much easier like firewall rules, IP whitelisting, and no more stupid CGNAT.

akdor1154 2y ago

> So please: If you do IPv6 take it seriously. If you don’t take it seriously, don’t do IPv6. Amen - replace IPv6 in the above aphorism with $anything, and it's a great rule for running projects.

JoshTriplett 2y ago

The biggest piece of annoyance I have with IPv6: it's really hard to tell the OS "here's your IPv6 address, here's your gateway, here are your routes, now don't mess with any of it!". With IPv4 it's easy to set up a static configuration. With IPv6, the Linux kernel is eager to listen to all sorts of advertisements from the network, and it's hard to say "no, stop, don't ever ever listen to anything except my static configuration". I can bring up IPv4 networking in a tiny fraction of a second. IPv6 networking sometimes takes seconds to settle down and be reliable. (I'd be interested in any suggestions for how to improve this.)

teddyh 2y ago
In your /etc/sysctl.d/local.conf: net.ipv6.conf.default.accept_dad=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.default.autoconf=0 Or, in your network startup script (like Debian’s /etc/network/interfaces): sysctl -w net.ipv6.conf.default.accept_dad=0 sysctl -w net.ipv6.conf.default.accept_ra=0 sysctl -w net.ipv6.conf.default.autoconf=0 Or, in your /etc/systemd/network/en0whatever.network: [Network] IPv6AcceptRA=false IPv6DuplicateAddressDetection=0
- Dagger2 2y ago
  Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd also argue that you should prefer automatic config over static in general. RAs can set your default route correctly and you can use `ip token` if you really need SLAAC to give you a specific address. I think it's better to be able to just connect machines and have them get the right config rather than need to hand-craft it on each one.
  - JoshTriplett 2y ago
    For most cases I agree that automatic configuration is the right answer. In this case I'm bringing up virtual machines, as fast as possible, and static is inherently faster and more predictable. Automatic configuration isn't compatible with literally counting milliseconds.

acedTrex 2y ago

The github curl worked for me? curl -6 https://github.com -o /dev/null % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 273k 0 273k 0 0 957k 0 --:--:-- --:--:-- --:--:-- 956k

aboardRat4 2y ago
That's the worst part of the problem. Sometimes it works, sometimes it doesn't.
tambre 2y ago
You're on an network with DNS64 and NAT64 as its IPv4 compatibility mechanism probably.
raaron773 2y ago
It didnt work for me.

Havoc 2y ago

I’ve taken to just disabling it. I’d prefer to keep it on but every time I try it I run into a bunch of odd bugs. Silly stuff like GitHub container registry pulls being dialup speeds but docker.io being fine. Disable ipv6 and both at gigabit speeds. Bizarre stuff like that which I just don’t have the time and energy to go spelunking into the mysteries of dual stack to untangle. (Out of the box opnsense)

miyuru 2y ago
you might be having issues connecting to faslty. afk ghcr uses fastly and docker uses cloudflare.

donor20 2y ago

The big issue I've seen is that there are not clear wins for all the pain of IPv6. And the failure to provide a much much better ipv4 interop story out the gate (vs just trying to yell at everyone to switch) was a big big loss. So that means folks ended up having to run ipv4 to end devices in many cases and we have dual stack hell across the network. For the 90%+ of network clients on-prem that play by the rules you are often supporting both DHCP and SLAAC on IPv6 networks (unless android has figured out DHCP). Dual WAN redundancy on IPv6 in SMB settings is actually worse relative to a NAT and ipv6. The subnet size /64 is stupidly large, and the number of available subnets you can easily get annoyingly small from most upstream providers. Firewall filtering has to be modified or you get weird errors. People don't always like ICMP coming through the firewall. It's does lots of things differently, but for what? We do prefix delegation with DHCP but can't use DHCP to assign address (we are supposed to use SLAAC) but still need DHCP for lots of other stuff? It's nonsensical - you end up with just way too much garbage. The privacy extension stuff hits IPv6 hard. You have lots of auto-rotating addresses. The number of times turning of IPv6 fixes weird glitches / timeouts / stalls etc is still crazy too me. ATT (massive corp) requires end user devices request /64 subnets one by one - which most end user gear does not support. Getting static ipv6 IP's (despite claims there are lots of them) is seriously hard from upstream providers in many cases - but IPv4 is trivial by comparison. The list goes on. I would have made the subnet size 32 bits. Expanded the network part. Maybe even reduced the overall size - 128 bits feel dumb with /64's as the smallest subnet? Then just go super high interop / overlay to IPv4 with great suggestions so folks could ship ipv6 only stuff (even with on device bridge to ipv4 so outbound interface is ipv6) and no new concepts unless clearly justified.

muhammadn 2y ago

As per the article mentions of resolving AAAA IPv6 records, a feature was just merged into Linux's systemd-resolved last week. https://github.com/systemd/systemd/pull/34165 https://github.com/systemd/systemd/pull/34165 So you can do. RefuseRecordTypes=AAAA So there, your DNS won't ever query for IPv6 AAAA records. (in fact you can refuse any DNS questions like MX, SRV, TXT as well with: RefuseRecordTypes=MX SRV TXT) Note - I started adding that feature because some applications were "misbehaving" and querying AAAA records when IPv6 stack was disabled.

miyuru 2y ago
can it do `RefuseRecordTypes=A` as well?

AtlasBarfed 2y ago

So is CGNAT "real" ipv6? Asking for a friend, like, what all the ipv6 use in the world is. I'm curious. On the other side of CGNAT, you know, the mobiles, can they individually address each other, or can they only talk to each other through the CGNAT? I honestly don't know.

UltraSane 2y ago

One thing I like about IPv6 is the lack of CIDR so that every IPv6 address always has the same 48 bit site prefix and then 16 bits of subnets and than 64 bits of host. It is easy to remember the 48 bit prefix and then you can actually just sequentially number subnets and hosts if you want so an address can be prefix:1:1 if you want. One thing I hate about it is that they used 64 bits for host which is just absurd. 32 bits or even 16 bits would have been plenty for a single broadcast domain.

Dagger2 2y ago
The 64-bit host space is used by SEND to hold a cryptographic key as part of a method of securing neighbor discovery. 16 or 32 bits would be laughably inadequate for that. It's also used as a passive defence against IP scanning, making it significantly harder for worms to spread by brute-force scanning. I admit it does make the address space look a bit lop-sided, but taking bits away from the host side (where they're being used) and giving them to the network side (where we should already have enough space anyway) wouldn't be a sensible trade.
- UltraSane 2y ago
  That is a clever hack made necessary by the lack of crypto as part of the IPv6 protocol like it should have been. If they were more ambitious they would have built something like the Locator/ID Separation Protocol (LISP) (RFC 6830) directly into IPv6 but used public keys as the ID.

qwertox 2y ago

> If you don’t take it seriously, don’t do IPv6. Which is why I deactivated IPv6 on almost every device in my network. My main issue is that the router/gateway provided by my ISP does not support DHCPv6 prefix delegation, which causes a couple of issues in my setup. Sometimes you can try really hard to archive a goal, but when the workarounds to simple problems become new problems, it's time to say "no".

wink 2y ago

If everyone supported it, IPv6 wouldn't be hard. Working with IPv6 if you are not entitled to switch out every vendor, every piece of hardware, every piece of software that is lacking.. that's the hard part. In short: reality is hard.

lakomen 2y ago

[dead]

lofaszvanitt 2y ago

ipv6 has this bullshit smell. bullshit, because it has this fucking useless naming convention (it's not for humans...) and overly complicated. like it was invented to muddle things about the internet, to raise the bar to understand it and hence coerce control. it resembles something that is not man made or deliberately made to be hard to use.

roody15 2y ago

In my career I have found IPv6 simply to be unnecessary. Running a network of 7 buildings with approximately 2,300 computers for now almost 2 decades and this is still true. Setting edge routers to simply drop all ipv6 packets and running only ipv4 works, is simpler, is faster (than dual stack) and easier to troubleshoot. I don’t have any inheritant issues with IPv6 other than is has failed to make a case for why people like me should bother rolling it out.

UltraSane 2y ago
I've worked at companies big enough to start running out of private IPs. That isn't fun.
akvadrako 2y ago
Although it sounds like keeping IPv4 is a reasonable choice in your situation, if you merge with another company (or otherwise connect your networks) that uses overlapping private IPs it will cause issues.
- diggan 2y ago
  > , if you merge with another company (or otherwise connect your networks) that uses overlapping private IPs it will cause issues. Wouldn't this be true with IPv6 as well, assuming that both companies happened to have chosen some overlapping ranges?
  - remram 2y ago
    You don't "choose" your IPv6, they are assigned to you. Even if you used private IPs (ULA) for whatever reason, there are enough of those too not to conflict. By comparison my company uses the entirety of the private IPv4 space. `docker compose up` often fails because there is no private IP range left that is not directed through the VPN.
impeplague 2y ago
For your use case is fine today IPv4. In my case, I would love to get rid of my CGNAT IPv4 ISP address and use only IPv6.

citrin_ru 2y ago

It's surprising to that all comments (except a few) state that IPv6 is not hard. I'm not an IPv6 expert but I did spend time learning it (may be even more than I spent on IPv4 but with v4 I have more practical experience). I used v6 for a few years at home / home lab (and for a side project). I think IPv6 is hard - there is much more one needs to know to use it well than in case of v4. Any deviation from a happy path (a non-standard configuration / use case) is a pain (or at least it was 10 years ago, don't think it is much better now except now we likely have even more RFC to learn). Not used IPv6 recently so cannot name specific problems but I didn't enjoy working with it at all. Will do it again only if it will be well compensated.

nottorp 2y ago
> Any deviation from a happy path (a non-standard configuration / use case) is a pain I've posted here before about my home network with two internet connections. Not going to whine about it again, except restate that i basically have no idea what to do about it with ipv6.
magicalhippo 2y ago
I think there's a big difference between enterprise IT folks who can specify hardware with good IPv6 support, and which are able to switch internet providers if they don't support IPv6 well. It's entirely a different thing for home users which get handed some shitty router from the only ISP around. My options are cable or long-distance ADSL. The cable ISP has dynamic prefix, so I get a new prefix every week or so. If you contact them regarding IPv6 there's zero support, I had to find the prefix length by trial and error. So much software relies on the prefix being fixed, so this can lead to a lot of frustration. On the bright side I actually get a prefix, some just get a /64. IPv6 might not be hard, but using IPv6 might indeed be hard.
- cylemons 2y ago
  > On the bright side I actually get a prefix, some just get a /64 what's the difference?

kpcyrd 2y ago

I run a ghcr proxy server to avoid having to rent an ipv4 address just to pull the container images I build with github actions: docker pull ghcr.proxy.orca.toys/kpcyrd/apt-swarm:edge My services are often run behind cloudflare, who does ipv4 for me and proxies to my ipv6-only vps. Should you use this? Well docker's security model is pretty much only https, so it's like using a proxy server from some random hackernews comment for your `curl|sh` needs, without end-to-end encryption. I wish github would just step up their game, at least for ghcr.io.

JansjoFromIkea 2y ago

Considering in the UK you can get sim cards with 10GB or so of data for pennies I'm a bit surprised I don't hear much about people doing old school self hosted direct access stuff over ipv6. Would there be much of a security risk if you had a dedicated device on its own network that doesn't actually directly communicate with anything else in your home?

1970-01-01 2y ago

The issue with IPv6 is that it's just too big; IETF overcompensated. Exponential growth really didn't occur "as planned" and addresses are barely readable to humans. 2^64 would have been better. That's something you can code using just 0-9 and no human will be forced to recite a never ending hexadecimal string.

vaylian 2y ago
> 2^64 would have been better. That's something you can code using just 0-9 That doesn't make any sense. 0-9 is base ten while 2^64 is base two.

deleted 2y ago

[deleted]

selfhoster 2y ago

IPv6 is mainly only wanted by people whose job it is to track people. In any IPv6 discussion they yell, flap their virtual arms and gums and attack any non-IPv6 true believers.

sujaldev 2y ago

Off-topic but I'm curious why would someone purposely left-align a website? It makes no sense unless you're _really_ trying to avoid css which is not the case here.