6 ms·

This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. If anyt

• api 2y ago
  "Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect.
  • knorker 2y ago
    > "Hard" for many is "unfamiliar." IPv4 plus NAT and all that ugliness is the devil we know. Indeed. I meant that if evaluating the two de novo, IPv4+NAT is harder.
    • jeroenhd 2y ago
      I agree that NAT sucks but IPv6 having two different ways of assigning addresses (SLAAC and DHCPv6) with one of them being practically optional (Android doesn't do DHCPv6 for address assignment) does make IPv6 harder than it needs to be. Then there are crimes against network protocols like NAT66 that are borderline necessary in some situations because terrible ISPs have decided to dynamically alter IPv6 prefixes so they can charge extra for a static prefix. I still think NAT makes everything harder than it should be, but I get why some people struggle with IPv6 if their ISP is particularly terrible.
      • api 2y ago
        The sin of IPv6 was trying to do too much. They should have extended address sizes, period. SLAAC and most of the other extensions were a mistake. Everyone should bomb Android bug reports with complaints about lack of DHCPv6 until they fix it. Then people can de-facto deprecate SLAAC. AFAIK Android is the only major offender here. Some corporate networks already don't do SLAAC if they don't need Android to work on them.
        • raron 2y ago
          In that case ISPs would give you a single /126 and ask more money for extra devices, eg. /124 for a "family plan".
      • kstrauser 2y ago
        I don't generally care for Android but I'm glad they chose not to support DHCPv6. It's a nice forcing function to make network admins actually learn how SLAAC works and why they should almost certainly prefer it to DHCP.
  • kstrauser 2y ago
    Maybe a long time ago, but just about everything I've used recently supports mDNS for LAN hostnames. If I add a computer named "foo" to the LAN, it's almost certain I can run "ping foo" on another computer 3 seconds later.
    • kllrnohj 2y ago
      that's not mDNS that's just dhcp+dns and it's something ipv6 actually breaks, which is part of the problem. DHCPv6 is optional, so local devices don't necessarily ever register their hostname nor do they necessarily ever consider your local DNS server.
      • amaccuish 2y ago
        >that's not mDNS that's just dhcp+dns Actually mDNS does exactly what they said just fine. You’re confusing it with the ability of a DHCP server to make updates in DNS on behalf of clients. There is more than one way to skin the cat. Both achieve the same affect, just differently. > nor do they necessarily ever consider your local DNS server. Hardcoded DNS servers are just as equally a thing with IPv4.
        • kstrauser 2y ago
          That's right. I'm specifically talking about mDNS, not DHCP+DNS. It works out of the box nearly all the time that I've tried it.
        • kllrnohj 2y ago
          mDNS would work just fine but the given command ('ping foo') wouldn't be using mDNS. That's just standard name resolution. `ping foo.local` would potentially use mDNS if you have a ping that does such a thing, but that's restricted to `.local` specifically. Rather, most routers add DHCP hostname requests to the local DNS routes. That doesn't require mDNS, nor would you want to replace it with mDNS as mDNS is more limited & flakier.
          • 2y ago
  • kllrnohj 2y ago
    > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Possibly, but I think it's also that some aspects of IPv6 are just badly designed, and subsequent updates only fixed some of the issues. SLAAC, for example, is godawful stupid. And while DHCPv6 exists to fix some of that, critical aspects of the protocol, like prefix delegation, are manually configured. This is beyond idiotic and makes things like subnets massively more difficult than they have any right to be. SLAAC and PD combine to create the worst sin of all - flakiness. It's hard to figure out why IPv6 isn't working because everything is telling you it is (it "auto configured" a valid IP despite not having any actual route to anywhere else, so helpful! /s). If IPv6 was literally just "IPv4 but 128-bit addresses instead of 32-bit ones" it almost certainly would have been adopted en masse by now. But it isn't, it made things more fragile and harder to configure for no goddamn reason. And of course you then have ISPs doing silly stuff, like my ISP only gives me a /64 so I literally can't use IPv6 on my network since I want VLAN isolation. 18446744073709551615 possible addresses are given to me yet dividing that up into 3-5 subnets is completely impossible. Fucking stupid protocol.
    • api 2y ago
      Why is delegating smaller addresses impossible? Kernels will totally take /72, /88, /96, etc. without issue... or at least any OS I've ever used will.
      • kllrnohj 2y ago
        It breaks SLAAC so routers won't do it. Or if they do, it's non-standard and they won't easily let you do it. /64 is the smallest PD by spec ( RFC 5375 )
        • api 2y ago
          You can do it with DHCPv6, but of course there's Android. Android aside, it works fine. The core of V6 -- longer IPs -- is great. SLAAC and /64 being the smallest need to be deprecated. It's asinine. Really absolutely everything but longer IPs should be deprecated and was a mistake.
  • lowercased 2y ago
    > I'm also convinced that the length of IPv6 addresses and the difficulty in typing them is a major reason for lack of adoption. Very seemingly small UX annoyances can have a large effect. I've been convinced of this since around 2000. Every network utility dealing with IPv4 had... dotted quad addresses. You could remember them, you could read them, you could speak them to someone else. Brainwise, we can remember 3-5 things - segments, digits, etc. Remembering more is harder for the average person. Having the 6 be literally dotted sextant(?) - 5.73.192.168.0.4 for example - would have been much much much easier to transition in to, and would have given us 64k x 4 billion addresses. Yes, it's not the near infinity we have with IPv6, where apparently every molecule in the universe can have multiple IP addresses or whatever the max number is. But it would have been much much easier to transition. 27 years later we're not transitioned from ipv4, and we've got another 27 years of dotted quad baked in to daily usage everywhere.
    • kstrauser 2y ago
      That would have required exactly as much work to transition, plus require computers to get good at 48-bit math. ("Why are the top 2 bytes always 0xFF?" "I don't know, grandson, but I'm sure it seemed like a great idea before Y248.")
      • lowercased 2y ago
        I'd imagine many countries would claim a top spot or two, and transition all canadian addresses to, say, 7.0.0.0.0.0. Big companies would probably get some of their own. Legacy/default stuff would have leading 0.0, sure, but... so what? No, it wouldn't have taken 'exactly as much work to transition'. See another reply. In 2024, I'm still reading about BGP/routing table issues, and hardware having problems keeping up with IPv6 networking - it's just too large. How was this supposed to work in 1999? A smaller stepped transition from 4 billion addresses to... 64k of those would have been an easier transition step, and the ease - mental, UI, training, testing, security, etc would have given everyone involved the confidence and positive feedback to tackle a next stage to IPv6 (eventually).
    • yrro 2y ago
• motorest 2y ago
  > This is a response to what appears to be a complaint that IPv6 is not treated as a first class citizen by some providers, not literally that it's hard. Last time I've checked, some telecoms such as Vodafone didn't even supported IPv6 yet.
  • baq 2y ago
    telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. b2b telecoms as a consequence also have at best zero incentive since if the consumer doesn't have ipv6, businesses don't need or want ipv6. the solution here, which will inevitably strike a nerve with some, is to have a regulatory mandate for ipv6. a soft version would start with 'government networks must run exclusively on ipv6, this applies to any and all contractors, including govclouds' and work upwards from there. I understand such policies were in place or at least planned; OTOH in the current political climate it'll be sort of a miracle if the existing ipv4 networks keep working.
    • yjftsjthsd-h 2y ago
      I was under the impression that cell carriers famously went all in on v6 because it saves them money?
      • kccqzy 2y ago
        Yes that don't have to allocate an IPv4 address for each customer or deploy ugly solutions like CGNAT. They simply cooperate with phone OS makers (Apple and Google) to make sure the OS and the apps work in an IPv6-only environment. Apple then forces app developers to make their app work in an IPv6+NAT64+DNS64 environment.
    • knorker 2y ago
      > telecoms that deal with consumers have at best 0 (zero) incentive to deploy ipv6 unless there's regulatory pressure. Not entirely true. 10/8 is only so big, so the management of addresses very much has a nonzero opex cost. And on top of that there's capex on "carrier grade NAT". For the biggest providers 10/8 is not even big enough for their production environment. And then they acquire some some company that (obviously) also uses 10/8. No, there's definitely incentive there. Just… not enough.
• cyberax 2y ago
  NAT is awesome. It automatically forces users to have a stateful border firewall that makes incoming connections impossible.
  • bobbob1921 2y ago
    I second this, it forces security by default (at least keeping devices from being directly exposed)
  • growse 2y ago
    NAT does not, in any way, "force" the use of a firewall. They're entirely separate concepts.
    • cyberax 2y ago
      NAT _is_ a firewall. And it provides the same level of security as pretty much all of the "firewalls" marketed as such.
      • growse 2y ago
        No... it's not? It's simply a widely-used technique to rewrite the addresses of IP packets that transit a router. It inherently makes no policy decisions on which packets should and shouldn't flow over and above what a router does anyway.
        • mixmastamyk 2y ago
          I’ve never seen one without the other, so while technically correct, not useful to debate.
          • growse 2y ago
            shrug at work we use NAT to let two different networks with overlapping addresses talk to each other all the time. No firewalls there. NAT wasn't invented for the home-broadband user, you know. But I'm at least glad we've cleared up the myth that NAT provides any security benefit when, in fact, it's the often deployed accompanying stateful firewall that's actually providing this.
• johnea 2y ago
  I don't disagree, but I would point out that one upside to every LAN being behind NAT, is that those LANs are also inherently firewalled. This is dependent on the firewall features of the NAT router, but at least its something, and the router provides one centralized point of protection from interent traffic. In IPv6 typically every machine on a LAN is directly connected to the internet with a public IP address. Every one of those machines now needs a full strength internet firewall. This complicates some intra-LAN communications, and removes the feature of having the LAN be a walled garden, mostly isolated from the interent.
  • KAMSPioneer 2y ago
    Or you can implement a firewall on your gateway device with a default drop policy for inbound traffic. Essentially the same behavior as NAT in terms of unsolicited (usually malicious) inbound traffic, but without the downsides of one-to-many NAT. Which is, coincidentally, exactly how it works if your LAN is made up of devices with publicly-routable IPv4 addresses as well, which happens in business/academic/military networks all the time.
    • aboardRat4 2y ago
      But most users are not business academic military. They just want to watch some reels.
      • KAMSPioneer 2y ago
        And? Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. My point is that NAT isn't a security feature, and that firewalls in edge network equipment is table stakes these days.
        • aboardRat4 2y ago
          >Most consumer routers also implement a stateful firewall with deny-by-default inbound policy. No they don't. Most ISP boxes only implement the bare minimum of functions to make sure that youtube is available to the users. Which includes NAT, because otherwise youtube does not work, and does not include anything else.