4 ms·

Adding two extra bits to each octet, making each octet range from a still memorable 0-1023 rather than 0-255, would result in an addressing scheme 256x larger t

Adding two extra bits to each octet, making each octet range from a still memorable 0-1023 rather than 0-255, would result in an addressing scheme 256x larger than all of IPv4 combined. The entire internet works fine even when IPv4 was nominally exhausted. NAT and CGNAT are not sins, they're not crimes, and there's no rational reason to be as disgusted with them as IPv6 fans are. Even then, IPv4 exhaustion wasn't really a true technical problem in the first place, it was an allocation problem. There are huge /8 blocks of public IPv4 space that remain almost entirely unused to this day. The reason I'm an IPv4 advocate in the IPv4/IPv6 war is that the problem was "we're out of address", not "your thermostat should be natively routable from every single smartphone on the planet by default and inbound firewalls should become everyone's responsibility to configure for every device they own". CGNAT is a feature, not a bug. Blending in with the crowd with a dynamic WAN IP is a helpful boost to privacy, even if not a one-stop solution. IPv6 giving everyone a globally unique, stable address by default is a regression in everyone's default privacy, and effectively a death sentence for the privacy of non-technical users who aren't capable of configuring privacy extensions. It's a wet dream for shady data brokers, intelligence agencies, organized crime, and script kiddies alike - all adversaries / attackers in threat modelling scenarios. IPv6 adds configuration surface I don't want. Privacy extensions, temporary addresses, RA flags, NDP, DHCPv6 vs SLAAC — these are problems I don't have with IPv4. More features means more opportunities to footgun with misconfigurations, being forced to waste my time learning and understanding the nuances of each (in again, what amounts to system I want nothing to do with). "Reaching your own stuff" is already a solved problem, too. Tailscale/Headscale gives you authenticated, encrypted, NAT-traversing connectivity. It's better than being globally routable. It's also opt-in for anyone who wants it, and not forced on anyone, unlike the IPv6 transition.

thfuran 7mo ago
>"Reaching your own stuff" is already a solved problem, too. Tailscale/Headscale IPv6 predates those by decades.
teo_zero 7mo ago
Saying that IPv4 is ok because we have NAT and CGNAT is like saying that spam is not a problem because we have spam filters everywhere.
hbogert 7mo ago
I don't have your problems with ipv6, and I'm actively using it. I don't have to rely on extra commercial entities to be able to reach my network. I did have a problem with hosting my own shit because my ISP by default does cgnat. That cost me an hour of my life to convince a party to give what used to be normal, end to end connectivity.
- anonym29 7mo ago
  The tailscale client and the headscale server are both open source, you don't need to rely on commercial entities.
  - hbogert 7mo ago
    yes you do, the control plane is closed. Only reverse engineered by the headscale project. The control plane is necessary for the peers to find each other. If you need to rely on such a crucial part being reverse-engineered, than yes, I think it's fair to say you are ultimately relying on commercial entities.
    - anonym29 7mo ago
      Headscale is open source and it already works. You don't need to rely on anyone to use it, or even to improve it.
simonra 7mo ago
Wouldn't easy and accessible self-hosting be a major privacy win if that's your primary concern? Sounds much more private to run a Minecraft and Mumble server on an old laptop in a friend group than paying a commercial entity like a hosting provider to know about it and have a back door.
- anonym29 7mo ago
  Easy and accessible self hosting isn't the primary concern. It's much more private and secure to run that Minecraft or Mumble server on an encrypted overlay network like via headscale + tailscale rather than exposing both services directly to the entire planet. But again, the primary concern was only ever address space.
  - simonra 7mo ago
    What I tried to express was privacy being the primary concern. The easy and accessible self-hosting on old hardware would be the uses of a home network beyond superficialities like consumption and commerce. Privacy wise headscale as a solution is still not quite there, because it either necessitates an additional third party to host the headscale server and know about all my friends, or jank like dynDNS. The additional security gained by getting everyone involved to set up and configure separate VPNs for different community utilities is not worth it.
mrsssnake 7mo ago
> NAT and CGNAT are not sins Highly disagree. Middleboxes are a huge problem on global scale and have frozen any innovation below application layer. TCP and UDP even that they are on software not hardware layer cannot be updated or changed, see MPTCP efforts or QUIC giving up and building on top of UDP. If this is so much privacy problem, IPv6 is there for many years reaching 50%+ deployments in some countries, I bet there should be concrete examples of such breaches and papers written. > Reaching your own stuff is already a solved problem, too. Tailscale/Headscale No address to receive communication - no problem install an app that would proxy it through someone who has the address. Tailscale/Headscale is great, using it daily, but they are not solution to the huge already build global network created to connect devices not connecting devices because lack of digits. Global is key here.
apitman 7mo ago
I disagree wrt NAT. It creates huge problems for many p2p applications.
- M95D 7mo ago
  I wouldn't call port forwarding "huge problems". It's only one minor router setting and if you don't want to deal with it, there's the abomination called upnp.
  - vel0city 7mo ago
    > I wouldn't call port forwarding "huge problems". Port forwarding has massive problems if you're running applications expecting certain ports and need multiple hosts to have public access to those ports.
    - M95D 6mo ago
      I can't think of any application that needs "certain ports" and it's not a public server application. Why would a home net have a public server app? And why would it have more than one? Public servers would use a firewall, a load balancer, possibly a reverse proxy that does TLS too, between the internet and real app servers anyway. If anyone needs to host multiple servers from their home net, I would expect them to know this.
      - vel0city 6mo ago
        Maybe I've got a media server with a web interface, my owncloud instance, a web UI to my SDRs, and some other web app I'd like to have public. Now I need a reverse proxy as well, yet another piece of infrastructure to maintain. Trying to firewall it so only my friend's house can use the media server and I can connect to the owncloud from the office and thenSDR from anywhere is messier and more complicated. Or I can just have each device have its own public firewall rules and not have to maintain a reverse proxy as well and deal with its own complications. I've had game consoles with matchmaking issues with multiple consoles fighting over the same collection of ports

thfuran 7mo ago

>"Reaching your own stuff" is already a solved problem, too. Tailscale/Headscale IPv6 predates those by decades.

teo_zero 7mo ago

Saying that IPv4 is ok because we have NAT and CGNAT is like saying that spam is not a problem because we have spam filters everywhere.

hbogert 7mo ago

I don't have your problems with ipv6, and I'm actively using it. I don't have to rely on extra commercial entities to be able to reach my network. I did have a problem with hosting my own shit because my ISP by default does cgnat. That cost me an hour of my life to convince a party to give what used to be normal, end to end connectivity.

anonym29 7mo ago
The tailscale client and the headscale server are both open source, you don't need to rely on commercial entities.
- hbogert 7mo ago
  yes you do, the control plane is closed. Only reverse engineered by the headscale project. The control plane is necessary for the peers to find each other. If you need to rely on such a crucial part being reverse-engineered, than yes, I think it's fair to say you are ultimately relying on commercial entities.
  - anonym29 7mo ago
    Headscale is open source and it already works. You don't need to rely on anyone to use it, or even to improve it.

simonra 7mo ago

Wouldn't easy and accessible self-hosting be a major privacy win if that's your primary concern? Sounds much more private to run a Minecraft and Mumble server on an old laptop in a friend group than paying a commercial entity like a hosting provider to know about it and have a back door.

anonym29 7mo ago
Easy and accessible self hosting isn't the primary concern. It's much more private and secure to run that Minecraft or Mumble server on an encrypted overlay network like via headscale + tailscale rather than exposing both services directly to the entire planet. But again, the primary concern was only ever address space.
- simonra 7mo ago
  What I tried to express was privacy being the primary concern. The easy and accessible self-hosting on old hardware would be the uses of a home network beyond superficialities like consumption and commerce. Privacy wise headscale as a solution is still not quite there, because it either necessitates an additional third party to host the headscale server and know about all my friends, or jank like dynDNS. The additional security gained by getting everyone involved to set up and configure separate VPNs for different community utilities is not worth it.

mrsssnake 7mo ago

> NAT and CGNAT are not sins Highly disagree. Middleboxes are a huge problem on global scale and have frozen any innovation below application layer. TCP and UDP even that they are on software not hardware layer cannot be updated or changed, see MPTCP efforts or QUIC giving up and building on top of UDP. If this is so much privacy problem, IPv6 is there for many years reaching 50%+ deployments in some countries, I bet there should be concrete examples of such breaches and papers written. > Reaching your own stuff is already a solved problem, too. Tailscale/Headscale No address to receive communication - no problem install an app that would proxy it through someone who has the address. Tailscale/Headscale is great, using it daily, but they are not solution to the huge already build global network created to connect devices not connecting devices because lack of digits. Global is key here.

apitman 7mo ago

I disagree wrt NAT. It creates huge problems for many p2p applications.

M95D 7mo ago
I wouldn't call port forwarding "huge problems". It's only one minor router setting and if you don't want to deal with it, there's the abomination called upnp.
- vel0city 7mo ago
  > I wouldn't call port forwarding "huge problems". Port forwarding has massive problems if you're running applications expecting certain ports and need multiple hosts to have public access to those ports.
  - M95D 6mo ago
    I can't think of any application that needs "certain ports" and it's not a public server application. Why would a home net have a public server app? And why would it have more than one? Public servers would use a firewall, a load balancer, possibly a reverse proxy that does TLS too, between the internet and real app servers anyway. If anyone needs to host multiple servers from their home net, I would expect them to know this.
    - vel0city 6mo ago
      Maybe I've got a media server with a web interface, my owncloud instance, a web UI to my SDRs, and some other web app I'd like to have public. Now I need a reverse proxy as well, yet another piece of infrastructure to maintain. Trying to firewall it so only my friend's house can use the media server and I can connect to the owncloud from the office and thenSDR from anywhere is messier and more complicated. Or I can just have each device have its own public firewall rules and not have to maintain a reverse proxy as well and deal with its own complications. I've had game consoles with matchmaking issues with multiple consoles fighting over the same collection of ports