6 ms·

Do we know any technical reason for this? Or are we left to think this is somehow a political thing?

denkmoon 7mo ago
Outdated beliefs probably. When I talk about v6 support in our b2b saas, PM laughs and says nobody uses that shit. Big tech are massive laggards on this funnily enough.
- ViscountPenguin 7mo ago
  It's because big tech is USA based mostly, where there's still a glut of ipv4 available.
  - FuriouslyAdrift 7mo ago
    IPv4 was exhausted at ARIN in 2011. Last time I bought a /24 on the open market, it was around $6k. I assume it is much more, now.
    - Dylan16807 7mo ago
      It's close to that right now. Prices more than doubled as covid set in, then dropped back down to about where they were before.
  - paulddraper 7mo ago
    Where can I get it, asking for a friend?
- 10000truths 7mo ago
  Definitely not for the biggest ones. Google and Meta have so many machines in their data centers that IPv6 addressing becomes a technical necessity due to the risk of exhausting the RFC 1918 address space. Naturally, they were early adopters of IPv6.
  - denkmoon 7mo ago
    Yeah, I can't imagine managing fleets like that with only v4. Our network config is so convoluted with gateways and NATs everywhere, paying AWS through the nose for it all, when it could all be so much simpler.
- throw0101d 7mo ago
  > Outdated beliefs probably. When I talk about v6 support in our b2b saas, PM laughs and says nobody uses that shit. Nobody except the 140M subscribers on T-Mobile US's network: * https://www.youtube.com/watch?v=d6oBCYHzrTA https://www.youtube.com/watch?v=d6oBCYHzrTA But sure, be IPv4-only and add latency by forcing traffic through an extra translation box.
- paulddraper 7mo ago
  Well it’s over 50%…
direwolf20 7mo ago
It could be that they don't want to implement IP bans in IPv6.
- c0balt 7mo ago
  Or the most likely more expensive rate limiting (computational wise)
  - michh 7mo ago
    I mean, given how the site performs on average I don't think they've optimized so much that the extra cpu cycles of ANDing with the fixed constant of 2^64-1 and then looking up or hashing a 16 byte integer - whatever they do - rather than a 4 byte one would increase the load significantly. Let's be pessimistic and say it's 20 extra cpu cycles, that's not gonna be much of a problem if their load balancers were made in the past 20 years.
- merpkz 7mo ago
  How does IP bans work in IPv6 case? One just blocks whole /64 or /56 address range?
  - throw0101d 7mo ago
    I have not had a deal with this, but if I was going to, I would start at the /64 and move up by nibble (4-bit) boundaries: /64, /60, /56, /52, /48. /56 is often recommended as the minimum as for a (residential) customer. /48 is considered a "site" address prefix, and is the smallest allocation that can be advertised in BGP: * https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommended-minimum-prefix-size-for-routing/ https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommende... * https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-and-for-every-site-a-48/ https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-a... You get 65k subnets with it, which is what you get with 10/8.
    - roryirvine 7mo ago
      Yes, /64 is a reasonable starting point for blocking outright, but /48 is the right unit for scoring reputation.
alex_duf 7mo ago
It's a possibly a managerial thing, which KPI are you improving when spending engineering time on adding IPv6 support? That said, for their HTTP stack they use fastly (as far as I understand), which should make the shift moderately easier.
AtNightWeCode 7mo ago
You probably need a hefty security reimplementation if you want to add IPv6 to Github.
michh 7mo ago
Perhaps a little tin foil hatty and definitely not the only reason but Microsoft owns Github and also makes a boatload of money off of Azure. Incumbent cloud providers like Azure have a major advantage in terms of having plenty of IPv4 addressing available whereas a new entrant to that market would have to buy or lease that space at a premium. Thus, these companies have an incentive to keep IPv4 a necessity.
- IshKebab 7mo ago
  IPv4 is going to be a necessity for many many decades no matter what Microsoft do. Even when IPv6 is at 99%, people aren't going to want 1 in every 100 people to not be able to access their site at all. It'll need to be like 99.9% before we start seeing serious IPv6-only services.
  - jiggawatts 7mo ago
    Sure, but the implementation in the public clouds is totally backwards. What they should have done is have their core network default to IPv6 with IPv4 an optional add-on for things like public IP addresses, CDN endpoints, edge routers, VPNs, etc... Instead, their core networks are IPv4 only for the most part with IPv6 a distant afterthought.
    - fogllgldl 7mo ago
      IPv6 is the protocol of the future. And will be so.
  - michh 7mo ago
    I don't know what the percentage would be, but we do have some historical precedent that could give us a clue. Best one I can think of is when bigger websites started actually dropping SSLv3 and TLSv1.0 (and later TLSv1.1) support, cutting off older browsers and operating systems. Google and Amazon still support TLSv1.0, but plenty of others (including Microsoft) have dropped 1.0 and 1.1. HN itself doesn't accept 1.1 anymore either. Then there's browser support. Lots of websites - big and small - cut off support for Internet Explorer 6 when it was somewhere below 5% marketshare because the juice was no longer worth the squeeze. Of course, few of those actually fully cut off the ability to browse the (now broken) website fully but it's a datapoint suggesting trade-offs can and will be made for this sort of thing. Or to put it in the present: a significant amount of webapps don't support Firefox (3% market share) to the extent their product is completely unusable in it.
mmbleh 7mo ago
IPv6 is very difficult to implement and enforce reliable rate limits on anonymous traffic. This is something we've struggled a lot with - there is no consistent implementation or standard when it comes to assigning of IPv6 addresses. sometimes a machine gets a full /64, other times a whole data center uses a full /64. So then we need to try and build knowledge of what level to block based on which IP range and for some it's just not worth the hassle.
- Tuna-Fish 7mo ago
  ... But that's no different from IPv4. Sometimes you have one per user, sometimes there are ~1000 users per IP. Most of the ipv4 world is now behind CGNAT, one user per ip is simply a wrong assumption.
  - mmbleh 7mo ago
    Anonymous rate limits for us are skewed towards preventing abusive behavior. Most users do not have a problem, even there is a CGNAT on IPv4. For IPv6, if we block on /128 and a single machine gets /64, a malicious user has near infinite IPs. In the case of Linode and others that do /64 for a whole data center, it's easy to rate limit the whole thing. Wrong assumption or not, it is an issue that is made worse by IPv6
    - agwa 7mo ago
      I don't doubt your experience, but I wouldn't expect it to continue. I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT, but that does appear to be the trend. You can't even assume hosting providers give their subscribers their own IPv4 addresses anymore. On the other hand, there's a chance providers like Linode will eventually wise up and start giving subscribers their own /64 - there are certainly enough IPv6 addresses available for that, unlike with IPv4.
      - mmbleh 7mo ago
        Yeah, absolutely no expectations for the future. My point was more that while there may be clear benefits for users, IPv6 presents real problems for service operators with no clear solutions in sight. Given that GitHub also offers free services for anonymous users, I can imagine they face similar problems. The easiest move is simply to just not bother, and I can't blame them for it.
skywhopper 7mo ago
IPv6 rollout is a lot of operational work that ends with next to no immediate quantifiable benefit. So I’ll never be prioritized in a cost-cutting environment.
- tialaramex 7mo ago
  I mean, all your numbering woes vanished, so, that's probably an immediate quantifiable benefit unless you're so tiny you never needed any renumbering effort, in which case your "operational work" to deploy IPv6 was probably zero.

Outdated beliefs probably. When I talk about v6 support in our b2b saas, PM laughs and says nobody uses that shit. Big tech are massive laggards on this funnily enough.

ViscountPenguin 7mo ago
It's because big tech is USA based mostly, where there's still a glut of ipv4 available.
- FuriouslyAdrift 7mo ago
  IPv4 was exhausted at ARIN in 2011. Last time I bought a /24 on the open market, it was around $6k. I assume it is much more, now.
  - Dylan16807 7mo ago
    It's close to that right now. Prices more than doubled as covid set in, then dropped back down to about where they were before.
- paulddraper 7mo ago
  Where can I get it, asking for a friend?
10000truths 7mo ago
Definitely not for the biggest ones. Google and Meta have so many machines in their data centers that IPv6 addressing becomes a technical necessity due to the risk of exhausting the RFC 1918 address space. Naturally, they were early adopters of IPv6.
- denkmoon 7mo ago
  Yeah, I can't imagine managing fleets like that with only v4. Our network config is so convoluted with gateways and NATs everywhere, paying AWS through the nose for it all, when it could all be so much simpler.
throw0101d 7mo ago
> Outdated beliefs probably. When I talk about v6 support in our b2b saas, PM laughs and says nobody uses that shit. Nobody except the 140M subscribers on T-Mobile US's network: * https://www.youtube.com/watch?v=d6oBCYHzrTA https://www.youtube.com/watch?v=d6oBCYHzrTA But sure, be IPv4-only and add latency by forcing traffic through an extra translation box.
paulddraper 7mo ago
Well it’s over 50%…

direwolf20 7mo ago

It could be that they don't want to implement IP bans in IPv6.

c0balt 7mo ago
Or the most likely more expensive rate limiting (computational wise)
- michh 7mo ago
  I mean, given how the site performs on average I don't think they've optimized so much that the extra cpu cycles of ANDing with the fixed constant of 2^64-1 and then looking up or hashing a 16 byte integer - whatever they do - rather than a 4 byte one would increase the load significantly. Let's be pessimistic and say it's 20 extra cpu cycles, that's not gonna be much of a problem if their load balancers were made in the past 20 years.
merpkz 7mo ago
How does IP bans work in IPv6 case? One just blocks whole /64 or /56 address range?
- throw0101d 7mo ago
  I have not had a deal with this, but if I was going to, I would start at the /64 and move up by nibble (4-bit) boundaries: /64, /60, /56, /52, /48. /56 is often recommended as the minimum as for a (residential) customer. /48 is considered a "site" address prefix, and is the smallest allocation that can be advertised in BGP: * https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommended-minimum-prefix-size-for-routing/ https://blog.apnic.net/2020/06/01/why-is-a-48-the-recommende... * https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-and-for-every-site-a-48/ https://www.infoblox.com/blog/ipv6-coe/a-48-for-every-site-a... You get 65k subnets with it, which is what you get with 10/8.
  - roryirvine 7mo ago
    Yes, /64 is a reasonable starting point for blocking outright, but /48 is the right unit for scoring reputation.

alex_duf 7mo ago

It's a possibly a managerial thing, which KPI are you improving when spending engineering time on adding IPv6 support? That said, for their HTTP stack they use fastly (as far as I understand), which should make the shift moderately easier.

AtNightWeCode 7mo ago

You probably need a hefty security reimplementation if you want to add IPv6 to Github.

michh 7mo ago

Perhaps a little tin foil hatty and definitely not the only reason but Microsoft owns Github and also makes a boatload of money off of Azure. Incumbent cloud providers like Azure have a major advantage in terms of having plenty of IPv4 addressing available whereas a new entrant to that market would have to buy or lease that space at a premium. Thus, these companies have an incentive to keep IPv4 a necessity.

IshKebab 7mo ago
IPv4 is going to be a necessity for many many decades no matter what Microsoft do. Even when IPv6 is at 99%, people aren't going to want 1 in every 100 people to not be able to access their site at all. It'll need to be like 99.9% before we start seeing serious IPv6-only services.
- jiggawatts 7mo ago
  Sure, but the implementation in the public clouds is totally backwards. What they should have done is have their core network default to IPv6 with IPv4 an optional add-on for things like public IP addresses, CDN endpoints, edge routers, VPNs, etc... Instead, their core networks are IPv4 only for the most part with IPv6 a distant afterthought.
  - fogllgldl 7mo ago
    IPv6 is the protocol of the future. And will be so.
- michh 7mo ago
  I don't know what the percentage would be, but we do have some historical precedent that could give us a clue. Best one I can think of is when bigger websites started actually dropping SSLv3 and TLSv1.0 (and later TLSv1.1) support, cutting off older browsers and operating systems. Google and Amazon still support TLSv1.0, but plenty of others (including Microsoft) have dropped 1.0 and 1.1. HN itself doesn't accept 1.1 anymore either. Then there's browser support. Lots of websites - big and small - cut off support for Internet Explorer 6 when it was somewhere below 5% marketshare because the juice was no longer worth the squeeze. Of course, few of those actually fully cut off the ability to browse the (now broken) website fully but it's a datapoint suggesting trade-offs can and will be made for this sort of thing. Or to put it in the present: a significant amount of webapps don't support Firefox (3% market share) to the extent their product is completely unusable in it.

mmbleh 7mo ago

IPv6 is very difficult to implement and enforce reliable rate limits on anonymous traffic. This is something we've struggled a lot with - there is no consistent implementation or standard when it comes to assigning of IPv6 addresses. sometimes a machine gets a full /64, other times a whole data center uses a full /64. So then we need to try and build knowledge of what level to block based on which IP range and for some it's just not worth the hassle.

Tuna-Fish 7mo ago
... But that's no different from IPv4. Sometimes you have one per user, sometimes there are ~1000 users per IP. Most of the ipv4 world is now behind CGNAT, one user per ip is simply a wrong assumption.
- mmbleh 7mo ago
  Anonymous rate limits for us are skewed towards preventing abusive behavior. Most users do not have a problem, even there is a CGNAT on IPv4. For IPv6, if we block on /128 and a single machine gets /64, a malicious user has near infinite IPs. In the case of Linode and others that do /64 for a whole data center, it's easy to rate limit the whole thing. Wrong assumption or not, it is an issue that is made worse by IPv6
  - agwa 7mo ago
    I don't doubt your experience, but I wouldn't expect it to continue. I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT, but that does appear to be the trend. You can't even assume hosting providers give their subscribers their own IPv4 addresses anymore. On the other hand, there's a chance providers like Linode will eventually wise up and start giving subscribers their own /64 - there are certainly enough IPv6 addresses available for that, unlike with IPv4.
    - mmbleh 7mo ago
      Yeah, absolutely no expectations for the future. My point was more that while there may be clear benefits for users, IPv6 presents real problems for service operators with no clear solutions in sight. Given that GitHub also offers free services for anonymous users, I can imagine they face similar problems. The easiest move is simply to just not bother, and I can't blame them for it.

skywhopper 7mo ago

IPv6 rollout is a lot of operational work that ends with next to no immediate quantifiable benefit. So I’ll never be prioritized in a cost-cutting environment.

tialaramex 7mo ago
I mean, all your numbering woes vanished, so, that's probably an immediate quantifiable benefit unless you're so tiny you never needed any renumbering effort, in which case your "operational work" to deploy IPv6 was probably zero.