3 ms·

Anonymous rate limits for us are skewed towards preventing abusive behavior. Most users do not have a problem, even there is a CGNAT on IPv4. For IPv6, if we b

by mmbleh 6mo ago

Anonymous rate limits for us are skewed towards preventing abusive behavior. Most users do not have a problem, even there is a CGNAT on IPv4. For IPv6, if we block on /128 and a single machine gets /64, a malicious user has near infinite IPs. In the case of Linode and others that do /64 for a whole data center, it's easy to rate limit the whole thing. Wrong assumption or not, it is an issue that is made worse by IPv6

agwa 6mo ago
I don't doubt your experience, but I wouldn't expect it to continue. I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT, but that does appear to be the trend. You can't even assume hosting providers give their subscribers their own IPv4 addresses anymore. On the other hand, there's a chance providers like Linode will eventually wise up and start giving subscribers their own /64 - there are certainly enough IPv6 addresses available for that, unlike with IPv4.
- mmbleh 6mo ago
  Yeah, absolutely no expectations for the future. My point was more that while there may be clear benefits for users, IPv6 presents real problems for service operators with no clear solutions in sight. Given that GitHub also offers free services for anonymous users, I can imagine they face similar problems. The easiest move is simply to just not bother, and I can't blame them for it.
- Tuna-Fish 6mo ago
  > I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT ~60%+ of internet traffic is mobile, which is ~100% behind CGNAT. On desktop, only ~20% of US and European web traffic uses CGNAT, but in China that number is ~80%, in India ~70% and varies among African countries but is typically well over 70%, with it being essentially universal in some countries. Overall, something a bit over 80% of all ipv4 traffic worldwide currently uses CGNAT. It's just distributed very unevenly, with US and European consumers enjoying high IP allocations for historical reasons, and the rest of the world making do with what they have.
  - agwa 6mo ago
    Oh wow, thanks for those numbers! Since mmbleh mentioned Linode I'm guessing they're more concerned with traffic from servers, where CGNAT is uncommon. But even that may be changing - https://blog.exe.dev/ssh-host-header https://blog.exe.dev/ssh-host-header
    - mmbleh 6mo ago
      Yeah, our traffic is more from automated systems/servers, nothing from mobile
GoblinSlayer 6mo ago
If a single machine gets /64 and you rate limit by /64, what doesn't work? >Linode and others that do /64 for a whole data center That's how it's supposed to work.
- Dylan16807 6mo ago
  > That's how it's supposed to work. According to who? It could fit best practices if your datacenter has one tenant and they want to put the entire thing on a single subnet? In general I would expect a datacenter to get something like a /48 minimum. Even home connections are supposed to get more than /64 allocated. And Linode's default setup only gives each server a single /128. That's not how it's supposed to work. But you can request /64 or /56.
  - GoblinSlayer 6mo ago
    If the OS uses SLAAC by default, then it will just work, but SLAAC is for humans and makes less sense for web servers (yet can make sense for vpn servers). For web servers /128 is more meaningful.

by mmbleh 6mo ago

agwa 6mo ago

I don't doubt your experience, but I wouldn't expect it to continue. I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT, but that does appear to be the trend. You can't even assume hosting providers give their subscribers their own IPv4 addresses anymore. On the other hand, there's a chance providers like Linode will eventually wise up and start giving subscribers their own /64 - there are certainly enough IPv6 addresses available for that, unlike with IPv4.

mmbleh 6mo ago
Yeah, absolutely no expectations for the future. My point was more that while there may be clear benefits for users, IPv6 presents real problems for service operators with no clear solutions in sight. Given that GitHub also offers free services for anonymous users, I can imagine they face similar problems. The easiest move is simply to just not bother, and I can't blame them for it.
Tuna-Fish 6mo ago
> I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT ~60%+ of internet traffic is mobile, which is ~100% behind CGNAT. On desktop, only ~20% of US and European web traffic uses CGNAT, but in China that number is ~80%, in India ~70% and varies among African countries but is typically well over 70%, with it being essentially universal in some countries. Overall, something a bit over 80% of all ipv4 traffic worldwide currently uses CGNAT. It's just distributed very unevenly, with US and European consumers enjoying high IP allocations for historical reasons, and the rest of the world making do with what they have.
- agwa 6mo ago
  Oh wow, thanks for those numbers! Since mmbleh mentioned Linode I'm guessing they're more concerned with traffic from servers, where CGNAT is uncommon. But even that may be changing - https://blog.exe.dev/ssh-host-header https://blog.exe.dev/ssh-host-header
  - mmbleh 6mo ago
    Yeah, our traffic is more from automated systems/servers, nothing from mobile

GoblinSlayer 6mo ago

If a single machine gets /64 and you rate limit by /64, what doesn't work? >Linode and others that do /64 for a whole data center That's how it's supposed to work.

Dylan16807 6mo ago
> That's how it's supposed to work. According to who? It could fit best practices if your datacenter has one tenant and they want to put the entire thing on a single subnet? In general I would expect a datacenter to get something like a /48 minimum. Even home connections are supposed to get more than /64 allocated. And Linode's default setup only gives each server a single /128. That's not how it's supposed to work. But you can request /64 or /56.
- GoblinSlayer 6mo ago
  If the OS uses SLAAC by default, then it will just work, but SLAAC is for humans and makes less sense for web servers (yet can make sense for vpn servers). For web servers /128 is more meaningful.