4 ms·

It’s not. It’s IPv4 with more bits and some changes to Ethernet level lookup. The SLAAC vs DHCPv6 mess is not really a problem with the core V6 spec.

by api 5mo ago

ninkendo 5mo ago
The changes to Ethernet lookup mandate that you have a link-local address in addition to your “real” address, and this starts the ball rolling on the idea that machines have multiple IP addresses in general. Which makes privacy addresses commonplace, ULA+GUA addresses on the same machine, etc. I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, and you can’t easily predict what address will be used when connecting somewhere. IP-based access control becomes impossible (not that it was ever a great idea in the first place), reverse DNS lookups become irrelevant, seeing IP’s in logs no longer tells you “what machine connected here”, it’s overall a big change in mental model. But then you get over it, stop making assumptions that you can rely on IP addresses for knowing things about a host, and the rest of it is fine.
- doctorpangloss 5mo ago
  > I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, a little over half the bytes of a typical IPv6 visitor's address is comparable in identification to what all four bytes of an IPv4 address tells you
  - ninkendo 5mo ago
    I'm not necessarily talking about fingerprinting or tracking here, it can be something a lot more mundane. Like if I have a homelab setup and I want to see what hosts connected to something, and I look at the logs and see privacy addresses, I know I'll never know what host it was. Or if I want to set up netgroups for access control to shares or something (just a hypothetical.) In the classic sysadmin world, the idea that an IP you see could belong to any host and you have practically zero way of knowing, is rather different from what we expect in the IPv4 world. You just have to embrace it, basically.
- simoncion 5mo ago
  > I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, and you can’t easily predict what address will be used when connecting somewhere. Can't you unset the "Use autonomous addressing" bit and set the "Use DHCPv6 for addressing and other config" bit in your RAs, and then refuse to hand out anything other than DHCPv6 Normal Addresses? Or do OS's ignore the fact that Temporary Addresses are an entire other category of DHCPv6 addresses and just go off and make their own "privacy addresses" off of the advertised prefix in the RA... ignoring the router's command to not use SLAAC for addressing? [0] [0] Yes, I'm very aware that Android doesn't support anything that DHCPv6 provides other than getting an entire damn prefix delegated. For the duration of this discussion, let's ignore Android.
  - ninkendo 5mo ago
    IME nothing pays attention to when you set a flag to not do autonomous addressing. macOS and iOS don't respect it AFAICT, I don't recall what Linux does by default, but I don't remember having any success. But it's rather not really my point... best practices for IPv6 are to not do any of this, and you probably don't want to do it, because privacy addresses are an actually-important thing for privacy (so that sites can't correlate you easily.) You can say "oh but websites use fingerprinting anyway" (which doesn't help you when it's not a web browser you're using, but any other software that's connecting places) or "but sites don't trust the trailing 64 bits" (which only helps because everyone else is using privacy addresses, which rather proves my point.) When doing IPv6, you sort of have to abandon the idea that you're going to have a fixed, known IP address that you will use for all outbound connections. Fighting this is an exercise in pain.
    - simoncion 5mo ago
      > IME nothing pays attention to when you set a flag to not do autonomous addressing. When I unset the Autonomous flag, Linux does the right thing, at least on the systems I have at hand. Android does the right thing. My Playstation 5 does the right thing. I'd be shocked if Windows doesn't do the right thing. While I wouldn't be surprised to hear that Apple devices absolutely do the wrong thing -given Apple's long history with flagrantly doing the disruptively-wrong thing in regards to networking-, based on the results I'm seeing, I expect that Apple devices work just fine. I think you came to the wrong conclusions because you fucked up your test. > ...privacy addresses are an actually-important thing for privacy (so that sites can't correlate you easily.) As you allude to, The Web has eleventy billion ways to track you that give absolutely zero shits about your IP address. "Privacy" addresses buy the typical user of The Internet effectively zero privacy. January's deprecation of DHCPv6 "Temporary Addresses" suggests that folks who deploy this stuff believe that this feature is far less useful than proponents might think it to be. Plus, absolutely nothing prevents a DHCPv6 server from randomly generating the host part of the addresses it hands out, as well as handing out entirely new addresses for each address request. If I believed that "privacy" addresses actually provided any meaningful privacy, that's how I'd configure mine to behave for hosts that I wasn't intentionally providing fixed addresses.
- tardedmeme 5mo ago
  Nothing in v6 stops you giving a machine a single stable address (plus link-local). Every server on the internet has one. You can also bind a socket to a specific source address if that's what you want, because the recipient is IP-filtering.
formerly_proven 5mo ago
If it actually was v4 with more bits and different ARP it wouldn't take 30+ years to be deployed.
- tardedmeme 5mo ago
  It's the more bits that are the problem. Anything with more bits is incompatible with the whole internet and anything that's incompatible with the whole internet won't be deployed quickly if ever. NAT is way worse than IPv6 but it got deployed quickly because it was compatible.
dgoodell 5mo ago
IPv4 + all the other stuff you need to actually make it work in the real world actually seems more complicated than IPv6 to me. Maybe they’re comparing the minimal implementation on a home network. But even then I’m not sure the claim holds up. People learned IPv4 when they were younger in a more incremental manner and take it for granted now.
- api 5mo ago
  V4 plus one or more layers of NAT and all that junk objectively is more complicated, but it’s the devil people know.
  - righthand 5mo ago
    Is it a job security issue? Greyed Neckbeards keeping things overly complex because they’ve managed to cement themselves in with IPv4 systems and anti-IPv6 talk?
- Ekaros 5mo ago
  ARP and DHCP really look really dirty whenever I look at them. Like pretty bad designs overall. From more neutral viewpoint it feels that whole stack would be better with something else than these clear hacks.
  - kazen44 5mo ago
    arp simply breaks down in very large networks aswell. Think about things like the following: you are a datacenter and are providing connectivity to the internet for your customers. Each customer get a vlan with a specific ip prefix attached to it. You prove the gateway for each customers subnet. ARP crosses the L2 vs L3 boundary to do succesful address resolution. The problem this creates in large (mainly datacenter) networks is that a router needs to do arp resolution for for a LOT of networks. (i am talking about 100's of networks in past, many thousands with something like an EVPN vxlan). Why is this a problem? Layer 2 lookups are usually done in the forwarding plane, and ARP resolution is usually a routing engine task. Doing it this way is very expensive compared to the IPV6 way of doing things. (multicast based address resolution). The router only needs to send out one multicast packet per vlan, instead of doing arp resolution for each specific host in the vlan. In modern datacenters this is "fixed" by doing arp suppression, which is a whole other level of hackary added on top of it.
Spooky23 5mo ago
When I turned IPv6 on on my spectrum connection i ended up with like 4 different interfaces I didn’t need and broken local DNS.
convolvatron 5mo ago
the intent behind the ipv6 spec was to remove dhcp as a requirement for establishing layer 3 connectivity. there was a generalized notion at the time that other service discovery (dns) would be handled by a more graceful multicast protocol. that was a very reasonable position to take. but operational inertia got in the way. I don't think people really wanted to think about what a dhcp-less world would look like, even if it removed the requirement to manage a central service and the associated configuration. this was kind of ok. but then things got ugly. people wanted to be able to get assigned prefixes dynamically from their upstream provider that they could subnet themselves. because we don't think about these issues architecturally anymore, someone put that function on dhcp. and since we don't think about these issues architecturally anymore no one really realized that that would require _another_ protocol on the inside of that boundary to manage assignments in the providers space. and now we don't even have the option of depreciating dhcp gracefully.
doctorpangloss 5mo ago
SLAAC and DHCPv6 actually make a ton of sense, along with the other features of IPv6. I think you need a lot of experience in both networking and applications, at many scales, to understand the design decisions and appreciate how useful they are in which contexts. That said, you could publish a clear playbook for an ISP of residential Internet for ipv6 adoption, it wouldn't change much, because they are not deciding to adopt ipv6 based on either its aesthetics or its technical merits.
- kazen44 5mo ago
  SLAAC is probably one of the better improvements of IPV6. DHCP breaks down at scale. Managing many DHCP prefixes becomes a massibe pain, SLAAC is far more scalable, far more easy to make redundant if you have redundant gateway's and protocol wise is really simple.
deleted 5mo ago
[deleted]

It’s not. It’s IPv4 with more bits and some changes to Ethernet level lookup. The SLAAC vs DHCPv6 mess is not really a problem with the core V6 spec.

by api 5mo ago

It’s not. It’s IPv4 with more bits and some changes to Ethernet level lookup. The SLAAC vs DHCPv6 mess is not really a problem with the core V6 spec.

ninkendo 5mo ago

The changes to Ethernet lookup mandate that you have a link-local address in addition to your “real” address, and this starts the ball rolling on the idea that machines have multiple IP addresses in general. Which makes privacy addresses commonplace, ULA+GUA addresses on the same machine, etc. I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, and you can’t easily predict what address will be used when connecting somewhere. IP-based access control becomes impossible (not that it was ever a great idea in the first place), reverse DNS lookups become irrelevant, seeing IP’s in logs no longer tells you “what machine connected here”, it’s overall a big change in mental model. But then you get over it, stop making assumptions that you can rely on IP addresses for knowing things about a host, and the rest of it is fine.

doctorpangloss 5mo ago
> I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, a little over half the bytes of a typical IPv6 visitor's address is comparable in identification to what all four bytes of an IPv4 address tells you
- ninkendo 5mo ago
  I'm not necessarily talking about fingerprinting or tracking here, it can be something a lot more mundane. Like if I have a homelab setup and I want to see what hosts connected to something, and I look at the logs and see privacy addresses, I know I'll never know what host it was. Or if I want to set up netgroups for access control to shares or something (just a hypothetical.) In the classic sysadmin world, the idea that an IP you see could belong to any host and you have practically zero way of knowing, is rather different from what we expect in the IPv4 world. You just have to embrace it, basically.
simoncion 5mo ago
> I think this is the biggest change with IPv6: that a machine’s IP addresses is no longer its identity, and you can’t easily predict what address will be used when connecting somewhere. Can't you unset the "Use autonomous addressing" bit and set the "Use DHCPv6 for addressing and other config" bit in your RAs, and then refuse to hand out anything other than DHCPv6 Normal Addresses? Or do OS's ignore the fact that Temporary Addresses are an entire other category of DHCPv6 addresses and just go off and make their own "privacy addresses" off of the advertised prefix in the RA... ignoring the router's command to not use SLAAC for addressing? [0] [0] Yes, I'm very aware that Android doesn't support anything that DHCPv6 provides other than getting an entire damn prefix delegated. For the duration of this discussion, let's ignore Android.
- ninkendo 5mo ago
  IME nothing pays attention to when you set a flag to not do autonomous addressing. macOS and iOS don't respect it AFAICT, I don't recall what Linux does by default, but I don't remember having any success. But it's rather not really my point... best practices for IPv6 are to not do any of this, and you probably don't want to do it, because privacy addresses are an actually-important thing for privacy (so that sites can't correlate you easily.) You can say "oh but websites use fingerprinting anyway" (which doesn't help you when it's not a web browser you're using, but any other software that's connecting places) or "but sites don't trust the trailing 64 bits" (which only helps because everyone else is using privacy addresses, which rather proves my point.) When doing IPv6, you sort of have to abandon the idea that you're going to have a fixed, known IP address that you will use for all outbound connections. Fighting this is an exercise in pain.
  - simoncion 5mo ago
    > IME nothing pays attention to when you set a flag to not do autonomous addressing. When I unset the Autonomous flag, Linux does the right thing, at least on the systems I have at hand. Android does the right thing. My Playstation 5 does the right thing. I'd be shocked if Windows doesn't do the right thing. While I wouldn't be surprised to hear that Apple devices absolutely do the wrong thing -given Apple's long history with flagrantly doing the disruptively-wrong thing in regards to networking-, based on the results I'm seeing, I expect that Apple devices work just fine. I think you came to the wrong conclusions because you fucked up your test. > ...privacy addresses are an actually-important thing for privacy (so that sites can't correlate you easily.) As you allude to, The Web has eleventy billion ways to track you that give absolutely zero shits about your IP address. "Privacy" addresses buy the typical user of The Internet effectively zero privacy. January's deprecation of DHCPv6 "Temporary Addresses" suggests that folks who deploy this stuff believe that this feature is far less useful than proponents might think it to be. Plus, absolutely nothing prevents a DHCPv6 server from randomly generating the host part of the addresses it hands out, as well as handing out entirely new addresses for each address request. If I believed that "privacy" addresses actually provided any meaningful privacy, that's how I'd configure mine to behave for hosts that I wasn't intentionally providing fixed addresses.
tardedmeme 5mo ago
Nothing in v6 stops you giving a machine a single stable address (plus link-local). Every server on the internet has one. You can also bind a socket to a specific source address if that's what you want, because the recipient is IP-filtering.

formerly_proven 5mo ago

If it actually was v4 with more bits and different ARP it wouldn't take 30+ years to be deployed.

tardedmeme 5mo ago
It's the more bits that are the problem. Anything with more bits is incompatible with the whole internet and anything that's incompatible with the whole internet won't be deployed quickly if ever. NAT is way worse than IPv6 but it got deployed quickly because it was compatible.

dgoodell 5mo ago

IPv4 + all the other stuff you need to actually make it work in the real world actually seems more complicated than IPv6 to me. Maybe they’re comparing the minimal implementation on a home network. But even then I’m not sure the claim holds up. People learned IPv4 when they were younger in a more incremental manner and take it for granted now.

api 5mo ago
V4 plus one or more layers of NAT and all that junk objectively is more complicated, but it’s the devil people know.
- righthand 5mo ago
  Is it a job security issue? Greyed Neckbeards keeping things overly complex because they’ve managed to cement themselves in with IPv4 systems and anti-IPv6 talk?
Ekaros 5mo ago
ARP and DHCP really look really dirty whenever I look at them. Like pretty bad designs overall. From more neutral viewpoint it feels that whole stack would be better with something else than these clear hacks.
- kazen44 5mo ago
  arp simply breaks down in very large networks aswell. Think about things like the following: you are a datacenter and are providing connectivity to the internet for your customers. Each customer get a vlan with a specific ip prefix attached to it. You prove the gateway for each customers subnet. ARP crosses the L2 vs L3 boundary to do succesful address resolution. The problem this creates in large (mainly datacenter) networks is that a router needs to do arp resolution for for a LOT of networks. (i am talking about 100's of networks in past, many thousands with something like an EVPN vxlan). Why is this a problem? Layer 2 lookups are usually done in the forwarding plane, and ARP resolution is usually a routing engine task. Doing it this way is very expensive compared to the IPV6 way of doing things. (multicast based address resolution). The router only needs to send out one multicast packet per vlan, instead of doing arp resolution for each specific host in the vlan. In modern datacenters this is "fixed" by doing arp suppression, which is a whole other level of hackary added on top of it.

Spooky23 5mo ago

When I turned IPv6 on on my spectrum connection i ended up with like 4 different interfaces I didn’t need and broken local DNS.

convolvatron 5mo ago

the intent behind the ipv6 spec was to remove dhcp as a requirement for establishing layer 3 connectivity. there was a generalized notion at the time that other service discovery (dns) would be handled by a more graceful multicast protocol. that was a very reasonable position to take. but operational inertia got in the way. I don't think people really wanted to think about what a dhcp-less world would look like, even if it removed the requirement to manage a central service and the associated configuration. this was kind of ok. but then things got ugly. people wanted to be able to get assigned prefixes dynamically from their upstream provider that they could subnet themselves. because we don't think about these issues architecturally anymore, someone put that function on dhcp. and since we don't think about these issues architecturally anymore no one really realized that that would require _another_ protocol on the inside of that boundary to manage assignments in the providers space. and now we don't even have the option of depreciating dhcp gracefully.

doctorpangloss 5mo ago

SLAAC and DHCPv6 actually make a ton of sense, along with the other features of IPv6. I think you need a lot of experience in both networking and applications, at many scales, to understand the design decisions and appreciate how useful they are in which contexts. That said, you could publish a clear playbook for an ISP of residential Internet for ipv6 adoption, it wouldn't change much, because they are not deciding to adopt ipv6 based on either its aesthetics or its technical merits.

kazen44 5mo ago
SLAAC is probably one of the better improvements of IPV6. DHCP breaks down at scale. Managing many DHCP prefixes becomes a massibe pain, SLAAC is far more scalable, far more easy to make redundant if you have redundant gateway's and protocol wise is really simple.

deleted 5mo ago

[deleted]