3 ms·

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But

by elric 1mo ago

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

NoMoreNicksLeft 1mo ago
>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. This might not be a good thing. Perhaps if there had been no protection for those odious operating systems, they'd have died the horrible deaths they earned decades ago. We should only want to protect things we intend to keep, after all, and none of us wanted to keep that garbage.
- mikewarot 1mo ago
  All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code. I know of zero systems that can survive exposure to the raw Internet, unpatched and without administrative oversight, with uptimes of years.
  - NoMoreNicksLeft 1mo ago
    >I know of zero systems that can survive exposure to the raw Internet Sure. And as long as nothing has to survive exposure to the raw Internet, no one will build anything that could survive it. Not sure why that's so difficult to understand. You seem to think that the protection is the reaction to dangerous operating systems, when it's the cause.
  - GoblinSlayer 1mo ago
    > The all operate programs with the ambient authority of the user. Doesn't mean much when you have a buffer overflow in kernel.
    - mikewarot 29d ago
      Which is part of why Tanenbaum was right, and Linus Torvalds is dead wrong.[1] Eventually, we'll all be running Operating Systems designed on microkernels, which have been written by actual software engineers, and proven correct with formal methods. Until then, we're going to suffer through endless series of increasingly severe cybersecurity incidents. Computer Security is a solved problem, has been since the mid 1980s, secure proven microkernels, with almost all code in user space, capabilities based security, etc. have been just waiting to move into mainstream use. We can end this nightmare. [1] https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_debate https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_deb...
      - AnimalMuppet 29d ago
        Eventually? I've seen more than forty years of OSes that "we're all running". Given past trends, your "eventually" we'll be after we're all dead. There isn't such a thing as you describe. There isn't a trend toward such a thing as you describe. What there is, is Windows 11, and Linux, and OSX. And when people complain that Windows 11 stinks, they're mostly complaining about the UI and the ads, not about the security or the lack of formal methods or the lack of a microkernel. The closest there is to what you're describing is SELinux. It's still a monolithic kernel. (Though I think it did use formal methods, but I'm not sure of that.) The only microkernel candidate that I know of is the Hurd, and it isn't what we're all running, and shows no sign of becoming so.
orbital-decay 1mo ago
>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. I don't think NAT being a janky ad hoc firewall does anyone a service. It shields the devices enough to keep the developers oblivious about security, but not enough to stop them from connecting to arbitrary hosts. This perpetuates the humongous botnet ecosystem.
preisschild 1mo ago
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. Its definitely the opposite. People started ignoring security because its "natted" anyways, even though NAT was never supposed to be security-critical. Thats what firewalls are for.
- elric 1mo ago
  People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.
  - Hizonner 1mo ago
    ... because people (by which I mean software vendors who should have known better) irresponsibly failed to create secure systems for those average users to use. A whole lot of which came to be justified by "it'll be behind a firewall" thinking.
    - mhurron 1mo ago
      Did you forget dialup was a thing? No one created anything for home users thinking it would be behind some firewall because as said Windows didn't ship with one, and because the dominant way of customers getting online was dialup, giving a public IP to every user. Software was created with no security because no one demanded it because no one cared. Technologies that came later did not create that situation.
  - combyn8tor 1mo ago
    I remember in the Windows 95/98 days asking my friend for his IP address and then browsing through my windows explorer to his mum's fully shared windows C drive. She had her computer plugged directly into the modem and was using ICS to share the net to my friends computer. I sent them a screenshot of her shared drive through ICQ, and not long after she bought a router.
mort96 1mo ago
Yeah NAT is still "every household gets a public IP address". This is a perfectly good foundation for an open Internet. You can still host servers in your home. I did this a lot as a kid and learned a ton from it. It's maybe not super elegant but it works. Going to a model of "you don't get a public IP address, all traffic must go through servers other people host for you" is what finally kills the open Internet. It's okay enough for cell phones where it's a hack to work around TCP/IP's lack of roaming support, but it should be illegal to deploy as residential Internet.
Hizonner 1mo ago
> "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If you try to use those port forwarding hacks, you force every single piece of software to deal with the fact that the IP address it sees for itself is not the IP address its peer sees for it. And you force every single protocol design to allow for that possibility. Add in UPNP, and now you have to implement a whole extra (badly designed) protocol in parallel with the actual application. It's not trivial to even discover the address your peer is seeing; even now there's a huge diversity of nasty unreliable hacks for doing it. HTTP isn't the world. In fact, HTTP becoming "the world" was another part of the problem.
blindport 1mo ago
[dead]
unethical_ban 1mo ago
NAT only serves as the janky inbound default deny because IPv4 doesn't have the address space. There are very few things NAT solves in a world without address exhaustion; the only one I can think of off hand is a janky method of forcing return routing in enterprise environments where symmetric rooting is needed. In an alternate universe (or a current one with IPv6) every home router would have a default deny inbound security policy, and home admins could punch holes as needed the way they do today with port forwarding.
ironhaven 1mo ago
I don't think that you can draw the line between NAT and CGNAT. The fact that single NAT works as well as it does is an argument for why it is ok to double NAT with CGNAT. The conceit behind NAT is that 99% of traffic over the router will be client-server and the last 1% can get away with separately negotiating with the router to get inbound traffic. For example my ISP Xfinity by default will put your router in CGNAT space (and ipv6) but if you request port forwarding from a mobile app the upstream router will assign you a ipv4 address and it all works. NAT is considered fine because adding roadblocks to server hosting is a acceptable tradeoff. The reason they i think they can be so flexible is that they likey have a ipv6 backbone to route to all the customers and ipv4 is not used for routing but as a extra service layered on top with packing the 48 bits of ipv4 and port inside a ipv6 address via MAP-T
- GoblinSlayer 1mo ago
  That can be because UPnP supports only ip4, you need PCP for ip6, but CGNAT supporting port mapping is unheard of.
Dylan16807 1mo ago
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. I doubt it. Very few devices do port NAT without also doing firewalling, since firewalling is simpler.
thomastjeffery 1mo ago
NAT didn't save us from insecure networking. It gave insecure networking an excuse that was just good enough to satisfy the masses. This is worse for everyone in so many ways: 1. Forwarding ports suddenly makes you insecure, because you already were. 2. You have to fuck with your router config to even do that, and risk breaking something else along the way. Nobody should have to bother, because port forwarding shouldn't exist in the first place. 3. Many ISPs make it difficult or impossible to configure your firewall, let alone reserve a static public IP. 4. It's an eternal problem that isolates itself from any true solution. Any actually good UPnP implementation would just be stuck behind your NAT and firewall. The entire premise "as long as you can control it" is the core issue, and the fundamental reason why NAT is the original sin. Without NAT, there wouldn't be anything to get control of.
throw0101a 1mo ago
> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. You can have a stateful firewall that blocks non-established-connection packs and all your publicly addressable devices would not be reachable. NAT ≠ firewall (though they often glommed together on CPEs). And NAT is also giving a false sense of security in some ways: "this device has an RFC 1918 address so is not reachable, and therefore safe". Yeah, except if another device already on the inside is / gets compromised. Perhaps if everything had a public address folks would be more circumspect.
- icedchai 1mo ago
  Generally, firewalls aren't going to save you from an internal compromise either. Are you giving each device its own VLAN, subnet, etc?
  - throw0101a 1mo ago
    > Generally, firewalls aren't going to save you from an internal compromise either. Right, but it's easy to get in the mindset that because devices are on the "inside" network they are safer. This is the risk that NAT brings: RFC 1918 = safe(r). If every device has a 200::/3 address, then even if there's a SPI firewall which prevents external connections, it may help to reduce this inside/outside thinking.
matheusmoreira 1mo ago
Regular NAT is not fine at all. It adds needless friction and complexity. Networking is complex and annoying enough without it. IPv6 just works. DNS gives me the address and that's it, I am now talking to my remote computer.
why_at 1mo ago
I think it's hard for us to imagine what we could have if not for NAT. Just as an example, any device on your home network could have a web interface which you could access from anywhere using a web browser. All the smart light bulbs and things which need some stupid account on some service could be made so they're controlled by the user instead of some company. I've set up things like this on my home network but it's a pain because I need to deal with port forwarding, and if I have more than one device I need to use a reverse proxy.

by elric 1mo ago

NoMoreNicksLeft 1mo ago

>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. This might not be a good thing. Perhaps if there had been no protection for those odious operating systems, they'd have died the horrible deaths they earned decades ago. We should only want to protect things we intend to keep, after all, and none of us wanted to keep that garbage.

mikewarot 1mo ago
All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code. I know of zero systems that can survive exposure to the raw Internet, unpatched and without administrative oversight, with uptimes of years.
- NoMoreNicksLeft 1mo ago
  >I know of zero systems that can survive exposure to the raw Internet Sure. And as long as nothing has to survive exposure to the raw Internet, no one will build anything that could survive it. Not sure why that's so difficult to understand. You seem to think that the protection is the reaction to dangerous operating systems, when it's the cause.
- GoblinSlayer 1mo ago
  > The all operate programs with the ambient authority of the user. Doesn't mean much when you have a buffer overflow in kernel.
  - mikewarot 29d ago
    Which is part of why Tanenbaum was right, and Linus Torvalds is dead wrong.[1] Eventually, we'll all be running Operating Systems designed on microkernels, which have been written by actual software engineers, and proven correct with formal methods. Until then, we're going to suffer through endless series of increasingly severe cybersecurity incidents. Computer Security is a solved problem, has been since the mid 1980s, secure proven microkernels, with almost all code in user space, capabilities based security, etc. have been just waiting to move into mainstream use. We can end this nightmare. [1] https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_debate https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_deb...
    - AnimalMuppet 29d ago
      Eventually? I've seen more than forty years of OSes that "we're all running". Given past trends, your "eventually" we'll be after we're all dead. There isn't such a thing as you describe. There isn't a trend toward such a thing as you describe. What there is, is Windows 11, and Linux, and OSX. And when people complain that Windows 11 stinks, they're mostly complaining about the UI and the ads, not about the security or the lack of formal methods or the lack of a microkernel. The closest there is to what you're describing is SELinux. It's still a monolithic kernel. (Though I think it did use formal methods, but I'm not sure of that.) The only microkernel candidate that I know of is the Hurd, and it isn't what we're all running, and shows no sign of becoming so.

orbital-decay 1mo ago

>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. I don't think NAT being a janky ad hoc firewall does anyone a service. It shields the devices enough to keep the developers oblivious about security, but not enough to stop them from connecting to arbitrary hosts. This perpetuates the humongous botnet ecosystem.

preisschild 1mo ago

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. Its definitely the opposite. People started ignoring security because its "natted" anyways, even though NAT was never supposed to be security-critical. Thats what firewalls are for.

elric 1mo ago
People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.
- Hizonner 1mo ago
  ... because people (by which I mean software vendors who should have known better) irresponsibly failed to create secure systems for those average users to use. A whole lot of which came to be justified by "it'll be behind a firewall" thinking.
  - mhurron 1mo ago
    Did you forget dialup was a thing? No one created anything for home users thinking it would be behind some firewall because as said Windows didn't ship with one, and because the dominant way of customers getting online was dialup, giving a public IP to every user. Software was created with no security because no one demanded it because no one cared. Technologies that came later did not create that situation.
- combyn8tor 1mo ago
  I remember in the Windows 95/98 days asking my friend for his IP address and then browsing through my windows explorer to his mum's fully shared windows C drive. She had her computer plugged directly into the modem and was using ICS to share the net to my friends computer. I sent them a screenshot of her shared drive through ICQ, and not long after she bought a router.

mort96 1mo ago

Yeah NAT is still "every household gets a public IP address". This is a perfectly good foundation for an open Internet. You can still host servers in your home. I did this a lot as a kid and learned a ton from it. It's maybe not super elegant but it works. Going to a model of "you don't get a public IP address, all traffic must go through servers other people host for you" is what finally kills the open Internet. It's okay enough for cell phones where it's a hack to work around TCP/IP's lack of roaming support, but it should be illegal to deploy as residential Internet.

Hizonner 1mo ago

> "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If you try to use those port forwarding hacks, you force every single piece of software to deal with the fact that the IP address it sees for itself is not the IP address its peer sees for it. And you force every single protocol design to allow for that possibility. Add in UPNP, and now you have to implement a whole extra (badly designed) protocol in parallel with the actual application. It's not trivial to even discover the address your peer is seeing; even now there's a huge diversity of nasty unreliable hacks for doing it. HTTP isn't the world. In fact, HTTP becoming "the world" was another part of the problem.

blindport 1mo ago

[dead]

unethical_ban 1mo ago

NAT only serves as the janky inbound default deny because IPv4 doesn't have the address space. There are very few things NAT solves in a world without address exhaustion; the only one I can think of off hand is a janky method of forcing return routing in enterprise environments where symmetric rooting is needed. In an alternate universe (or a current one with IPv6) every home router would have a default deny inbound security policy, and home admins could punch holes as needed the way they do today with port forwarding.

ironhaven 1mo ago

I don't think that you can draw the line between NAT and CGNAT. The fact that single NAT works as well as it does is an argument for why it is ok to double NAT with CGNAT. The conceit behind NAT is that 99% of traffic over the router will be client-server and the last 1% can get away with separately negotiating with the router to get inbound traffic. For example my ISP Xfinity by default will put your router in CGNAT space (and ipv6) but if you request port forwarding from a mobile app the upstream router will assign you a ipv4 address and it all works. NAT is considered fine because adding roadblocks to server hosting is a acceptable tradeoff. The reason they i think they can be so flexible is that they likey have a ipv6 backbone to route to all the customers and ipv4 is not used for routing but as a extra service layered on top with packing the 48 bits of ipv4 and port inside a ipv6 address via MAP-T

GoblinSlayer 1mo ago
That can be because UPnP supports only ip4, you need PCP for ip6, but CGNAT supporting port mapping is unheard of.

Dylan16807 1mo ago

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. I doubt it. Very few devices do port NAT without also doing firewalling, since firewalling is simpler.

thomastjeffery 1mo ago

NAT didn't save us from insecure networking. It gave insecure networking an excuse that was just good enough to satisfy the masses. This is worse for everyone in so many ways: 1. Forwarding ports suddenly makes you insecure, because you already were. 2. You have to fuck with your router config to even do that, and risk breaking something else along the way. Nobody should have to bother, because port forwarding shouldn't exist in the first place. 3. Many ISPs make it difficult or impossible to configure your firewall, let alone reserve a static public IP. 4. It's an eternal problem that isolates itself from any true solution. Any actually good UPnP implementation would just be stuck behind your NAT and firewall. The entire premise "as long as you can control it" is the core issue, and the fundamental reason why NAT is the original sin. Without NAT, there wouldn't be anything to get control of.

throw0101a 1mo ago

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. You can have a stateful firewall that blocks non-established-connection packs and all your publicly addressable devices would not be reachable. NAT ≠ firewall (though they often glommed together on CPEs). And NAT is also giving a false sense of security in some ways: "this device has an RFC 1918 address so is not reachable, and therefore safe". Yeah, except if another device already on the inside is / gets compromised. Perhaps if everything had a public address folks would be more circumspect.

icedchai 1mo ago
Generally, firewalls aren't going to save you from an internal compromise either. Are you giving each device its own VLAN, subnet, etc?
- throw0101a 1mo ago
  > Generally, firewalls aren't going to save you from an internal compromise either. Right, but it's easy to get in the mindset that because devices are on the "inside" network they are safer. This is the risk that NAT brings: RFC 1918 = safe(r). If every device has a 200::/3 address, then even if there's a SPI firewall which prevents external connections, it may help to reduce this inside/outside thinking.

matheusmoreira 1mo ago

Regular NAT is not fine at all. It adds needless friction and complexity. Networking is complex and annoying enough without it. IPv6 just works. DNS gives me the address and that's it, I am now talking to my remote computer.

why_at 1mo ago

I think it's hard for us to imagine what we could have if not for NAT. Just as an example, any device on your home network could have a web interface which you could access from anywhere using a web browser. All the smart light bulbs and things which need some stupid account on some service could be made so they're controlled by the user instead of some company. I've set up things like this on my home network but it's a pain because I need to deal with port forwarding, and if I have more than one device I need to use a reverse proxy.