3 ms·

The designers of the internet made one fundamental mistake, namely applying meatspace norms to cyberspace. In the "real world", you don't really need that much

The designers of the internet made one fundamental mistake, namely applying meatspace norms to cyberspace. In the "real world", you don't really need that much security. Your actual security comes from the fact that all the worst criminals are already locked up, most of the would-be criminals are afraid of being locked up, and if somebody does actually commit a crime, they will get locked up and won't be able to do it again for a good while. A lot of real-world security is about post-factum detection (think alarms, CCTV, panic buttons etc), because in the real world, detection and prevention are two sides of the same coin. This only works because if a real-world crime happens, the criminal by definition is in the same location as the victim, and law enforcement cares most about the community they serve. If the criminal is across the world, as is the case in cyberspace, even if it's a friendly country, it's often "not their problem". This means internet systems need actual security, and NAT provides exactly that. If not for NAT, we'd all need a firewall, and things would be almost if not exactly the same. In the real world, "leave things relatively open, because locks are mostly for keeping honest people honest" is a valid strategy. This strategy doesn't work on the internet.

baron3dl 2mo ago
I think about this frequently. IMO, geographic sparsity is the biggest difference. Every malcontent on the planet just can't reach my door, and the physical reality of movement through space means they can't reach my door, AND every other door on the planet, in the same way they can reach every IP, or practically every IP. There's probably a field of study with vocabulary and accompanying proofs of significant rigor that prove or disprove this. Maybe they'll stop by our little subthread and clear it up.
api 2mo ago
Uhh... you can have a firewall without NAT, including one at the perimeter. This is a very common misunderstanding. NAT and firewalls are separate concepts. You can also have NAT with no meaningful firewall -- a port remapping NAT that allows anything through. Most IPv6 networks are firewalled but there's no NAT.
- tptacek 2mo ago
  I think this is not really a good way to divide up the space. It's obviously true that there are non-NAT firewalls. But NAT was introduced as a firewalling technique. In the first decade of firewalls, there was a whole taxonomy of different kinds of firewalls: application layer gateways, packet filters, "stateful" packet filters, and, yes, NAT.
tom_alexander 2mo ago
> If not for NAT, we'd all need a firewall You still need a firewall regardless of NAT. Otherwise, every time you take your computer outside of your home, you're no longer protected. Any attacker or compromised device on your hotel, airport, or coffee shop wifi network would have direct access to your machine.
ElectricalUnion 2mo ago
> If not for NAT, we'd all need a firewall A NAT implementation could broadcast any "WAN" side incoming packets to all link local clients (aka: put everyone in the DMZ). The only thing preventing that is a stateful firewall.

baron3dl 2mo ago

I think about this frequently. IMO, geographic sparsity is the biggest difference. Every malcontent on the planet just can't reach my door, and the physical reality of movement through space means they can't reach my door, AND every other door on the planet, in the same way they can reach every IP, or practically every IP. There's probably a field of study with vocabulary and accompanying proofs of significant rigor that prove or disprove this. Maybe they'll stop by our little subthread and clear it up.

api 2mo ago

Uhh... you can have a firewall without NAT, including one at the perimeter. This is a very common misunderstanding. NAT and firewalls are separate concepts. You can also have NAT with no meaningful firewall -- a port remapping NAT that allows anything through. Most IPv6 networks are firewalled but there's no NAT.

tptacek 2mo ago
I think this is not really a good way to divide up the space. It's obviously true that there are non-NAT firewalls. But NAT was introduced as a firewalling technique. In the first decade of firewalls, there was a whole taxonomy of different kinds of firewalls: application layer gateways, packet filters, "stateful" packet filters, and, yes, NAT.

tom_alexander 2mo ago

> If not for NAT, we'd all need a firewall You still need a firewall regardless of NAT. Otherwise, every time you take your computer outside of your home, you're no longer protected. Any attacker or compromised device on your hotel, airport, or coffee shop wifi network would have direct access to your machine.

ElectricalUnion 2mo ago

> If not for NAT, we'd all need a firewall A NAT implementation could broadcast any "WAN" side incoming packets to all link local clients (aka: put everyone in the DMZ). The only thing preventing that is a stateful firewall.