5 ms·

> I know this idea has long missed the boat, but why wasn't IPv4 address space extended by adding an IPv4 Option header that could carry extra address bits? Be

> I know this idea has long missed the boat, but why wasn't IPv4 address space extended by adding an IPv4 Option header that could carry extra address bits? Because that wouldn't be compatible with existing IPv4 deployments and would cause a reliability havoc when a node not configured to deal with it mangled packets transparently somewhere in between your source and destination end-points. I don't get the resistance against IPv6. It works. It's a fresh take. Yes it requires some new stuff to be deployed and configured here and there, maybe even requires you to learn something new, but if you thought extending IPv4 would have been any other way you are deluding yourself. If you're going to do a significant change to something as big as the internet (and introducing a new address scheme is that, no matter how you implement it), you might as well step back and think it all through instead of applying yet another hack. So tell me. Why are you opposed to IPv6? Why do you want to hang on to this old IPv4-thing which is already at the bursting point, at the edge of what it can take?

mirimir 11y ago
> So tell me. Why are you opposed to IPv6? I'm very concerned about implications for anonymity. If every device has a unique IPv6 address, then just one leak can compromise all other anonymized connections.
- xorcist 11y ago
  Check out RFC 4941, "Privacy Extensions". It's probably already implemented on the computer you're using right now.
  - spystath 11y ago
    You can still track the prefix though. In a standard /64 deployment only the suffix will change so there is still some information leaking if you have a static prefix (obviously, as in static IPv4). However, my ISP defaults to dynamic /64 prefix unless you opt in for static prefix. I believe most ISPs should probably do the same.
    - wtbob 11y ago
      If you have a dynamic prefix then you can't (easily) run servers; you'd need some sort of dynamic DNS as well. And if you have dynamic DNS and dynamic reverse-resolution…there goes anonymity anyway. IP isn't anonymous; it wasn't designed to be, and probably (given the problems it's trying to solve) shouldn't be. Anonymity should be an overlay.
      - spystath 11y ago
        If you run a server you pretty much need to expose your IP one way or another anyway, even in IPv4. Well, I suppose you can use something like dynamic dns but still... I totally agree, though, anonymity is not part of IP. I was not implying that, just that there are still ways for home users to somehow shuffle their IPs within the IPv6 framework.
        mirimir 11y ago
        If I need to run a server, I anonymously lease hosted VPS or whatever, and SSH via Tor. My concern is keeping my personal Internet connectivity anonymous. I use nested VPN chains, generally using pfSense VMs as VPN clients, and Tor. I get that the Tor Project is working on IPv6. But I also want IPv6 NAT, in pfSense or whatever. That's to keep my local device IPv6 addresses (hosts and VMs) private, even from Tor entry guards. I guess that it's time to learn how to ensure that.
- dlitz 11y ago
  No version of IP provides anonymity reliably. If you want anonymity, use something designed for that purpose, like Tor, use it from a coffee shop, and pay cash.
- hobarrera 11y ago
  > I'm very concerned about implications for anonymity. If every device has a unique IPv6 address, then just one leak can compromise all other anonymized connections. IPv4 did not offer any anonymity. The closest you get to that, is an external entity being unable to differentiate the traffic you make vs the one your family makes.
rwmj 11y ago
I'm not opposed to IPv6. Indeed, I'm one of the few % of people who has a dual-stack home network and ISP. However I don't pretend it was easy to set up - I'm no novice, yet several aspects still confounded me and the large Fedora community that I asked: http://www.spinics.net/linux/fedora/fedora-users/msg459370.html http://www.spinics.net/linux/fedora/fedora-users/msg459370.h... (tldr: It's 2015, yet the default firewall in a major Linux distro can't handle IPv6)

mirimir 11y ago

> So tell me. Why are you opposed to IPv6? I'm very concerned about implications for anonymity. If every device has a unique IPv6 address, then just one leak can compromise all other anonymized connections.

xorcist 11y ago
Check out RFC 4941, "Privacy Extensions". It's probably already implemented on the computer you're using right now.
- spystath 11y ago
  You can still track the prefix though. In a standard /64 deployment only the suffix will change so there is still some information leaking if you have a static prefix (obviously, as in static IPv4). However, my ISP defaults to dynamic /64 prefix unless you opt in for static prefix. I believe most ISPs should probably do the same.
  - wtbob 11y ago
    If you have a dynamic prefix then you can't (easily) run servers; you'd need some sort of dynamic DNS as well. And if you have dynamic DNS and dynamic reverse-resolution…there goes anonymity anyway. IP isn't anonymous; it wasn't designed to be, and probably (given the problems it's trying to solve) shouldn't be. Anonymity should be an overlay.
    - spystath 11y ago
      If you run a server you pretty much need to expose your IP one way or another anyway, even in IPv4. Well, I suppose you can use something like dynamic dns but still... I totally agree, though, anonymity is not part of IP. I was not implying that, just that there are still ways for home users to somehow shuffle their IPs within the IPv6 framework.
      - mirimir 11y ago
        If I need to run a server, I anonymously lease hosted VPS or whatever, and SSH via Tor. My concern is keeping my personal Internet connectivity anonymous. I use nested VPN chains, generally using pfSense VMs as VPN clients, and Tor. I get that the Tor Project is working on IPv6. But I also want IPv6 NAT, in pfSense or whatever. That's to keep my local device IPv6 addresses (hosts and VMs) private, even from Tor entry guards. I guess that it's time to learn how to ensure that.
dlitz 11y ago
No version of IP provides anonymity reliably. If you want anonymity, use something designed for that purpose, like Tor, use it from a coffee shop, and pay cash.
hobarrera 11y ago
> I'm very concerned about implications for anonymity. If every device has a unique IPv6 address, then just one leak can compromise all other anonymized connections. IPv4 did not offer any anonymity. The closest you get to that, is an external entity being unable to differentiate the traffic you make vs the one your family makes.

rwmj 11y ago

I'm not opposed to IPv6. Indeed, I'm one of the few % of people who has a dual-stack home network and ISP. However I don't pretend it was easy to set up - I'm no novice, yet several aspects still confounded me and the large Fedora community that I asked: http://www.spinics.net/linux/fedora/fedora-users/msg459370.html http://www.spinics.net/linux/fedora/fedora-users/msg459370.h... (tldr: It's 2015, yet the default firewall in a major Linux distro can't handle IPv6)