Dagger2

17 ms·

301.
by Dagger2 2y ago
It's possible to get to your computer without hacking the "NAT server", but I'm not in a position to do it. There's no point setting up a demonstration if you don't make it possible for me to actually do the de
302.
by Dagger2 2y ago
Their router needs to know what devices are behind it so it can route to them. But if by "their router" you meant "your router"... your ISP doesn't need to know at all. They send all traffic for your prefix to your
303.
by Dagger2 2y ago
They aren't doing that though. The most common NAT (PAT) configurations don't deny unsolicited inbound traffic. They are of course commonly deployed together with a firewall that does deny that traffic, but claiming that NAT block
304.
by Dagger2 2y ago
Then you're back at having "two internets" again. (Well, I don't agree that it's two Internets, but you'd be stuck with the same situation we have already because people would continue to use v4 in order for th
305.
by Dagger2 2y ago
"Simply" is doing a lot of heavy lifting there. There are multiple v6 prefixes already allocated for containing the v4 space. It would help if all ISPs ran NAT64 routers on the standard NAT64 prefix, but e.g. how would that func
306.
by Dagger2 2y ago
v6 is not inherently privacy busting. It's just an IP. Worry about browser cookies and phone apps sending tracking IDs, not the randomized and non-persistent IPs they're sending them from.
307.
by Dagger2 2y ago
It doesn't do that. It rewrites the source address that outbound connections appear to come from; it doesn't implement any kind of access control. Take two networks that are identical, except one is doing NAT and one isn't, a
308.
by Dagger2 2y ago
Only accept_ra=0 is actually needed for static config. autoconf is de-facto disabled if RAs aren't being processed, and DAD is a separate thing (but relevant to the grandparent since it takes a few seconds to finish). Although I'd
309.
by Dagger2 2y ago
The 64-bit host space is used by SEND to hold a cryptographic key as part of a method of securing neighbor discovery. 16 or 32 bits would be laughably inadequate for that. It's also used as a passive defence against IP scanning, making
310.
by Dagger2 2y ago
No, v6 addresses are assigned by (or chosen based on) the current network, not permanently associated with a given system. They aren't MAC addresses or unique identifiers.
311.
by Dagger2 2y ago
FWIW IPv6 can handle this scenario just fine, by letting you take your home IP with you when you move to other networks. I don't think "v6 is a relic of a bygone era" is fair to say when it has a way to handle this exact pr
312.
by Dagger2 2y ago
"PAT" is not doing any firewalling either. (It does rely on state tracking, which it shares in common with stateful firewalls, but you could run a LAN with either a stateless firewall or no firewall if you really wanted to meet th
313.
by Dagger2 2y ago
Well, that's just not true: $ ip -4 addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft fo
314.
by Dagger2 2y ago
It's useful to correct this misunderstanding, because people often take "I've always seen NAT come with firewalling" to mean "firewalls are impossible without NAT". You quite regularly see people pop up in thes
315.
by Dagger2 2y ago
Many already support SOCKS, but not this 4-layer thing you're suggesting. How can a device, application, whatever that doesn't have support for this use it to handle longer addresses? How can it communicate with a remote node that
316.
by Dagger2 2y ago
NAT is useless for that. Firewalls are the tool for blocking connections.
317.
by Dagger2 2y ago
Applications don't support it either, and if the hardware is seeing normal v4 then you're limited to sending to v4 destinations. How is this helping?
318.
by Dagger2 2y ago
Yes, v6 is backwards compatible with v4 now, via dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6 and probably other methods I'm forgetting. In fact many of
319.
by Dagger2 2y ago
It's not being used to tag you. ARIN just happen to have 2600::/12 and various US ISPs got allocations from the beginning of it, which they use.
320.
by Dagger2 2y ago
But no v4 devices support this "four socks requests wrapped like an onion" thing you're proposing, so how would they work with it?
321.
by Dagger2 2y ago
I've been using this: javascript:(function() { for (var n of document.querySelectorAll('a, p, li, div')) { n.style.color = (n.nodeName == 'A' ? 'LinkText' : 'CanvasText'); n.style.backgroun
322.
by Dagger2 2y ago
It doesn't even do that much. NAT is something you apply to outbound connections, not to inbound ones. Unless there's a firewall blocking it, you can connect inwards over a router that's NATing its outbound connections.
323.
by Dagger2 2y ago
NAT is actually less restrictive for inbound connections, because it allows people to connect with just the correct port and not the correct IP+port. Instead of needing to provide the correct 80-bit number to connect, they only need the c
324.
by Dagger2 3y ago
"Why is there a sudden epidemic of spacecraft rolling on the moon like Olympic gymnasts performing floor routines?" That's not how statistics work. We don't have a "sudden epidemic", we just happened to get unl
325.
by Dagger2 3y ago
You say "back" to work, but not only did you go to HN to post this instead of to work, I'm pretty sure you started on HN in the first place.
326.
by Dagger2 3y ago
It's sucky in homes and offices too. It's not hard to test if your firewall is working. Using NAT to avoid that is not the sensible approach.
327.
by Dagger2 3y ago
NAT isn't a nice feature, it's a necessary evil to deal with address exhaustion in v4 and causes many problems of its own. Using it in v6 makes no sense. It doesn't have a "default deny" behavior -- NAT doesn't
328.
by Dagger2 3y ago
The general approach is to gradually expand the size of a block to cover more subnets if needed, e.g. three /64s banned from the same /60 -> ban the /60, and three /60s banned from a /56 -> ban the /56, o
329.
by Dagger2 3y ago
One provider without v6 doesn't mean that most providers don't have v6.
330.
by Dagger2 3y ago
...network effects? There are still people with legacy v4-only clients, which can never reach anything other than v4, or on v4-only ISPs. There are enough of them at the moment that we still need to support them. This isn't hard to fig

More ›