Dagger2

40 ms·

571.
by Dagger2 5y ago
It doesn't do that. How can rewriting the source address of outbound connections prevent inbound connections? You're not going to exhaustively scan the entire v6 space in any short amount of time. It is possible to whittle down th
572.
by Dagger2 5y ago
"Rated for 20A" means that putting 20A through the cable will heat it to the maximum rated temperature, which is ~90C for that type of cable. Heating all of your house wiring to 90C is a) dangerous, and b) expensive. Even if you&#
573.
by Dagger2 5y ago
This is not actually true. NAT rewrites the apparent source address of outbound connections, which has no impact on inbound connections -- any inbound connection that worked before you started NATing your outbound connections will continue
574.
by Dagger2 5y ago
It actually doesn't. NAT just changes the apparent source address of outbound connections; it doesn't do anything to inbound ones. In any case, people manage to do both NAT and firewalls on v4 today so I don't see why they&#x
575.
by Dagger2 5y ago
We deal with it by requiring v4 addresses to be entirely numeric, which... well, it's possible for v6 but would make it even more annoying to type v6 addresses out.
576.
by Dagger2 5y ago
In terms of rate of consumption of the overall address space, it's not. But consumers have started to have more than one device at home -- in fact almost everybody has an entire network with multiple machines these days, so a single ad
577.
by Dagger2 5y ago
I've heard this claim too: apparently Facebook tested a lot of routers, and they consistently routed v6 ~500us faster than v4. v6 has no checksum, so routers don't need to recalculate it when they decrement the TTL header, and it
578.
by Dagger2 5y ago
You do avoid some of the cost, because you can direct a significant amount of your traffic over v6 and not need to CGNAT it. The failure mode for your v6 failing is the same as it is for v4 failing in a v4-only ISP: stuff breaks. If you wan
579.
by Dagger2 5y ago
It shouldn't be any harder to get split-horizon DNS working on v6... and in fact v6 should eliminate the need for it in the first place, since the IP of a computer is just its IP.
580.
by Dagger2 5y ago
The kind of NAT that's widely deployed doesn't act as a firewall though. It buys you nothing from a security perspective. It's entirely possible to connect inwards over a NATing router unless there's also an additional f
581.
by Dagger2 5y ago
Can you suggest a way of extending v4's address space that works like BGP or AMD64 do? I've asked a lot of people this question, and the only answers I've ever gotten are either impossible or already implemented by v6. Perhap
582.
by Dagger2 5y ago
Don't think in terms of addresses. In a hierarchically-allocated and aggregated space like IP addresses, there's a massive difference between 64 bits of address space and 2^64 usable addresses. By the time you've gone through
583.
by Dagger2 5y ago
Sticking with periods was impossible, because many of the resulting addresses would also be valid DNS hostnames.
584.
by Dagger2 5y ago
All 128 bits are usable, it's not limited to just 64. A total length of 64 bits would be too small for the eventual size of the internet. Our choice was between deploying something with too many addresses or something with too few addr
585.
by Dagger2 5y ago
It was never a thing. NAT isn't security.
586.
by Dagger2 5y ago
It is today , but what about at the time it was picked? Software from that era (e.g. telnet) take their hostname/service arguments as two strings (e.g. `telnet 127.1 ssh`). I believe ip:port comes from URLs, the RFC for which was publ
587.
by Dagger2 5y ago
There are latency benefits, which translate into higher user engagement metrics. If your site sells things or has advertising, that means you get more money. See https://pc.nanog.org/static/published/meetings/
588.
by Dagger2 5y ago
It is when you add telemetry to your vegetables. Imagine if your grocery store terms were that you have to pay to take them home... and also that you must consent to a grocery store employee following you home and sitting in your kitchen, w
589.
by Dagger2 5y ago
v6 actually is pretty close to a wider v4. There are very few new things in it, the socket API is the same for both, and parts like addressing and routing work exactly the same. It could've been very different, but it's not. Runni
590.
by Dagger2 6y ago
Sounds like a good opportunity for an IPv6-only version at a discount/lower minimum. Many people (Google says 45% in the US) don't need servers to have v4 these days.
591.
by Dagger2 6y ago
I have. Not on the scale of AWS or GCP, admittedly. Those networks are Special because they run on custom hardware and can't take advantage of the work other people have done. But that's kinda their fault for not just doing their
592.
by Dagger2 6y ago
That said, NAT64/DNS64 is v6-only from the perspective of clients on that ISP. The v4 internet will be mapped into a v6 /96, but from the client perspective it's just the same as any other v6 prefix.
593.
by Dagger2 6y ago
You mean like... NAT64? For me, the necessary firewall changes consisted of using "domain (ip ip6)" in ferm instead of "domain ip"; the general config is a few lines in radvd.conf plus a static IP on the LAN interface (a
594.
by Dagger2 6y ago
It's actually very similar to v4, just with more bits. It has an identical network model to v4: routing and address assignment work the same way. It works over the same L2 links as v4, and L4 protocols like TCP and UDP all work the sam
595.
by Dagger2 6y ago
Teredo involves 2001:0::/32, Teredo servers and Teredo relays; connections over Teredo involve doing things like NAT traversal and asking the Teredo server to send a ping on your behalf to the target IP first. Teredo might use IPv6-in-
596.
by Dagger2 6y ago
Terado, Toredo, Terredo, Tedero, Toledo, Tereo, Taredo... it gets misspelt a lot for some reason. (Yes, I've seen all of those in the wild.) Not that there's any Teredo going on in the article...
597.
by Dagger2 6y ago
Have a cookie. 100ms isn't that low, and those NATs are introducing additional latency and complexity that don't need to exist. If both sides are behind NAT then you may well need to relay the connection through a third party serv
598.
by Dagger2 6y ago
That's already quite convoluted, and it means that one remote address can only connect to one of the services at a time and you need to reconfigure your router to change which one. It also gives you no selectivity for remote networks t
599.
by Dagger2 6y ago
And if you don't think Linux and Windows are secure, then you do. Either way, you shouldn't be putting them behind NAT. You should put them behind NAT if you want to connect your network to the internet but you don't have eno
600.
by Dagger2 6y ago
v6 already implements a similar scheme. You set the protocol field in the v4 packet to 41, and then put the v6 addresses at the beginning of the packet payload, with the original packet payload following afterwards. It doesn't seem to

More ›