Dagger2

52 ms·

631.
by Dagger2 6y ago
I would argue this is barely the default these days. Windows, OS X, and on the Linux side network-manager, dhcpcd, systemd-networkd etc all have privacy addresses enabled by default. Many OSs/distros also have RFC7217-style addresses e
632.
by Dagger2 6y ago
And weirdly, it's not even very different to v4. Most parts of v6 work exactly the same as they do in v4. Most other L3 protocols we've used have been far more different than these two are.
633.
by Dagger2 6y ago
If we're going to talk about "need", then you don't even need a computer. You could walk over to the rack and watch the yougram on its management console. But there are advantages to having a computer. Similarly, there a
634.
by Dagger2 6y ago
He's wrong. Not only do we have a lot of space in 2000::/3, but we also have five completely untouched /3s available, so if we do somehow run out of space in 2000::/3 we can always start using one of those /3s with
635.
by Dagger2 6y ago
That's an RFC1918 IP. I'm not going to be able to reach it from here. So long as you aren't also running a firewall, your ISP or anyone on your immediate upstream network could reach it just fine though. If you get me access
636.
by Dagger2 6y ago
`telnet <IP of destination device> <port>` will do the job.
637.
by Dagger2 6y ago
You could manage that with hashed emails by separately storing the case of letters in the user part, without storing which letters it's referring to. You could then apply that case to the user-provided email during checkout. (You could
638.
by Dagger2 6y ago
NAT can't prevent inbound connections, so... no, the first line of defence for most personal computers and personal devices on the internet, in the real world where normal people live, cannot be NAT. It's just not a thing that it
639.
by Dagger2 6y ago
Privacy addresses rely on SLAAC, which requires /64s, which means you have a 2^64 space to pick random addresses from. I'd expect collisions to be rare up to about the square root of that (essentially this is a birthday attack), i
640.
by Dagger2 6y ago
It doesn't even give that. Stateful NAT necessitates state tracking but doesn't require a stateful firewall. I've tested it -- NATing the outbound connections from your router has no impact whatsoever on inbound connections
641.
by Dagger2 6y ago
Even 1 second is already pretty severe bufferbloat, let alone 30 seconds. Your latency should increase by under 25-125ms even with upstream and downstream both running flat out.
642.
by Dagger2 6y ago
Nope, the WAN and LAN networks need to use different, non-overlapping network ranges. The only automated way to get the LAN prefix is to ask the ISP via DHCPv6-PD. Routing in v6 is exactly the same as in v4. If your ISP gives you 203.0.113.
643.
by Dagger2 6y ago
You can listen to RAs on your router's WAN interface, which may tell you the WAN subnet, but they won't tell you anything about the routed prefix which is what you use for networks on the LAN side of the router. The only way to ge
644.
by Dagger2 6y ago
"Components" may have been the wrong term. I meant to say that you can give WEs access to something that lets them access the same things that JS running in the browser can. My understanding is that this is currently most easily d
645.
by Dagger2 6y ago
Sort of? But the amount of effort required is much higher. Source patches require having a full dev environment, it takes much longer to build the entire browser and you also have to take on responsibility for rebasing onto upstream, dealin
646.
by Dagger2 6y ago
You did, though. You can just add a WE permission that gives them access to |Components|, like Mozilla's own WEs can already get when they need it. You're choosing not to do that.
647.
by Dagger2 6y ago
Exactly. There's no such thing as an average user: https://www.thestar.com/news/insight/2016/01/16/when-us-air-... If you design your thing for the average user, it won't work well for an
648.
by Dagger2 6y ago
I read most reddit posts that mention IPv6, as well as comments on any blog post, news story etc that makes the rounds. People bitch and moan about every little problem with v6, including blaming it for problems caused by v4 or by complet
649.
by Dagger2 6y ago
You said you'd be dropping all v6 packets, not just incoming connections. Not quite the same thing.
650.
by Dagger2 6y ago
Security is provided by a firewall. But a lot of IoT botnet stuff comes from people opening inbound connections to their cameras/NASs/etc so they can access them from elsewhere. These are hosts where the network security has been
651.
by Dagger2 6y ago
There's a fair few ISPs changing the prefix every day, but this is the first I've heard of anyone changing it every half an hour. If it was common I would've heard a lot of complaining about it by now.
652.
by Dagger2 6y ago
You don't even need an outbound connection. If your router receives a packet with a dest IP set to one of your LAN machines, it'll be routed to that LAN machine. NAT does nothing to stop that, and thus does nothing for (this aspec
653.
by Dagger2 6y ago
/64 is a subnet . End customers get /56 to /48 so that they can run multiple subnets. It is, unfortunately, more common than it should be for ISPs to not even give the minimum of that range though. Changing your prefix every
654.
by Dagger2 6y ago
That would just lower the number of samples though. For the blocking to drive the v6 percentage down, it would have to happen more often on v6 than on v4. ...which is certainly possible, but just "Google is blocked" alone doesn&#x
655.
by Dagger2 6y ago
And ISPs are figuring it out. All you need to do is leave v6 on in the routers they ship out. But if you're running your own router then you're taking over part of the responsibility, so you need to handle your part of it.
656.
by Dagger2 6y ago
It's an internal network if it's inside your networking perimeter. The type of addresses you use on it are irrelevant to that. Most enterprise networks need to be routed to other networks -- either other networks inside the enterp
657.
by Dagger2 6y ago
As a side benefit of v6, it makes it harder to find unprotected machines due to the vastly increased address space. Obviously that doesn't make those machines secure, but an insecure machine that hasn't been exploited is better th
658.
by Dagger2 6y ago
There's almost certainly more data in each entry than just the IP addresses, so it won't be 8x. NAT also requires a second set of entries to track the NAT session, which further equalizes it.
659.
by Dagger2 6y ago
DS-lite gives you a v6-only internet connection. v4 is provisioned as a service over the top of that, using a tunnel between your router and a server inside the ISP. The underlying network is v6, so a router without DS-lite support will onl
660.
by Dagger2 6y ago
You haven't seen the full depths of it then. I originally wrote "a giant headache that never goes away", but changed it because it is possible to renumber the networks. But... that doesn't properly fix the problem. Y

More ›