Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

By installing NAT, MIT stifles innovation

blog.achernya.com

Post reply on HN
Print view View original

51–60 of 188 posts

Re: By installing NAT, MIT stifles innovation

#51

Post by imjustapie »

new299 wrote: post #43
imjustapie wrote: post #32

Earlier quoted context omitted.

But why is MIT making money on those addresses more valuable than giving its students an opportunity to experiment and innovate? Why would selling those "unused" spaces to Amazon further the cause of IPv6? Also MIT hasn't even rolled out IPv6 yet...

Would the logic not be that the money will be spent on more useful things for students?

Perhaps. I haven't seen public discussion on the plans to use the fund though, other than vague promise that it will be used on Internet things.

Re: By installing NAT, MIT stifles innovation

#52

Post by yuhong »

0xdeadbeefbabe wrote: post #14
amq wrote: post #8

I'm all for supporting innovation and community services, but I think author is not mentioning other possible causes, like DMCAs, malware and spam (including unintended), which could have damaged the reputation. I just wonder why MIT didn't give more time to move and why it doesn't provide a replacement in eg cloud credits.

Isn't innovation worth more than the cost of malware, spam, and DMCAs? Edit: In the late 80s the morris worm was launched from MIT, but the network admins of the 80s didn't overreact like this. I wonder why.

Did CIDR even exist in the 1980s, let alone NAT? (They are basically now selling off half of their "Class A" block now to AWS)

Re: By installing NAT, MIT stifles innovation

#53

Post by ocschwar »

Animats wrote: post #41
pdonis wrote: post #35

Earlier quoted context omitted.

> MIT is just moving to IPv6. The "just" is incorrect. There are four bullets on the slide: DHCP, IPV6, private IPV4/NAT, and firewall. From the diagram it looks to me like even if you move to IPV6 (which, as others have noted, MIT has not yet rolled out, so at this point you can't), you will still be behind the firewall, so setting up a service visible to the Internet will still be more difficult than it used to be.

MIT doesn't have IPv6 everywhere yet? That's lame.

MIT just sold off half of its class A subnet.

MIT was always going to be the last place on earth to go total IPv6

Re: By installing NAT, MIT stifles innovation

#54

Post by imjustapie »

Symbiote wrote: post #34
smoyer wrote: post #17

Earlier quoted context omitted.

There are advantages to being on a private network behind a firewall ... and they could still offer a DNS name and routing to your computer if it was on a private network. It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world. This is a win for you from a security perspective - having additional layers of security won't hurt you.

NAT is not an additional layer of security. I run our servers on public IP addresses, behind a firewall. Troubleshooting and debugging is made much easier, and there's never any conflict with VPNs etc. > It's likely that the only difference is that you'd also have to specify what ports you want exposed to the outside world Port 80, please. With NAT, you can't offer that to more than one computer.

You nailed it! Students love that they can just spin up a whole new web server, no questions asked. I certainly won't be where I am on sysadmin-type skills without the kind of tinkering that the un-NAT'd network affords.

Re: By installing NAT, MIT stifles innovation

#55

Post by imjustapie »

unsignedint wrote: post #46
imjustapie wrote: post #40

Earlier quoted context omitted.

But that would just be ridiculous, considering that experimenting with Tor relays is like a favorite student passtime...

You don't need to run a Tor relay in order to run a hidden service. I have thrown in this idea as it's a dead simple (cheap/free, and you don't have to coordinate with anyone) to get your stuff publicly, let alone for experimental purpose.

Sure, but I'm just pointing out an example where MIT students get to be actors as well as playwrights, whereas now one must follow the prescribed lines and mustn't be too naughty.

Re: By installing NAT, MIT stifles innovation

#56

Post by pishpash »

0xdeadbeefbabe wrote: post #14
amq wrote: post #8

I'm all for supporting innovation and community services, but I think author is not mentioning other possible causes, like DMCAs, malware and spam (including unintended), which could have damaged the reputation. I just wonder why MIT didn't give more time to move and why it doesn't provide a replacement in eg cloud credits.

Isn't innovation worth more than the cost of malware, spam, and DMCAs? Edit: In the late 80s the morris worm was launched from MIT, but the network admins of the 80s didn't overreact like this. I wonder why.

MIT is run by corporate shills now driven by profits, and IS&T is just another bureaucracy with its own interests to justify existence.

Re: By installing NAT, MIT stifles innovation

#58

Post by jwilk »

microcolonel wrote: post #31
gocolts23 wrote: post #12

Why does this blog require javascript?

Unfortunately because of Google. Dunno why they did that, it doesn't make it any better; but it's not really the author's fault either.

It's not obligatory to use Google products for your blog.

Re: By installing NAT, MIT stifles innovation

#59

Post by imjustapie »

rspeer wrote: post #48
pdonis wrote: post #35

Earlier quoted context omitted.

> MIT is just moving to IPv6. The "just" is incorrect. There are four bullets on the slide: DHCP, IPV6, private IPV4/NAT, and firewall. From the diagram it looks to me like even if you move to IPV6 (which, as others have noted, MIT has not yet rolled out, so at this point you can't), you will still be behind the firewall, so setting up a service visible to the Internet will still be more difficult than it used to be.

The post isn't objecting to the firewall, though. I totally understand the need for a campus-wide firewall. The MIT network is a juicy target for botnets, and individual students are not good enough at running security on their own computers. The old approach to IP assignment was that you needed to get your IP approved and made routable by IS&T anyway, and if they detected botnet activity on your computer, they'd man…

Even in the old approach, you get publicly routable addresses over DHCP. The approval was for static addresses only, and was very fast, because you're literally on the same network as the DHCP addresses.

If they detect bad activity, they blacklist your MAC address so you can't connect. This is no different under the new scheme, and has nothing to do with NAT.

Re: By installing NAT, MIT stifles innovation

#60

Post by throwaway2048 »

ghshephard wrote: post #45

Wow - 2603:4000::/24. That's the largest block of IPv6 addresses I'm aware of being handed out to a single entity. Normally, ISPs get a /32, from which, they hand out /48s to their customer. And, with pretty much zero paper work, and ISP can get a second /32 (usually adjacent with their first /32 so they can summarize as a /31). So - an ISP might get 2001:1868::/32 and then hand off 2001:1868:0209::/48 to a customer.…

It has nothing to do with amounts of addresses, and everything to do with making dividing stuff up for routing easier.

A large ISP entity like comcast or AT&T can now have say a single /16 or /24 allocation and pretty much no matter how much they subdivide up their regional routing, routing to AT&T can easily be coalesced and summarized , and every end customer can still get a /64 till pretty much the end of time.

Post reply on HN