Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world in which IPv6 was a good design

apenwarr.ca

Post reply on HN
Print view View original

71–80 of 199 posts

Re: The world in which IPv6 was a good design

#71

Post by zAy0LfpBZLC8mAC »

gue5t wrote: post #37
jah6q wrote: post #5

Earlier quoted context omitted.

Check out ZeroTier It implements a virtual ethernet layer using cryptographic identities underneath. Here's the relevant section on the address computation from the manual: https://www.zerotier.com/manual.shtml#2_1_2

This seems really complicated. Is ZeroTier closer to an cjdns- / i2p-style system, or is it closer to CurveCP/MinimaLT/QUIC? (QUIC being the odd one out of the trio as it grafts on some awful HTTP semantics, but that's Google for you.)

> QUIC being the odd one out of the trio as it grafts on some awful HTTP semantics, but that's Google for you.

What specifically do you mean by that, and are you sure that it still applies to the IETF version?

Re: The world in which IPv6 was a good design

#72

Post by zAy0LfpBZLC8mAC »

tardo99 wrote: post #56

What if the server needs to send you a packet while you're mobile but you haven't sent it a packet yet so it can update its cache? That packet will be lost in his scheme. Nice try.

In a sensible (i.e., NAT-free) world, the end point knows when its global address changes, which it can use to trigger an address update to its peer.

Re: The world in which IPv6 was a good design

#73

Post by beagle3 »

beagle3 wrote: post #70

I am very glad IPv6 didn't catch on. The world in which it was designed was not a world in which everyone (NSA, Google, Facebook) was trying to document and correlate every tiny thing you do, whether it is related to them or not. If IPv6 eventually becomes widespread, I hope it comes with ISPs that will let you replace your prefix, and phones/hardware that will randomize your suffix - otherwise, the internet becomes…

Would a down voter care to explain why I am so wrong in their opinion?

Re: The world in which IPv6 was a good design

#74

Post by vertex-four »

beagle3 wrote: post #70

I am very glad IPv6 didn't catch on. The world in which it was designed was not a world in which everyone (NSA, Google, Facebook) was trying to document and correlate every tiny thing you do, whether it is related to them or not. If IPv6 eventually becomes widespread, I hope it comes with ISPs that will let you replace your prefix, and phones/hardware that will randomize your suffix - otherwise, the internet becomes…

IPv6 did catch on. Every consumer of the UK's largest broadband services (BT, Sky) now has access to the IPv6 internet. Many, many people across the world have access to it, with clients that prefer connecting to IPv6. And much of the world, especially on mobile but now even on broadband, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only address they actually have.

IPv6 is the only way we're ever going to create working peer-to-peer infrastructure. If you intend to keep anonymous, integrate Tor or HORNET into your protocols.

Re: The world in which IPv6 was a good design

#75

Post by okket »

anilgulecha wrote: post #68

One big UX mistake of IPv6: it was not made backward compatible with IPv4. (v6)0.0.192.168.1.10 == 192.168.1.10(v4). This simple design when planning and rolling it out would have meant incrementally updating the networking stack to also support v6. Now it turns out v4 and v6 are completely different, and no one has a big enough reason to make the change until everyone else makes the change. Hard chicken-egg problem.

Backwards compatibility can not work. You can not answer an IPv6 packet with IPv4. There is no room in the header for the much bigger source/return address.

You can try to do hacks like NAT (like you probably do in your home IPv4 network, which breaks/stops any peer-2-peer protocol). The IPv6 version is called DNS64/NAT64, and it breaks even more things, e.g. DNSSEC. Because it not only requires network address translation (lying about your IP), but also rewriting DNS records (lying about signed DNS records).

The only sane way forward is get rid of IPv4 as fast as possible (even if 'fast' means a decade or two).

Re: The world in which IPv6 was a good design

#76

Post by beagle3 »

vertex-four wrote: post #74
beagle3 wrote: post #70

I am very glad IPv6 didn't catch on. The world in which it was designed was not a world in which everyone (NSA, Google, Facebook) was trying to document and correlate every tiny thing you do, whether it is related to them or not. If IPv6 eventually becomes widespread, I hope it comes with ISPs that will let you replace your prefix, and phones/hardware that will randomize your suffix - otherwise, the internet becomes…

IPv6 did catch on. Every consumer of the UK's largest broadband services (BT, Sky) now has access to the IPv6 internet. Many, many people across the world have access to it, with clients that prefer connecting to IPv6. And much of the world, especially on mobile but now even on broadband, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs f…

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing.

> And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only address they actually have.

And that's a great thing, if you care about privacy (and I do). And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends, and if you want a public IPV4 address, the going rate wherever I look is about $1/month.

> IPv6 is the only way we're ever going to create working peer-to-peer infrastructure

We practically have less-than-perfectly-but-still working peer to peer; the lack of immediately direct connection is not, I believe, what's stopping "working peer to peer" from happening -- the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25, and for good reasons - most users cannot be trusted to run an addressable peer. So with IPv6 it would be technically easier to p2p, but practically the same as it will be firewalled by the ISPs.

And the price for this improvement will be utter complete tracability of your actions among every website -- right now, google and facebook can only (easily) exchange info about you if you gave enough of it to them, or if they decide to share cookies (which you can see and stop). On IPV6, it would be enough for them (and wikipedia, and ISPs and everyone else) to just trade access logs.

Re: The world in which IPv6 was a good design

#77

Post by bewo001 »

loeg wrote: post #15
Aloha wrote: post #8

Part of the difficulty here - is you're not just upgrading the whole stack, you're instead layering on whatever stack is already there - its a needed part of deploying any new technology without replacing everything from the basement up. I'm not sure what this guy would do instead however - as someone with a decent networking background, I got completely lost in the end.

The author has a verbose writing style, and may not be a genius, but they are clearly familiar with networking protocols and do a good job explaining the general scene and history.

Well he doesn't seem to be aware of all the ID/Locator split discussions in the IETF (see HIP, LISP, ILNP).

Mobile QUIC will give Google even more insight about how users move from network to network..

Mobile IP didn't fail because the latency was too bad. It failed because there was financially viable use case. The mobile providers wanted a purely network-based roaming solution to control the billing model. WiFi vendors couldn't count on OS support of mobile IP, so they went for L2 solutions. Because there were L2 solutions, the OS vendors didn't bother to implement mobile IP.

Re: The world in which IPv6 was a good design

#78

Post by Dagger2 »

beagle3 wrote: post #76
vertex-four wrote: post #74

Earlier quoted context omitted.

IPv6 did catch on. Every consumer of the UK's largest broadband services (BT, Sky) now has access to the IPv6 internet. Many, many people across the world have access to it, with clients that prefer connecting to IPv6. And much of the world, especially on mobile but now even on broadband, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs f…

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing. > And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only ad…

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way.

Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

Re: The world in which IPv6 was a good design

#79

Post by vertex-four »

beagle3 wrote: post #76
vertex-four wrote: post #74

Earlier quoted context omitted.

IPv6 did catch on. Every consumer of the UK's largest broadband services (BT, Sky) now has access to the IPv6 internet. Many, many people across the world have access to it, with clients that prefer connecting to IPv6. And much of the world, especially on mobile but now even on broadband, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs f…

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing. > And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only ad…

> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing

Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken.

> And that's a great thing, if you care about privacy (and I do).

It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript.

Again, if you want to be anonymous on the internet, use Tor. It accomplishes what you're looking for in a NAT to a much better degree. If you want to keep other users' privacy, encourage the use of onion routing in new protocols, and encourage the use of Tor to access the legacy internet.

> And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends

Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system.

> the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25

And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented.

FTR, they block incoming port 80 because they want to maintain an artificial differential between "consumer" and "business", not any security rationale - most of the rest of the world doesn't do that, they just have a firewall blocking everything incoming on the ISP-provided router by default, and you can unfirewall port 80 if you want to. Blocking outgoing port 25, otoh, is done because SMTP is a terrible protocol that by default assumes every node on the internet is trustworthy, and ISPs were roped in to ensure nobody ever had to change it.

Post reply on HN