Live data from Hacker News

The world in which IPv6 was a good design

apenwarr.ca

91–100 of 199 posts

Re: The world in which IPv6 was a good design

#91
post #76

Earlier quoted context omitted.

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing. > And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only ad…

> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken. > And that's a great thing, if you care about privacy (and I do). It's really not. Your ISP can quickly deanonymize you, and there's regu…

> It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript.

Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs for different aspects of my works and life, none with access to hardware acceleration, by using proper web filtering at both the browser and gateway level). They have it easy with the vast majority of the population, no doubt, but for now my actions gets mixed with everyone elses in such a way that Facebook would actually have to assign a person to deanonymize me. Similarly Google.

My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request (I'd be surprised if they actually demand a warrant). Switching to IPv6 would effectively deanonymize me constantly.

> And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented.

That's a great ideal. No, they don't allow all other ports, but what they allow or block varies a lot by service class, area and ISP, and you'd know for sure only after you tried (it used to also change often, but I heard it's converged; I'm not living in the US anymore)

> Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system.

Supernodes were retired because they do not work well anymore (haven't in a few years). I do not find "pay $1/month to provide service" too onerous; there are also public ICE/STUN/TURN.

I find it disingenuous that you completely dismiss the societal cost (privacy), and the engineering costs (the reason IPv6 is still not dominant despite being "in the works" for 20 years now), because some future protocol which had not been shown useful over those 20 years ("research papers waiting to be implemented"). There is enough IPv6 to make the case for the need, and the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago.

Re: The world in which IPv6 was a good design

#92

One big UX mistake of IPv6: it was not made backward compatible with IPv4. (v6)0.0.192.168.1.10 == 192.168.1.10(v4). This simple design when planning and rolling it out would have meant incrementally updating the networking stack to also support v6. Now it turns out v4 and v6 are completely different, and no one has a big enough reason to make the change until everyone else makes the change. Hard chicken-egg problem.

Except people _are_ making the change. When my ISP adopted IPv6, I just started using it. And a significant chunk of my traffic was IPv6. Backwards compatibility would have driven faster adoption, but just was too much of a technical hurdle. Dual-stack however is very possible, and is working to drive adoption. IPv6 usage is increasing. The change is happening.

Re: The world in which IPv6 was a good design

#93
post #78
post #76

Earlier quoted context omitted.

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing. > And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only ad…

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way. Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front.

Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids.

I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries.

edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).

Re: The world in which IPv6 was a good design

#94

That is a beautifully-written article. The IEEE hardware and IETF software guys have been busy adding complexity to the networks, with so many legacy protocols (when everyone just uses TCP/IP) and extra ports (when everything happens on port 80 - seriously, even email is now on cloud services). I can't get LTE because of political problems. So I just gave up trying to be online, and started caching everything possibl…

One look at ntop tells me very little of our traffic is port 80 or 443

Re: The world in which IPv6 was a good design

#97
Interesting article, but it contains some weird statements.

>It is literally and has always been the software-defined network you use for interconnecting networks that have gotten too big. But the problem is, it was always too hard to hardware accelerate, and anyway, it didn't get hardware accelerated, and configuring DHCP really is a huge pain, so network operators just learned how to bridge bigger and bigger things.

IP forwarding (longest prefix match) is more complicated than mac forwarding yes, but it has been done in hardware (ASICs, typically NPUs today) for a long time now. Operators (I assume ISPs) do not build large bridged networks as they need their networks to scale as they grow, or they will hit a breaking point where their network collapses. ISP's typically use centralised DHCP servers (as opposed to configuring their access routers) and configure their routers to use DHCP relay. DHCP server configuration is easily automated by just reading your IPAM data, it's a non-issue.

Re: The world in which IPv6 was a good design

#98
post #4

Earlier quoted context omitted.

Drop the idea of ports too. Every program gets its own IP Mentioning ideas like that at work get queer looks about how it'd be impossible to configure a firewall at that point But keep going further. End up with 128 bit CPU where every byte is IP addressable. Necessary security to block random outsiders from reading your memory, but capable of potentially running various parts remotely transparently

> But keep going further. End up with 128 bit CPU where every byte is IP addressable. Necessary security to block random outsiders from reading your memory, but capable of potentially running various parts remotely transparently This is already a thing: https://en.wikipedia.org/wiki/Remote_direct_memory_access

Cool, although the name sounds much more like a vulnerability than a feature.

Re: The world in which IPv6 was a good design

#99
post #91

Earlier quoted context omitted.

> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken. > And that's a great thing, if you care about privacy (and I do). It's really not. Your ISP can quickly deanonymize you, and there's regu…

> It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs…

> My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request

http://www.bbc.co.uk/news/technology-16721338 - something I remember from recent-ish history. That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it.

> I find it disingenuous that you completely dismiss the societal cost (privacy)

I don't. I think there's other, significantly better solutions for it. I don't think NAT provides reasonable privacy in and of itself.

> the engineering costs

In practice, the fact that it's been spread out over 20 years so far is because that's how long it takes to get round to replacing an entire nation-wide deployment of carrier-grade infrastructure at all unless there's other reasons to do so. Smaller/regional ISPs have been on IPv6 for years now, partially because buying enough IPv4 space would be prohibitively expensive and partially because there's no reason not to. The technical details of IPv6 support were resolved in pretty much all networking kit a long, long time ago - it's a marginal cost at this point. The rest of it is primarily planning, testing, and replacing ancient consumer routers.

> the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago

And yet I can't get a real IP address for most of the things I'd like to. My ISP tries its hardest not to sell IPv4 addresses to anyone (it can't buy them quickly enough, and buying them is a huge resource drain - they lose money on every address sold, which is then made back up in subscription costs), let alone "home" users. On the other hand, it literally gives out static IPv6 ranges if you ask nicely.

Re: The world in which IPv6 was a good design

#100
post #55

>And nowadays big data centers are basically just SDNed, and you might as well not be using IP in the data center at all, because nobody's routing the packets. It's all just one big virtual bus network. The opposite trend is true in large data centers. L3 fabrics where everything is routed have become extremely popular because BGP (or custom SDN setups) can be used to migrate IPs and you get to utilize multiple paths…

This is extra delicious irony given the fact that the typical, and often only, requirement for these SDN layers is IP connectivity.
Post reply on HN