Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world in which IPv6 was a good design

apenwarr.ca

Post reply on HN
Print view View original

111–120 of 199 posts

Re: The world in which IPv6 was a good design

#111

Post by ioquatix »

anilgulecha wrote: post #68

One big UX mistake of IPv6: it was not made backward compatible with IPv4. (v6)0.0.192.168.1.10 == 192.168.1.10(v4). This simple design when planning and rolling it out would have meant incrementally updating the networking stack to also support v6. Now it turns out v4 and v6 are completely different, and no one has a big enough reason to make the change until everyone else makes the change. Hard chicken-egg problem.

One case where I found IPv6 great was on my home network. All my systems have IPv6 addresses and I can ssh into them from a remote network which also supports IPv6. I don't need any NAT. But, I do have an IPv6 firewall of course.

Re: The world in which IPv6 was a good design

#112

Post by beagle3 »

jgrahamc wrote: post #107
beagle3 wrote: post #106

Earlier quoted context omitted.

I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; > DiG 9.7.1-P2 > www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Maybe they hate my ISP, but also anything behind cloudflare…

> Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address. We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4). https://blog.cloudflare.com/98-percent-ipv6/

Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off.

I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement).

Can you share what percentage of customers have IPv6 turned off explicitly?

Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?

Re: The world in which IPv6 was a good design

#113

Post by vertex-four »

beagle3 wrote: post #109
vertex-four wrote: post #99

Earlier quoted context omitted.

> My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request http://www.bbc.co.uk/news/technology-16721338 - something I remember from recent-ish history. That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it. > I find it disingenuous that you completely dismiss the societ…

> That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it. Verizon was also doing this for mobile customers in the US, perhaps still do. I vote with my wallet against these ISPs. You did have some control over it, for example, by using HTTPS. But IPv6 prefixes are so plentiful, that they are assigned one-per-customer which…

> It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them.

Again, we live in a world where CGNAT is a thing. My own ISP puts all IPv4 connections through CGNAT by default unless you explicitly opt out. Many smaller ISPs do the same - one of the new gigabit broadband services in my country will not allocate IPv4 addresses to customers, instead going for CGNAT and requiring an additional payment of £5 a month for an IPv4 address.

Mobile ISPs all implement CGNAT on IPv4 at this point - if they attempted to buy enough address space for every active mobile phone to have an IP, there'd be a serious problem.

Every single user on each of these networks does not have a routable IPv4 address. You cannot make a direct connection to these devices. IPv6 solves that problem.

> What are those other "significantly better" solutions you are aware of?

Tor. Future protocols should integrate HORNET or similar. If you really want a NAT without onion routing, use a VPN that'll do it.

> Likely because you are on a residential ISP

That's literally the point here. There's a differentiation between a "residential ISP" which can only ever consume and never participate as an equal part of the network, and a "business ISP" which is significantly more expensive because it comes with an SLA that I don't need or want.

IPv6 allows me to be an equal part of the network at the same cost as my current broadband service. I can run a website off my raspberry pi without paying anyone a penny. I can SSH/remote desktop into my home machine without having to create a "jump server". I can participate in peer-to-peer networks without depending on the hope that some other people on the network have machines that I can directly connect to, so that nobody else has to directly connect to me.

Re: The world in which IPv6 was a good design

#114

Post by beagle3 »

azernik wrote: post #110
beagle3 wrote: post #105

Earlier quoted context omitted.

Thank you for taking the time to explain. Let me try to word things a little better: What is the percentage of US homes who are on an IPv6? What is the percentage of websites on IPv6? What are the number of web site hits that are IPv6 to IPv6? (in the US? in the world?) The highest estimate I've ever seen for any of these is less than 20%, which - 20 years into IPv6, is in my opinion "not caught on". The mobile world…

Google puts global native IPv6 adoption among their users (i.e. proportion of incoming connections that are IPv6) at 17%-ish and exponentially/logistically increasing; the US numbers are much higher, at around 35% [ https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... ]. These numbers do not distinguish between mobile and fixed clients; I suspect that mobile deployment is higher than residential. The serve…

> IPv6 suffix randomization is enabled by default on Windows, OSX, and iOS. For Android, it probably varies (like everything else) by vendor, but my personal Android phone is using a random suffix. What are the machines you're using that aren't doing this?

I think it was Win7 last I tested it, probably an early service pack; according to https://superuser.com/questions/243669/how-to-avoid-exposing... it should already have had privacy addressing, but perhaps it was somehow turned off on the machine I tested (or perhaps my expectation that it would change on reboot was wrong?).

> The IPv6 prefix you are assigned by your carrier is a feature of whatever DHCPv6 setup they have; if they're assigning you the same prefix for every time you power-cycle your modem on IPv6 and they were not doing so with DHCPv4, that's super weird.

They were allocating from a pool on DHCPv4, where reservations were for a few hours (so immediate power cycle would get same address, but if you wait a couple of hours or release and request, you'd get a new one). They are not using DHCPv6 in the same way - they assign a prefix-per-customer. That was the case with all the local IPv6 carriers I inquired with. I guess it means that the prefix is /56 or even /60 - I didn't even ask.

Re: The world in which IPv6 was a good design

#115

Post by beagle3 »

vertex-four wrote: post #113
beagle3 wrote: post #109

Earlier quoted context omitted.

> That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it. Verizon was also doing this for mobile customers in the US, perhaps still do. I vote with my wallet against these ISPs. You did have some control over it, for example, by using HTTPS. But IPv6 prefixes are so plentiful, that they are assigned one-per-customer which…

> It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them. Again, we live in a world where CGNAT is a thing. My own ISP puts all IPv4 connections through CGNAT by default unless you explicitly opt out. Many smaller ISPs do the same - one of the new gigabit broadband services in my country will not allocate I…

Ok, just to clear up the confusion (because not all posts in this thread use the same terminology):

Home NAT, which is equivalent to suffix randomization, does NOT afford any privacy.

Carrier Grade NAT, which would be equivalent to prefix randomization (if such a thing existed) DOES afford some privacy, provided that care is taken not to leak other data (through cookies, browser fingerprinting, stylometrics, etc).

I am not currently at home behind a CGNAT, because my ISP is apparently IPv4 rich, but they are planning to switch at some point. I am behind a CGNAT on my mobile. I have no problem doing peer to peer on either using a STUN server I run on a $2 VPS that comes with an IPV4 address. I also tunnel ssh to my home through it when I want to.

The same ISP, if I request an IPv6, will give me the prefix it assigned to me the day I signed up. That's how they roll (They actually play it as a feature - "you pay for a fixed IPv4, but you get a fixed IPv6 for free! without even asking!")

IPv6 allows you to play "equal part" - it's routable, yes, but if everyone was equal we would have mob rule by DDoS attacks way worse than we do now (perhaps everyone is equal and we will have them .... if that's the case, it will stop being the case after a few high profile attacks as such).

Also, 99.9% of the people do not know how to secure their networks or devices. If everything was routable, as you seem to desire, I think we'd be worse off. As it is, the local home NATs provide a bit of security (which no one would have designed - we got lucky they were there because of address scarcity) and the CGNATs/random V4 assignment provide a bit of privacy (which got lip service, but would not have been as effective if not for address scarcity).

My threat model includes "$company can track my whereabouts online regardless of what I do about it". Your threat model seems to be "I can't route to my server without another hop". It's not that one is valid and on is invalid - it's just that they are incompatible with each other.

Re: The world in which IPv6 was a good design

#116

Post by vertex-four »

beagle3 wrote: post #115
vertex-four wrote: post #113

Earlier quoted context omitted.

> It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them. Again, we live in a world where CGNAT is a thing. My own ISP puts all IPv4 connections through CGNAT by default unless you explicitly opt out. Many smaller ISPs do the same - one of the new gigabit broadband services in my country will not allocate I…

Ok, just to clear up the confusion (because not all posts in this thread use the same terminology): Home NAT, which is equivalent to suffix randomization, does NOT afford any privacy. Carrier Grade NAT, which would be equivalent to prefix randomization (if such a thing existed) DOES afford some privacy, provided that care is taken not to leak other data (through cookies, browser fingerprinting, stylometrics, etc). I…

> Also, 99.9% of the people do not know how to secure their networks or devices.

I take it that you've never heard of a firewall on your router. Mine ships default deny. I assume yours does too.

Re: The world in which IPv6 was a good design

#117

Post by detaro »

beagle3 wrote: post #105
azernik wrote: post #82

Earlier quoted context omitted.

Because a) statements in your comment are false, b) some proposals in your comment have already been implemented, and c) the ones that haven't are bad ideas. IPv6 has caught on (I'm commenting from an IPv6-only connection right now, on a residential US ISP). Most clients do perform RFC4941 suffix randomization. Replacing the prefix destroys one of the most useful features of IP addresses and in particular the larger…

Thank you for taking the time to explain. Let me try to word things a little better: What is the percentage of US homes who are on an IPv6? What is the percentage of websites on IPv6? What are the number of web site hits that are IPv6 to IPv6? (in the US? in the world?) The highest estimate I've ever seen for any of these is less than 20%, which - 20 years into IPv6, is in my opinion "not caught on". The mobile world…

Giving a user the same IPv4 address on every connection is not uncommon either. It's a policy decision made by the provider, unrelated to IPv4/v6.

Re: The world in which IPv6 was a good design

#118

Post by zimpenfish »

vertex-four wrote: post #116
beagle3 wrote: post #115

Earlier quoted context omitted.

Ok, just to clear up the confusion (because not all posts in this thread use the same terminology): Home NAT, which is equivalent to suffix randomization, does NOT afford any privacy. Carrier Grade NAT, which would be equivalent to prefix randomization (if such a thing existed) DOES afford some privacy, provided that care is taken not to leak other data (through cookies, browser fingerprinting, stylometrics, etc). I…

> Also, 99.9% of the people do not know how to secure their networks or devices. I take it that you've never heard of a firewall on your router. Mine ships default deny. I assume yours does too.

Doesn't help if the router is easily hackable - http://www.bbc.co.uk/news/technology-40382877

> "Because the default wi-fi password formats are known, it's not difficult to crack them," said Mr Munro. > Once an attacker has access to your wi-fi network, they can seek out further vulnerabilities.

Re: The world in which IPv6 was a good design

#119

Post by beagle3 »

vertex-four wrote: post #116
beagle3 wrote: post #115

Earlier quoted context omitted.

Ok, just to clear up the confusion (because not all posts in this thread use the same terminology): Home NAT, which is equivalent to suffix randomization, does NOT afford any privacy. Carrier Grade NAT, which would be equivalent to prefix randomization (if such a thing existed) DOES afford some privacy, provided that care is taken not to leak other data (through cookies, browser fingerprinting, stylometrics, etc). I…

> Also, 99.9% of the people do not know how to secure their networks or devices. I take it that you've never heard of a firewall on your router. Mine ships default deny. I assume yours does too.

I'm well aware of it, but that just means all those amazing peer to peer protocols[0] that are waiting to be implemented were hyperbole, doesn't it? You know, "default deny" and stuff. Oh sure, there will be a protocol, probably called "Universal hole-Punch aNd-get Pwned" or some acronym thereof, to relax that "default deny".

[0] https://news.ycombinator.com/item?id=14988022

Re: The world in which IPv6 was a good design

#120

Post by topranks »

Hikikomori wrote: post #89
dom0 wrote: post #85

Earlier quoted context omitted.

DSL usually uses PPPoA (or PPPoE in a MPoA tunnel like below) over a subset of ATM (=DSL). PPP itself transports IP and provides configuration. When modem and router are separate, the modem only provides an MPoA tunnel to provide Ethernet access to the DSL link, while the router connects to the AC via PPPoE over said tunnel.

Another common option is RFC 1483 bridging (IPoEoATM) where DHCP is typically used for address assignment.

The newer VDSL standards define an Ethernet PHY rather than ATM-based encapsulation (given everyone ran PPPoE over it anyway it's one less layer).

But to the original point there is no reason you could not run DHCP over a T1 directly..... no Ethernet at all involved (HDLC or something at the data-link).

Post reply on HN