So Long Last /8 and Thanks For All the Allocations • Hacker News Board

Re: So Long Last /8 and Thanks For All the Allocations

#161

Post by zAy0LfpBZLC8mAC » Wed, Apr 25, 2018, 12:36 AM UTC

ozim wrote: post #156

zAy0LfpBZLC8mAC wrote: post #93

Earlier quoted context omitted.

> Also I do not need to have directly accesible stuff on my home network. I can use dropbox or buy cheap VPS if I want to keep my data in sync. You also can walk everywhere instead of using machines to move around ... but why would you? > One is security, NAT is nice for that a lot smaller attack surface. No, it doesn't. It's a common myth, but NAT does not provide any security, it only hides insecurity. > Second kee…

Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying. Having animals, kids, makes it even more difficult. If I would have to rely on it beeing up while I am abroad, I would rather pay for VPS. Hiding insecurity is perfectly valid. It is making attack surface smaller. I do not get pings of death, constant scanning, login at…

> Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying.

That's all besides the point. When you want to share a file with someone while you are both working on it, say, there is no need for a "server". IP is perfectly fine for transfering a file from your machine to theirs. When you want to talk to someone over the net, there is no need for a "server". IP is perfectly fine for transmitting voice calls between your machine to theirs.

Your mistake is in your assumption that you even need a server in the first place. For some things, that might be useful. For other things, that is only needed as a workaround for NAT in the first place.

Also, reliably running a server at home isn't hat hard either, even today. With hardware offerings that are a better fit, it could be even easier. There isn't really any reason why hosting your own "server" at home needs to be any more difficult than hosting your own vacuum cleaner.

> Hiding insecurity is perfectly valid. It is making attack surface smaller.

No, it doesn't. It simply makes it harder for you to notice that you are not secure, that's all. This is not about whether firewalling insecure services off from public access makes the attack surface smaller. It does. But NAT doesn't, a firewall does. If you have a firewall, you don't need NAT. If you don't have a firewall, NAT won't protect you.

> I do not get pings of death, constant scanning, login attempts all the time on my local machine which is always behind NAT. Every server that has public IP gets scanned or tried out with vulnerabilities.

Which is just completely irrelevant. None of these things are a security risk. They are annoyances when trying to debug the network, that's all. And none of that is in any way fundamentally helped by even a firewall. You have a huge attack surface in your web browser that is completely unaffected by your firewall and by NAT as well, pretending that a service listening on a port is somehow a huge security problem, but executing untrusted code inside a massively complicated virtual machine is harmless is just completely focusing on the wrong problem. Also, all those pages that you load into your browser sort-of have access to your local network anyway, because your browser is inside your firewall and can connect to all those services that you pretend your NAT protects.

> I can connect totally new PC to router with NAT and not be owned in matters of minutes by some botnet.

You are constantly confusing firewalls and NAT. That is done by a stateful firewall, not by a NAT.

> My router might be exposed but it is something I know. All machines behind router are perfectly fine for remote vulnerabilities.

That is an extremely naive perspective.

Re: So Long Last /8 and Thanks For All the Allocations

#162

Post by deathanatos » Wed, Apr 25, 2018, 12:47 AM UTC

Spivak wrote: post #143

fipple wrote: post #122

I’d rather these run out even faster so we can just get on with IPv6. Why waste effort on these dying gasps of v4.

Because the 'dying gasps' has a really long tail. My guess that that everyone in this forum will be dead before 25% of the internet is IPv6 only. There's a huge difference between supporting IPv6 and not supporting IPv4; the latter will take much much longer.

> My guess that that everyone in this forum will be dead before 25% of the internet is IPv6 only.

Google[1] thinks we're at ~22% world wide, and we've gained ~2% in the last 6 months, so I really hope not.

[1]: https://www.google.com/intl/en/ipv6/statistics.html

Re: So Long Last /8 and Thanks For All the Allocations

#163

Post by throwaway2048 » Wed, Apr 25, 2018, 12:56 AM UTC

smsm42 wrote: post #160

oasisbob wrote: post #158

Earlier quoted context omitted.

Because NAT is an abominable hack with significant technical and administrative overhead. My home is not intended to be a public space. But, it has a unique address, just like any other bar or restaurant in the area. Being able to locate it with a unique identifier is valuable, even if I don't intend for my living room to be publicly accessible.

> Because NAT is an abominable hack with significant technical and administrative overhead. Agreed. But you can use private networks without NAT. In fact, 99% of traffic in the private network doesn't need NAT. Only outside traffic does, and only that which can't use proxies etc. - which is pretty small amount of overall traffic, I think.

attempting to proxy traffic like that is an even more massive mess, you have a solution in search of a problem here.

Re: So Long Last /8 and Thanks For All the Allocations

#164

Post by zAy0LfpBZLC8mAC » Wed, Apr 25, 2018, 1:00 AM UTC

pas wrote: post #152

jlgaddis wrote: post #124

Earlier quoted context omitted.

Well, see, compared to what most of us are used to nowadays, IP networking looked a little bit different back then. In 1981, RFC791 [0] came about, describing a way of doing IP addressing on the ARPANET (based upon "classful networks" [1]). In accordance with this scheme, you would get either a /8 ("Class A"), a /16 ("Class B"), or a /24 ("Class C") -- depending on how many hosts you had (or thought you might reasona…

How come IPv6 wasn't standardized before 2017? I suspect there's some kind of story there. Do you happen to know the details? Any links/pointers? Thanks!

It's just nonsense. In the IETF's nomenclature, the label "Internet Standard" is used to refer to, and I quote:

   A specification for which significant implementation and successful
   operational experience has been obtained may be elevated to the
   Internet Standard level.  An Internet Standard (which may simply be
   referred to as a Standard) is characterized by a high degree of
   technical maturity and by a generally held belief that the specified
   protocol or service provides significant benefit to the Internet
   community.

   A specification that reaches the status of Standard is assigned a
   number in the STD series while retaining its RFC number.

Most internet standards are not "Internet Standard"s, as can be seen by the fact that IPv6 got assigned the standard number 86, and up until last year, IPv6 wasn't either, but it still was a perfectly fine and well-documented standard, and has been for a long time.

Re: So Long Last /8 and Thanks For All the Allocations

#165

Post by nsbq71 » Wed, Apr 25, 2018, 1:02 AM UTC

gmueckl wrote: post #126

gsich wrote: post #65

Earlier quoted context omitted.

privacy is not the issue. Selling business plans is the real reason.

You won't believe the number of crazy people in Germany who believe that static IP addresses are the root of all evil because of all the magucal tracking and surveillance possibilities they famtasize about.

The only reason I can still post here is that I don't have a static IP address. So yes, they are the root of all evil.

Re: So Long Last /8 and Thanks For All the Allocations

#166

Post by zAy0LfpBZLC8mAC » Wed, Apr 25, 2018, 1:08 AM UTC

pas wrote: post #150

dfox wrote: post #134

Earlier quoted context omitted.

Particularly notable example of this is that the three ip6tables rules needed to get NAT-like everything out nothing out behavior are exactly the same three rules that you need in v4 iptables for the NAT to have any security effect at all.

Care to share them? And how is NAT not added security by default? By default it drops everything incoming, no? (I mean, theoretically NAT doesn't, but [almost] every practical implementation situations means that there's no possible automatic internal-external address correspondence, otherwise you wouldn't need the NAT.)

A NAT doesn't drop anything. A NAT translates. A firewall drops.

If you only have a NAT, your ISP (or anyone who has compromised their router, or possibly simply your neighbour when ISPs occasionally fail to isolate their customers on layer 2) still can send you packets addressed directly to your "internal" addresses. The only thing that actually helps is a stateful firewall. And when you have that, the NAT does not add anything security-wise.

NAT and "internal addresses" is as much a security mechanism as not telling anyone that there is a room called "living room" in your house. If you want to prevent strangers from getting into your living room, you don't use internal names for your rooms, you install a lock on the door.

Re: So Long Last /8 and Thanks For All the Allocations

#167

Post by leeter » Wed, Apr 25, 2018, 1:09 AM UTC

craftyguy wrote: post #159

leeter wrote: post #128

Earlier quoted context omitted.

Technically that depends on the agreements with IANA. If IANA could say "HEY YOU if you're not using 80% of your space actively, by January after next then we'll charge you a an exponentially increasing fee" I suspect they'd get a lot more movement. I suspect that the price of IP space on the market will also change that attitude as people go "Well crap that's worth a lot of money"

What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.

Then they reverse the assignment, as the ultimate authority on the internet they do have the right.

Re: So Long Last /8 and Thanks For All the Allocations

#168

Post by craftyguy » Wed, Apr 25, 2018, 1:10 AM UTC

leeter wrote: post #167

craftyguy wrote: post #159

Earlier quoted context omitted.

What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.

Then they reverse the assignment, as the ultimate authority on the internet they do have the right.

"Something something National Security"

Re: So Long Last /8 and Thanks For All the Allocations

#169

Post by Florin_Andrei » Wed, Apr 25, 2018, 1:19 AM UTC

throwaway2048 wrote: post #130

cortesoft wrote: post #125

Earlier quoted context omitted.

Everything having a publicly routable IP isn't an automatic good thing.

NAT does nothing meaningful securitywise that a firewall cannot achive, and causes a lot of stupid problems.

> NAT does nothing meaningful securitywise that a firewall cannot achive

One good thing about NAT is even if you screw up the firewall config, such as configure everything in "allow all" mode, your internal network is still secure, because private IPs are not routable at the Internet level.

> and causes a lot of stupid problems.

That is true.

Re: So Long Last /8 and Thanks For All the Allocations

#170

Post by azernik » Wed, Apr 25, 2018, 1:25 AM UTC

tedunangst wrote: post #99

nashashmi wrote: post #49

Can anyone offer an explanation why IPv6 still has not blanketed the world yet? I mean if client pings an IPv4 address, it should be automatically converted to an IPv6 version. So why isn't IPv4 instantly outdated?

What? Converted by who? How does this work?

To elaborate other commenter's reference to XLAT:

There is an IPv6 address block assigned for "IPv4-translated" address (::ffff:0:$IP4ADDR). In networks that support this, packets destined for these addresses are routed to a NAT64 box for introduction to the v4 internet.

Like all NAT-based solutions, this only provides support for outgoing connections out of the box, but that's unavoidable without assigning v4 addresses to hosts, and in the consumer ISP use case is all you need anyway.