Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So Long Last /8 and Thanks For All the Allocations

labs.ripe.net

Post reply on HN
Print view View original

171–180 of 201 posts

Re: So Long Last /8 and Thanks For All the Allocations

#171

Post by comex »

jwr wrote: post #69
djrogers wrote: post #62

Is it just me, or does the excessive use of undefined acronyms make this a difficult read for everyone else too? At the very least, please annotate your first use of acronyms like LIR and RIR so us outsiders have some context.

I'd say that if you don't understand the acronyms, you won't find the rest of the article useful or informative, either, so I don't think it's much of a problem.

Speak for yourself. I know what an /8 is, know what it means to be running out of IPv4 addresses and having to ration the last ones available, and am interested in news about how that process is going, especially insofar as it affects the transition to IPv6. That was enough for me to grasp the majority of the current article, which I found informative. But I’ve never interacted with the IP address allocation process myself, nor is it all that central to my interests, so my knowledge is relatively skin deep. I could tell you what ICANN was and probably remembered that RIPE was one of its regional affiliates, but not much more than that. In particular, I had no idea what an RIR or LIR was. So, while I didn’t mind the use of jargon, neither would it have hurt to spell out the acronyms the first time.

Re: So Long Last /8 and Thanks For All the Allocations

#172

Post by stordoff »

ozim wrote: post #156
zAy0LfpBZLC8mAC wrote: post #93

Earlier quoted context omitted.

> Also I do not need to have directly accesible stuff on my home network. I can use dropbox or buy cheap VPS if I want to keep my data in sync. You also can walk everywhere instead of using machines to move around ... but why would you? > One is security, NAT is nice for that a lot smaller attack surface. No, it doesn't. It's a common myth, but NAT does not provide any security, it only hides insecurity. > Second kee…

Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying. Having animals, kids, makes it even more difficult. If I would have to rely on it beeing up while I am abroad, I would rather pay for VPS. Hiding insecurity is perfectly valid. It is making attack surface smaller. I do not get pings of death, constant scanning, login at…

> Do you have redundant power supply at home, redundant internet connection?

Depends what you need. My last power outage was over a year ago, and Internet issues will generally resolve themselves in a relatively short period of time. That's reliable enough for a lot of use cases.

Re: So Long Last /8 and Thanks For All the Allocations

#173

Post by stordoff »

tialaramex wrote: post #74
EE84M3i wrote: post #38

IPv4 address utilization is incredibly low. For example, consider 44.0.0.0/8 - it's sitting around almost entirely unallocated. UCSD Caida uses it for their network telescope (pretending to use it for amateur radio) and won't give it back. Just look at how dark it is: https://benjojo.co.uk/internet-2018.png (from https://blog.benjojo.co.uk/post/scan-ping-the-internet-hilbe... ) Discussion on r/amateurradio - https://…

The fact something looks "dark" on that plot doesn't tell you anything about how much of the space is allocated. The site linked by that many years old Reddit post says that in fact loads of this space is allocated, to specific people, in this case "Hams", I see alphanumeric designations which I seem to remember Hams call "handles" as well as geographic locations and some human names. Is the Amateur Radio "Ham" commu…

> The fact something looks "dark" on that plot doesn't tell you anything about how much of the space is allocated.

A lot will also depend on when the scan is done. For instance, the University of Cambridge has 131.111/16 and hands it out to student devices, so if you scan during a vacation a large portion of it will look empty.

Re: So Long Last /8 and Thanks For All the Allocations

#174

Post by gwright »

ancarda wrote: post #114
freehunter wrote: post #105

Earlier quoted context omitted.

Man I've worked with my fair share of quasi-governmental agencies who have a /8 or /16 to themselves and use it for their internal address space. I wonder how many addresses we'd have if we could take back unused address space.

Why do they do that? They already have an /8 to themselves -- 10.0.0.0/8. Did they need an additional 16M IP addresses?

Using NAT and the IPv4 private address ranges sounds at first like a good solution but it creates some operational problems when two organizations want to connect their networks or when two organizations merge.

Re: So Long Last /8 and Thanks For All the Allocations

#175

Post by astrodust »

craftyguy wrote: post #159
leeter wrote: post #128

Earlier quoted context omitted.

Technically that depends on the agreements with IANA. If IANA could say "HEY YOU if you're not using 80% of your space actively, by January after next then we'll charge you a an exponentially increasing fee" I suspect they'd get a lot more movement. I suspect that the price of IP space on the market will also change that attitude as people go "Well crap that's worth a lot of money"

What if they didn't pay it? It's the US military, IANA would have a hard time enforcing any punishment they bestowed on the DoD.

If the US military had to pay a staggering $100/IP per year it wouldn't even show up in a detailed audit. It's an utterly inconsequential amount compared to the military budget.

It's not a price thing, it's a "why should we" thing.

Re: So Long Last /8 and Thanks For All the Allocations

#176

Post by astrodust »

outworlder wrote: post #153
toopsss wrote: post #73

Earlier quoted context omitted.

Microsoft pretty much had an anti internet strategic policy until 1995, that’s why. Back in the day a tcpip stack was a third party add on.

Trumpet Winsock?

Consider that when Trumpet Winsock was a third-party IP add-on for Windows 3.1, classic MacOS already had IP support built-in.

Ironically around that time Microsoft was selling Xenix (https://en.wikipedia.org/wiki/Xenix) which did support it.

Re: So Long Last /8 and Thanks For All the Allocations

#177

Post by zaarn »

d215 wrote: post #138
maccam94 wrote: post #117

Earlier quoted context omitted.

There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.

I don't know if you're being ironic, but NAT64[0] is (sort of unfortunately) an actual existing technology and in use as well. [0] https://en.wikipedia.org/wiki/NAT64

NAT64 is NAT in reverse, essentially. Your internal, IPv6 network can use it to contact an IPv4 host by embedding the target address. This is arguably better than current NAT44. The NAT64 only needs to track which ports and IPs are used on the IPv4 side which should become easier as more hosts don't require an IPv4 anymore.

It's a last-stage transitional method IMO, when most but not all of the internet is IPv6.

Re: So Long Last /8 and Thanks For All the Allocations

#178

Post by zaarn »

cortesoft wrote: post #125
maccam94 wrote: post #117

Earlier quoted context omitted.

There was a time before NAT, where every machine had a publicly routable IP, and things were good. Any machine could talk directly to any port on any other machine (firewall willing). Until one day, IP exhaustion attacked. Thankfully NAT doesn't exist in IPv6, because 2^128 addresses should be enough for everybody.

Everything having a publicly routable IP isn't an automatic good thing.

Routable != Reachable, which is obvious once you actually setup a firewall once.

My IPv6 /48 is entirely routable. The reachable portions are some ports in the list of popular protocols like SSH, HTTPS and similar.

The good part is that the entire /48 is reachable from within and simplifies OpenVPN routing a lot compared to IPv4, which requires a bit of outbound NAT hackery so it doesn't have to traverse the firewall three times (OpenVPN->WAN->LAN instead of OpenVPN->LAN)

Re: So Long Last /8 and Thanks For All the Allocations

#179

Post by zaarn »

cm2187 wrote: post #9

Even in developed countries IPv6 is barely deployed (my UK ISP - BT - pretends that they rolled it out but half of the time my modem tells me IPv6 is not availabled until I force it to reconnect, and no sign of IPv6 on mobile networks). Was looking at whether it was more economical to buy a small address block vs rent it from a datacentre. A /24 address block seems to cost around $4,000 upfront but then you need to p…

OVH doesn't properly deploy IPv6 either. pfSense is also being weird (if you only get a /64 you need SLAAC or else you can't configure the LAN with it for some bizarre reason and OVH doesn't SLAAC properly)

Though thanks to HE/tunnelbroker.net I deployed a /48 on my network and all is good now (and easier).

Re: So Long Last /8 and Thanks For All the Allocations

#180

Post by ozim »

zAy0LfpBZLC8mAC wrote: post #161
ozim wrote: post #156

Earlier quoted context omitted.

Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying. Having animals, kids, makes it even more difficult. If I would have to rely on it beeing up while I am abroad, I would rather pay for VPS. Hiding insecurity is perfectly valid. It is making attack surface smaller. I do not get pings of death, constant scanning, login at…

> Do you have redundant power supply at home, redundant internet connection? Keeping your own server up and running at home is unreliable and annoying. That's all besides the point. When you want to share a file with someone while you are both working on it, say, there is no need for a "server". IP is perfectly fine for transfering a file from your machine to theirs. When you want to talk to someone over the net, the…

We are talking about IPv6 and possibilities to directly access machine where some vulnerable service might be exposed by misconfiguration. If you have remote code execution vulnerability service listening in that service it is really bad. Even pro people forget to close their database on servers sometimes, cannot think what weird stuff might be running on normal users machines.

I did not even touched running untrusted code by user because that is not in the scope of discussion. It is insecure with whatever the network configuration will be.

I do not know how you can connect to device behind NAT without setting up tunnel to it. But I might be wrong, point me to some resource please?

Post reply on HN