Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

71–80 of 154 posts

Re: Blockers to IPv6 Adoption

#71

Post by AmericanChopper »

jjeaff wrote: post #10
kojon99 wrote: post #7

Performance? How exactly is ipv6 more performing? It even has bigger headers. Why would ipv6 be more reliable than ipv4? I’d say it’s the opposite: many times I’ve found websites with AAAA registers that pointed to a dead server. I mean, if you’re going to blame cgn for your problems, let’s steep to your level. Analytics? Forensics? So you’re telling me ipv6 destroys my privacy. How is that a pro argument?

I'm by no means am expert in this space, but I was working on some routing issues lately and doing some speed testing with my router. The specs on the router claimed that the highest speeds could be reached with ipv6 support because you could then avoid the overhead of nat for your ipv4 addresses. So that may be what they are referring to. Nat does create overhead.

But I like NAT. I don’t want to spark a ‘NAT is not a firewall’ debate, but it solves many security and privacy issues with little overhead, and does so in an incredibly simple and elegant way. Having the private LAN as a trusted network zone makes perfect sense, and for home users is works perfectly well with 0 configuration. Remove it and you’re giving every single device a globally unique L3 identifier (no fucking thank you), and to get the same benefits that NAT provides you’ll have to replace it with an unavoidably more complex solution.

Re: Blockers to IPv6 Adoption

#72

Post by grandinj »

throwaway2048 wrote: post #65
grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

Its not like "ipv4 with longer addresses" would have been any more compatable, we would be stuck in exactly the same situation wrt actually deploying it. The things that ipv6 brings along that are not present in ipv4 are pretty inconsequential.

Not really.

Virtually every related protocol (e.g. ARP, BOOTP, OSPF, BGP) was modified in non-trivial ways, the rules around different kinds of addresses (link-local, etc) are very different, IP-level encryption stuff started out mandatory (may not be anymore), various flow-control stuff was tweaked (and tweaked again since then to match the improvements in IPv4), rules for parsing optional header fields was tweaked, etc, etc.

Re: Blockers to IPv6 Adoption

#73

Post by mehrdadn »

detaro wrote: post #70
mehrdadn wrote: post #66

Earlier quoted context omitted.

And you're also claiming every single router I'm going to encounter today has already set up IPv6 correctly as needed to mirror the security and privacy characteristics of IPv4 like this?

Pretty much, yes. Other security issues with random routers appear to be way more common.

EDIT: My mistake, see comment below.

Re: Blockers to IPv6 Adoption

#75

Post by throwaway2048 »

grandinj wrote: post #72
throwaway2048 wrote: post #65

Earlier quoted context omitted.

Its not like "ipv4 with longer addresses" would have been any more compatable, we would be stuck in exactly the same situation wrt actually deploying it. The things that ipv6 brings along that are not present in ipv4 are pretty inconsequential.

Not really. Virtually every related protocol (e.g. ARP, BOOTP, OSPF, BGP) was modified in non-trivial ways, the rules around different kinds of addresses (link-local, etc) are very different, IP-level encryption stuff started out mandatory (may not be anymore), various flow-control stuff was tweaked (and tweaked again since then to match the improvements in IPv4), rules for parsing optional header fields was tweaked,…

All of those things would needed to be changed for "IPv4 but longer", its not like you could take the IPv4 versions of any of them and use them.

Re: Blockers to IPv6 Adoption

#76

Post by 4ad »

sliken wrote: post #46
lwhalen wrote: post #17

Comcast is my biggest blocker to IPv6 adoption. I maintain a static v4 block with them, they tell me I have to give that up if I want a v6 block. Until I give up v4, v6 works on my network right up to the Comcast modem, and is promptly dropped on the floor. Regrettably, that is 'no bueno' for a multitude of reasons. :-(

Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6. Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.

> Their default is to give a /60, which seems appropriately overkill.

A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it.

The recommended size of block that every ISP should give is /48 (RFC 6177). Good ISPs will give you a /48, some lesser ISPs will give you a /56. Comcast and crappy ISPs will give you a /60.

Re: Blockers to IPv6 Adoption

#78

Post by detaro »

4ad wrote: post #76
sliken wrote: post #46

Earlier quoted context omitted.

Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6. Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.

> Their default is to give a /60, which seems appropriately overkill. A /60 is pathetically small, with SLAAC you have 16 (!!) subnets for your whole network. With people having multiple computers and multiple phones, this is not enough even for a normal household of 3 people. If you are a IT person, with multiple computers and VMs, forget it. The recommended size of block that every ISP should give is /48 (RFC 6177)…

How does a household with 3 people need 14 subnets?

I agree a /60 is stingy, but "not enough even for a normal household of 3 people" sounds like massive hyperbole. Even as a tech enthusiast filling that would be some work, unless you insist I use a /64 for point-to-point links.

Re: Blockers to IPv6 Adoption

#79

Post by mehrdadn »

andrewaylett wrote: post #31
guidedlight wrote: post #24

I see IPv6 as a privacy issue. It will enable clients to be individually identified without needing to rely on cookies and fingerprinting anymore. NAT is great in that it obscures individual machines without too much lose of functionality.

https://tools.ietf.org/html/rfc4941 defines IPv6 privacy extensions, which mitigate that issue. One of the few benefits of an extended roll-out of IPv6 is that there's been time for people to identify issues like this and get fixes rolled out widely before systems started relying on the old behaviour.

What percentage of IPv6-supporting routers have implemented and activated those privacy extensions?
Post reply on HN