Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

111–120 of 399 posts

Re: Is there hope for IPv6?

#111

Post by geofft »

jdblair wrote: post #75
AnIdiotOnTheNet wrote: post #58

Earlier quoted context omitted.

If NAT is wrong, then firewalls that block incoming connections by default are also wrong. I think you'll have a hard time making that argument.

You're mixing up NAT and ingress blocking. A stateful firewall doesn't depend on NAT, we're just used to ingress blocking as a side effect of NAT.

No, I think that argument makes perfect sense. A stateful firewall doesn't depend on NAT but you get all the downsides of NAT from a working stateful firewall in default-deny mode: you still have to talk the firewall into allowing the relevant traffic through, and without that you still have connections that work in one direction and not the other. The only thing that's different is address discovery, but you can solve that by just asking the firewall what public address to use at the same time that you ask it to open the port. (Or curl whatismyip.akamai.com or something.)

So if NAT is a problem for your application, so are the stateful firewalls implicitly envisioned by those who advocate for assigning unNATted public addresses to devices on home networks.

Re: Is there hope for IPv6?

#112

Post by Gibbon1 »

magila wrote: post #71
geofft wrote: post #57

Earlier quoted context omitted.

As a network application developer I haven't felt much pain from NAT - I need to run a central server to relay connections, but that's about it. And oftentimes I need to run a central server anyway for discovery or authentication. (A few years ago I worked at a startup that enabled secure remote access to corporate networks, as in you could connect from a roaming laptop or mobile app into the network, browse the web,…

You're right some some applications are more effected than others. It sounds like you were dealing with business customers, "asked people to...forward a port on their NAT" is not a viable strategy when dealing with consumers. I work on P2P applications, so NAT is the bane of my existence.

I've always thought that facebook wouldn't exist if you had workable P2P for consumers.

Re: Is there hope for IPv6?

#113

Post by coding123 »

apple4ever wrote: post #69
Someone1234 wrote: post #41

Earlier quoted context omitted.

Backwards compatibility seems to be the largest. Look at the deployment of TLS as a success story. Everyone kept on supporting both old and new, watched the percentages, and then dropped the old when the new had enough penetration. The whole thing is also a bit of a shell game. Nobody wants to invest in it until they feel like they're "behind" if they don't. So you have a big player or two in order to make it feel li…

TLS is a great example of how to do it. IPv6 is a great example of how not to.

Tls was a software upgrade for nearly everything. In fact just by building newer devices that software was just there and ready. Ipv6 is not just a software upgrade.

Re: Is there hope for IPv6?

#114

Post by zamadatix »

apple4ever wrote: post #73
geofft wrote: post #31

Earlier quoted context omitted.

Loose coupling and no second system effect. IPv6 should have been extended address space and extended address space only, in a manner backwards-compatible with IPv4. You think ARP is broken? Great, implement a fixed version of ARP for both IPv4 and IPv6, meanwhile we'll spec IPv6 to use ARP. Don't design IPv6 to use your new thing called NDP that layers completely differently. You think everyone using NAT is wrong? G…

You hit on the problem with IPv6 designers- they took a solution (bigger address space) to a problem (not enough addresses) and they added a bunch of other changes (No NAT, No DHCP, ARP vs NDP, weird address scheme, etc) that arguably made things worse. Then they wonder why people aren’t adopting it. (Its the same complaint I have against Let’s Encrypt. They shoved down a policy which is antithetical to helping their…

No NAT/DHCP is an implementation choice not a protocol limitation. NDP is the only real "you must do " in your list that is true. The address schemes are either straight from v4 (link local, private, loopback, public, multicast), optional (temp address), or just best practices (/64s)

Re: Is there hope for IPv6?

#115

Post by gregmac »

jdblair wrote: post #75
AnIdiotOnTheNet wrote: post #58

Earlier quoted context omitted.

If NAT is wrong, then firewalls that block incoming connections by default are also wrong. I think you'll have a hard time making that argument.

You're mixing up NAT and ingress blocking. A stateful firewall doesn't depend on NAT, we're just used to ingress blocking as a side effect of NAT.

Think about FTP. Client is behind NAT, so needs to use PASV mode (server opens arbitrary data port for client to connect to, instead of server connecting to arbitrary data port on client).

If the server has a firewall that blocks all inbound but 21/tcp, or is behind NAT with just 21/tcp forwarded, no data transfers are possible.

These are totally different setups from a network operations point of view, but look identical from application and user point of view.

I think this is what the parent was getting at: both setups effectivity prevent a user from accepting arbitrary inbound connections to their machine.

Re: Is there hope for IPv6?

#116

Post by phicoh »

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6

- There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder.

- IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure

- Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv6. But everyone who has enough IPv4 space has no reason to care.

When IPv6 was first promoted, there basically was no IPv4 market. You would just go and get more IPv4 space when needed. For the last couple of years we now have a mature market for IPv4 addresses.

It is possible to buy IPv4 addresses, but prices go up. At some point it becomes interesting to try to move traffic to IPv6.

Re: Is there hope for IPv6?

#117

Post by saurik »

geofft wrote: post #104
lwf wrote: post #100

Earlier quoted context omitted.

> (Its the same complaint I have against Let’s Encrypt. They shoved down a policy which is antithetical to helping their mission.) Can you expand what you mean by this? I'm drawing a blank.

I assume they're referring to the 3-month certificate lifetimes, which all but force you to automate certificate renewal, whereas the 1+-year certificates of the past let you treat it as manual sysadmin work. This was based on a belief that automating certificate renewals is the right thing to do. Still, LE seems to be wildly more successful than IPv6. I suspect in part that's because they were more technically right…

I think another big thing with Let's Encrypt is that they are free while their legacy competitors cost money, which is on the brutal end of incentives.

Re: Is there hope for IPv6?

#119

Post by zamadatix »

Pxtl wrote: post #106

Imho IPV6 failed because of a failure to make DNS usable to non-specialists. If every device on every network could be assigned a domain name, then we'd never have to know what underlying addressing scheme exists. My ISP has a name. I have an account with them. Every device on my network has a name. There's no good reason I don't have Device.accountName.pub.ispName.tld Bound to the phone I'm writing this on right now…

99% of users couldn't tell you what an IP address or port is let alone manually configure MACs and IPs into their router so I don't think that has anything to do with adoption of v6. To the vast majority of users they type a name in the URL bar and that's their full interaction with what they'd think of as "internet addresses".

Those administering the systems users connect to have always handled DNS just fine so I don't see why they wouldn't be able to know that the address got a bit longer.

Re: Is there hope for IPv6?

#120

Post by zanny »

yjftsjthsd-h wrote: post #60
vnw wrote: post #50

Earlier quoted context omitted.

Every time I see a conversation about IPv6, this argument comes up. Is "it's got a gorillion IP addresses" the only redeemable quality IPv6 has?

It's less a redeeming quality and more the entire reason why we bothered to switch to a new system. So yes, that is the point.

I don't think its helpful to discredit all the other technical advantages of v6. Address assignment and configuration is significantly better under SLAAC than DHCP, multicasting actually makes sense, and routing logic and packet format are simplified.

If you were to try implementing a router for ipv4 and v6 the v6 one would be dramatically simplier with a lot fewer convoluted edge cases.

Post reply on HN