Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#121

Post by geofft » Sat, Jan 05, 2019, 6:45 PM UTC

zamadatix wrote: post #114

apple4ever wrote: post #73

Earlier quoted context omitted.

You hit on the problem with IPv6 designers- they took a solution (bigger address space) to a problem (not enough addresses) and they added a bunch of other changes (No NAT, No DHCP, ARP vs NDP, weird address scheme, etc) that arguably made things worse. Then they wonder why people aren’t adopting it. (Its the same complaint I have against Let’s Encrypt. They shoved down a policy which is antithetical to helping their…

No NAT/DHCP is an implementation choice not a protocol limitation. NDP is the only real "you must do " in your list that is true. The address schemes are either straight from v4 (link local, private, loopback, public, multicast), optional (temp address), or just best practices (/64s)

Your ability to implement this as a network operator is also constrained by what your network devices and client devices support. Since there exist devices that don't support DHCPv6 and only support SLAAC, /64s turn from a best practice to a requirement. Since everyone made fun of NAT, NAT66 implementations did not exist until very recently and they're still uncommon, even though it's been technically obvious what to do since day one.

You can implement IPv6 by ditching all your network hardware, installing commodity Linux boxes, writing some patches to iptables, and insisting that nobody bring Android devices onto your network unless they run your in-house fork of AOSP. I just think most people would not consider that an option in scope.

Re: Is there hope for IPv6?

#122

Post by dane-pgp » Sat, Jan 05, 2019, 6:45 PM UTC

geofft wrote: post #104

lwf wrote: post #100

Earlier quoted context omitted.

> (Its the same complaint I have against Let’s Encrypt. They shoved down a policy which is antithetical to helping their mission.) Can you expand what you mean by this? I'm drawing a blank.

I assume they're referring to the 3-month certificate lifetimes, which all but force you to automate certificate renewal, whereas the 1+-year certificates of the past let you treat it as manual sysadmin work. This was based on a belief that automating certificate renewals is the right thing to do. Still, LE seems to be wildly more successful than IPv6. I suspect in part that's because they were more technically right…

It's worth pointing out, in terms of LE being "wildly more successful", that this represents a single organisation, with a security critical role on the web, approaching a monopoly. That's actually a worse situation than if 100% of hosts on the internet supported (different but compatible implementations of) IPv6.

Here is a chart showing the trend for LE marketshare (under the IdenTrust root):

https://w3techs.com/technologies/history_overview/ssl_certif...

I really support LE's mission, and celebrate their success, but would feel more comfortable if a separate organisation tried replicating what they had done, running the same service but with distinct personnel and assets.

For reference, here is another chart showing the run down of the remaining IPv4 supply:

http://www.potaroo.net/tools/ipv4/plotend.png

Re: Is there hope for IPv6?

#123

Post by rleigh » Sat, Jan 05, 2019, 6:48 PM UTC

geofft wrote: post #52

Kranar wrote: post #11

Earlier quoted context omitted.

IPv6 allows for so many IP addresses that you could give yourself a new IP address every minute and never worry about running out.

You could, but does your device actually do so? Are you confident that 100% of the devices you own use privacy addresses and do not leak non-privacy addresses? The nice thing about IPv4 NAT is that you plug a single gadget in to your ISP's connection (cable modem, ONT, whatever), you connect your devices to that gadget, and it works out of the box and has all the security properties you'd expect, even if you're a per…

Most operating systems default to using Privacy Extensions which will cycle your address at frequent intervals, unless you specifically disable it.

Re: Is there hope for IPv6?

#124

Post by zlynx » Sat, Jan 05, 2019, 6:48 PM UTC

CydeWeys wrote: post #40

rawoke083600 wrote: post #25

how about ipv5 and we just add an extra .255 ? Im sure our kids wilk figure out a better solution... ?

Assuming you're not joking, the nice thing about IPv4 is that it uses 32 bits, so you can store addresses in an unsigned int and use memory efficiently. Just adding one octet takes you up to 40 bits, which has alignment issues. You may as well go up to 64 bits (half of IPv6), which could be represented as 16 hex characters, e.g. 06A4.6E1B.12C9.95C8. That way you're kicking the can much farther down the road too.

I doubt anyone cares about efficiency or I wouldn't find people storing IP addresses in JSON, as text. Unnormalized too, so IPv6 is almost guaranteed to be broken.

Re: Is there hope for IPv6?

#125

Post by zamadatix » Sat, Jan 05, 2019, 6:48 PM UTC

Someone1234 wrote: post #41

kens wrote: post #36

Earlier quoted context omitted.

It seems like a lot of technology transitions go smoothly, while others painfully drag on for a decade (ipv6, Python3). Are there any common root causes for the semi-failures? Has anyone written about why some succeed and some don't?

Backwards compatibility seems to be the largest. Look at the deployment of TLS as a success story. Everyone kept on supporting both old and new, watched the percentages, and then dropped the old when the new had enough penetration. The whole thing is also a bit of a shell game. Nobody wants to invest in it until they feel like they're "behind" if they don't. So you have a big player or two in order to make it feel li…

You can do the same thing with v6, the difference is problem space. TLS is about the client and the server upgrading while IP is about every box inbetween as well. If you look at TLS and HTTP version changes when the inbetween infrastructure is involved (even just a single corporate FW, not the whole path) you're held to legacy versions just the same as IP is held to legacy versions.

Eventually some protocol is the bottom of what a group agrees to speak rather than individuals and that protocol has a completely different set of deployment issues than abstraction layers that can be built between end stations at higher levels.

Re: Is there hope for IPv6?

#126

Post by zzzcpan » Sat, Jan 05, 2019, 6:48 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

> The party that is out of IPv4 addresses needs IPv6.

That party is not an ISP though. An ISP is interested to provide IPv4 internet no matter whether there is IPv6 or there isn't.

Re: Is there hope for IPv6?

#127

Post by rleigh » Sat, Jan 05, 2019, 6:50 PM UTC

Pxtl wrote: post #47

dpark wrote: post #19

Earlier quoted context omitted.

IPv4 is for machines. IP addresses were never intended for humans, which is why domain names exist.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

Most common routers and systems will automatically register and resolve names automatically on the local network. Plus there's zeroconf on top of that. You don't need to manually edit bind zone files for your local network unless you really want to.

Re: Is there hope for IPv6?

#128

Post by Gibbon1 » Sat, Jan 05, 2019, 6:51 PM UTC

wongarsu wrote: post #42

magila wrote: post #29

What we really need is a killer app that requires end-to-end connectivity. Users have little reason to care about IPv6 right now because the existing ecosystem of services has evolved around the constraints of NAT. As IPv6 deployment expands hopefully we will reach a point where some great new application becomes economically viable. My biggest fear is such an application not emerging quickly enough. Without an imper…

There are great apps "requiring" end-to-end connectivity. Cryptocurrency clients, various videochat solutions, many multiplayer games, bittorrent clients, etc. They either force you to set up port forwarding (unless they can do it themselves using UPnP), or they use STUN/ICE or any of the other NAT traversal techniques. As a last resort it's often sufficient if enough of your users are reachable from the outside and…

Consumer IOT devices really should be peer to peer so it just works without the manufacturer having to deal with security issues on the server side. And because there are two types of IOT providers, those that don't want your data nor the security headaches that entails;those whose business model is about spying on people.

Re: Is there hope for IPv6?

#129

Post by hn_throwaway_99 » Sat, Jan 05, 2019, 6:51 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

> For the last couple of years we now have a mature market for IPv4 addresses.

Which highlights the utter failure of v6 - people are willing to pay for access to technology that v6 was supposed to make obsolete over a decade ago.

Re: Is there hope for IPv6?

#130

Post by geofft » Sat, Jan 05, 2019, 6:54 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

Why is IPv6 more attractive for address exhaustion than IPv4 NAT?

As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's the benefit? Are there systems of communication between parties on the public internet that can guarantee native IPv6 on both ends, don't want to use IPv4 NAT, and don't want to set up a point-to-point VPN?

(I am actually okay with IPv6 ULAs for private addressing on private VPNs to avoid RFC 1918 collisions/exhaustion, but that also saves you a lot of the complexity of IPv6 deployment because you don't need any network device support, you generally get address assignments from your VPN layer and don't need to think about SLAAC or DHCPv6 or anything, etc. And it's unrelated to public IPv4 exhaustion.)