Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#131

Post by mdaniel » Sat, Jan 05, 2019, 6:56 PM UTC

Pxtl wrote: post #47

dpark wrote: post #19

Earlier quoted context omitted.

IPv4 is for machines. IP addresses were never intended for humans, which is why domain names exist.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

> If my ISP offered free dyndns

I am about 80% certain that in the time it took you to write this comment you could have bought a domain name, used the registrar's web-gui to input your now static IP addresses, and had a perfectly functioning DNS setup for your home.

Or, if the free DDNS is the most important to you, OpenWRT appears to natively support quite an extensive list: https://openwrt.org/docs/guide-user/services/ddns/client

Re: Is there hope for IPv6?

#132

Post by wongarsu » Sat, Jan 05, 2019, 6:58 PM UTC

Gibbon1 wrote: post #128

wongarsu wrote: post #42

Earlier quoted context omitted.

There are great apps "requiring" end-to-end connectivity. Cryptocurrency clients, various videochat solutions, many multiplayer games, bittorrent clients, etc. They either force you to set up port forwarding (unless they can do it themselves using UPnP), or they use STUN/ICE or any of the other NAT traversal techniques. As a last resort it's often sufficient if enough of your users are reachable from the outside and…

Consumer IOT devices really should be peer to peer so it just works without the manufacturer having to deal with security issues on the server side. And because there are two types of IOT providers, those that don't want your data nor the security headaches that entails;those whose business model is about spying on people.

If your IOT device doesn't connect to the internet, then there isn't an issue to begin with (peer to peer on IPV4 works great within your own WIFI, and other non-IP protocols on a different frequency are usually a better choice anyways).

If it does connect to the internet, I would rather have the device phone to one server only, and that server handling public access. It's much easier to keep one server secure than millions of devices that are in the hands of customers.

Of course my prefered option are IOT devices talking to one hub I control in my network, and me deciding how I want to expose that hub. But in that case, peer-to-peer communication is a non-issue just like in the first case.

Re: Is there hope for IPv6?

#133

Post by Dagger2 » Sat, Jan 05, 2019, 7:00 PM UTC

AnIdiotOnTheNet wrote: post #54

apearson wrote: post #12

Earlier quoted context omitted.

I'm not sure what routers you've used or seen but every home router I've touched in the last 5 to 10 years has had the option to enable IPv6 in its settings. Also, IPv6 has a unique address that everybody can reach but most if not all routers have an IPv6 firewall that gives at least if not more security than NAT provides.

> IPv6 firewall that gives at least if not more security than NAT provides That's just not true. NAT and firewall both achieve what little security they provide through simple blocking of packets based on state information. Firewalls generally provide more robust state information, but NAT is what lets you redirect sockets. They work together.

Except NAT gives no security, because NAT doesn't block packets.

If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would be, and in the absence of a firewall (which is logically separate, even if often implemented in the same software stack) it'll be routed to whatever the destination in the packet header is.

Re: Is there hope for IPv6?

#134

Post by gregmac » Sat, Jan 05, 2019, 7:02 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

- No transition or migration design. It seems like IPv6 was designed as if it was being built instead of building IPv4, and didn't consider how the move would happen beyond something like "everyone run dual-stack IPv4/IPv6, and once that's at 100% we'll turn off IPv4."

This results in a stale-mate of sorts:

As a server operator, as long as you have IPv4-only clients, you need an IPv4 address. There are no [1] IPv6-only clients, so implementing IPv6 at all is a lot of work with no tangible benefits for the next x years [2].

As a client, you can't go IPv6-only without losing access to the IPv4-only services. There are no[1] IPv6-only servers, so implementing IPv6 at all is a bunch of work with no real benefits for the next x years[2]

[1] no meaning a tiny fraction that rounds to 0%

[2] x being the number of years before there's a significant number of IPv6-only servers or users.

Re: Is there hope for IPv6?

#135

Post by toast0 » Sat, Jan 05, 2019, 7:07 PM UTC

vnw wrote: post #62

yjftsjthsd-h wrote: post #60

Earlier quoted context omitted.

It's less a redeeming quality and more the entire reason why we bothered to switch to a new system. So yes, that is the point.

Then, given that CG-NAT solutions have proven to work well and they don't bother most end users, it's no wonder the transition to IPv6 has stopped.

For ISPs (and mobile carriers) that are actively involved in their infrastructure, CG-NAT is more expensive to run than native ipv6 (aquiring IPv4 public addresses; tracking connection states; if all customers are on private IPv4, maintaining multiple distinct private networks with the same address space is a hassle too), so those ISPs are pushing to make services available over IPv6 (I've heard from T-Mobile USA and Jio India), but that doesn't mean they won't also run CG-NAT for customers on older devices and for services that aren't IPv6 -- it just reduces the deployment. For smaller ISPs, or where everything is contracted out, the cost savings aren't as apparent.

Re: Is there hope for IPv6?

#136

Post by rawoke083600 » Sat, Jan 05, 2019, 7:10 PM UTC

SlowRobotAhead wrote: post #32

rawoke083600 wrote: post #25

how about ipv5 and we just add an extra .255 ? Im sure our kids wilk figure out a better solution... ?

You joke, but I’m pretty sure ipv6 suffered by removing the familiar octets system in favor of something most people can’t understand.

absolutely ! I can shout an ipv4 address across the office... i cant easily do it with ipv6 :/

Re: Is there hope for IPv6?

#137

Post by elcomet » Sat, Jan 05, 2019, 7:11 PM UTC

chrononaut wrote: post #88

AnIdiotOnTheNet wrote: post #74

Earlier quoted context omitted.

> because I get assigned a new prefix every 24 hours Which kinda defeats the purpose of having a globally reachable unique address in a lot of respects. How am I supposed to allow connections to this device in my firewall if the address is always changing?

There's advantages and disadvantages to this approach. When we're talking about residential networks, some consumers won't care about the inability to do that, some will. Those that do care also have to weigh the privacy concerns about the fact that they have a now static prefix for their networks, much like static IPv4 addresses. Personally I'd prefer ISPs to take an approach like this by default, but allow the opti…

> When we're talking about residential networks, some consumers won't care about the inability to do that, some will.

This prevents also to create products that need a public address. I think it is a real brake on innovation, who knows what could be invented if everyone had a public ip address ?

Re: Is there hope for IPv6?

#138

Post by Dagger2 » Sat, Jan 05, 2019, 7:12 PM UTC

paulddraper wrote: post #84

CydeWeys wrote: post #40

Earlier quoted context omitted.

Assuming you're not joking, the nice thing about IPv4 is that it uses 32 bits, so you can store addresses in an unsigned int and use memory efficiently. Just adding one octet takes you up to 40 bits, which has alignment issues. You may as well go up to 64 bits (half of IPv6), which could be represented as 16 hex characters, e.g. 06A4.6E1B.12C9.95C8. That way you're kicking the can much farther down the road too.

I always wish IPv6 had done example this -- use 64 bits. The address space is still enormous: a couple billion for every currently living person (yes, I know allocating isn't 100% efficient, but even at 0.001% efficiency, that's still tens of thousands per capita). And, the address could fit in a common word size, and be significantly more readable. As is, IPv6's one-address-per-atom-on-Earth is unnecessary, the addr…

64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today, and there's far more space available in v6 today than there would be after 100+ years of your 64-bit space.

Having an unnecessarily large amount of addresses is a good thing, because the alternative is to have too few addresses. You don't want to have too few addresses, because if you think v6 is taking a long time to roll out... imagine how long a replacement to it would take.

Re: Is there hope for IPv6?

#139

Post by _0w8t » Sat, Jan 05, 2019, 7:13 PM UTC

zamadatix wrote: post #125

Someone1234 wrote: post #41

Earlier quoted context omitted.

Backwards compatibility seems to be the largest. Look at the deployment of TLS as a success story. Everyone kept on supporting both old and new, watched the percentages, and then dropped the old when the new had enough penetration. The whole thing is also a bit of a shell game. Nobody wants to invest in it until they feel like they're "behind" if they don't. So you have a big player or two in order to make it feel li…

You can do the same thing with v6, the difference is problem space. TLS is about the client and the server upgrading while IP is about every box inbetween as well. If you look at TLS and HTTP version changes when the inbetween infrastructure is involved (even just a single corporate FW, not the whole path) you're held to legacy versions just the same as IP is held to legacy versions. Eventually some protocol is the b…

It is not only about intermediate boxes. Just consider how relatively smoothly various parts of WiFi stack was upgraded or how 2G->4G transition happens with mobiles phones.

The biggest problem with IPv6 is that it a different protocol that requires special support on all levels starting from applications and down to managed switches.

Re: Is there hope for IPv6?

#140

Post by zamadatix » Sat, Jan 05, 2019, 7:14 PM UTC

dghughes wrote: post #46

I like IPv6 it can actually be easier to set up stuff instead of using IPv4 for example OSPF. But I find IPv6 is not as intuitive as IPv4 just looking at an address in IPv4 vs IPv6. You can create new networks for IPv4 pretty easily just by eyeball but not IPv6. At least I can't.

It's pretty easy in v6 if you follow the best practice of making client subnets /64s. Say you were assigned a bog standard /48 then you would have the patternxxxx:xxxx:xxxx:yyyy::z where:

x represents your fixed routing prefix

y represents your subnet instance (0000-FFFF, 2^16 subnets)

:: represents the expansion of "0000:"s

z represents the client identifier.

For a relatively normal /56 or /60 home user assignment via PD from an ISP you simply lose 2 or 3 "y"s respectively. In both your client netmasks are always /64 and your gateways should always be fixed:subnet::1.