Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#221

Post by the8472 » Sat, Jan 05, 2019, 9:19 PM UTC

geofft wrote: post #130

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's th…

NAT has many severe limitations.

When I was on an ISP with CGNAT I regularly saturated the connection tracking tables which resulted in all new connections failing until some some slots were freed up.

NAT also makes it difficult to run any kind of server at home (PCP support varies) or use any kind of p2p protocol. NAT traversal techniques don't work all the time and even when they work they may only help for coordinated connections but not for unsolicited contacts.

Re: Is there hope for IPv6?

#222

Post by lolc » Sat, Jan 05, 2019, 9:23 PM UTC

jjeaff wrote: post #208

4bpp wrote: post #198

Earlier quoted context omitted.

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

I have no real first hand knowledge of this, but I have wondered if part of the reluctance of ipv6 is the fact that many of the "powers that be" use ip addresses to identify and group traffic and other activity from multiple devices. They also use ip addresses to block scrapers (both Google and Amazon do this heavily). With ipv6, an IP address can be completely disposable. You could scrape Google search results all d…

If you try to do this at scale you'll find you won't get transit anywhere. Any AS will drop routes from you when Google looks their way. If you think you can ignore them, they'll just threaten upstream. You'll be cut off in hours.

It works the same way on v4 and v6.

Re: Is there hope for IPv6?

#223

Post by vbezhenar » Sat, Jan 05, 2019, 9:26 PM UTC

phicoh wrote: post #116

hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

I never truly delved into low level networking, but I generally got a grasp for IPv4, I can setup simple networks and I think that I understand what's going on on every level. Now despite the fact that I tried to understand IPv6 multiple times, I failed miserably all the time. I tried to setup IPv6-over-IPv4 OpenVPN, it did not work despite all efforts. IPv6 is just too complex. At this point I wish that IPv6 would be just IPv4 with 16-byte address (or better 8-byte, because that's really enough for everyone and another 8 bytes I have no idea who really need that, and our computers work natively with 8 bytes), keeping all concepts the same. Now I'm aggressively against any IPv6 and I'll do only the minimal amount of work to support IPv6 clients for my services while using IPv4 for my own infrastructure everywhere.

Re: Is there hope for IPv6?

#224

Post by 4bpp » Sat, Jan 05, 2019, 9:27 PM UTC

Dagger2 wrote: post #218

nothrabannosir wrote: post #213

Earlier quoted context omitted.

Wouldn't you be bound to a specific subnet dedicated to you? Or how does it work? Can you really just propagate to the world at any time "I am now baba:fefe:..."? Don't backbone routing tables get crazy mad verbose that way? I know next to nothing about ipv6, I'm afraid.

It would be a random address from a given subnet, yes. Basically the privacy, tracking and banning implications of this are more or less the same as they are with v4+NAT, with the v4 public IP mapping to the v6 subnet. Note that there's still no way to map a subnet to a person, just like there's no way to map a public v4 address to a person.

Huh, are you implying that with IPv6, the ISP can place multiple unrelated people in the same subnet but not coordinate with them regarding what address from the subnet they use? How does this work from a routing perspective? What if two people pick the same address?

On the other hand, if the ISP ultimately does hand out the address in the subnet (and the end user can merely ask it for a new one), the ISP can retain a record of this, which together with the server-side data can be used to unambiguously deduce who accessed what, whereas the equivalent information in v4+NAT is insufficient without also logging everyone's connection metadata. It would therefore be more appropriate to say the privacy, tracking and banning implications are the same as dynamic IPv4 without NAT, where you can likewise request a new address from your provider at any time.

Re: Is there hope for IPv6?

#225

Post by gerdesj » Sat, Jan 05, 2019, 9:28 PM UTC

4bpp wrote: post #198

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

I'm a techie too but I think:

- If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now.

- In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh

- The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day.

Now, for my gripes:

- Try doing multi WAN effectively over IPv6 without PI and a routing algorithm, or NAT - Try changing ISP (new addressing everywhere)

The second gripe I currently work around with RFC 4193 - Unique Local IPv6 Unicast Addresses, the first one I whine about and will probably use NPT (wholesale NAT for IPv6)

Re: Is there hope for IPv6?

#226

Post by pas » Sat, Jan 05, 2019, 9:30 PM UTC

keypress wrote: post #45

lisper wrote: post #34

Earlier quoted context omitted.

> What we really need is a killer app that requires end-to-end connectivity. That seems unlikely to emerge. Anything you can do with end-to-end connectivity you can do with a server in the middle forwarding packets. Servers are cheap and reliable, so there's very little incentive to get rid of them.

I still like the idea of a peer to peer web, with something like hosting in your own browser. This could be a great alternative fallback network with distributed DNS. Most phones are capable. Energy, speed and security are concerns, but in cracking them you'd probably make the web a better place.

IPFS works okay.

The problem is that if you want to host something usually you want it to be up and reachable 0-24. And that has costs, and p2p can help with that, but the freeloader problem is not trivial. (You need reputation or some other kind of accounting, that requires solving sybil attacks, and possibly global sync/enumeration, both are hard, etc.)

Re: Is there hope for IPv6?

#227

Post by Pxtl » Sat, Jan 05, 2019, 9:33 PM UTC

mdaniel wrote: post #131

Pxtl wrote: post #47

Earlier quoted context omitted.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

> If my ISP offered free dyndns I am about 80% certain that in the time it took you to write this comment you could have bought a domain name, used the registrar's web-gui to input your now static IP addresses, and had a perfectly functioning DNS setup for your home. Or, if the free DDNS is the most important to you, OpenWRT appears to natively support quite an extensive list: https://openwrt.org/docs/guide-user/serv…

I have a domain name. Setting up subdomains and binding it to addresses is non-trivial.

I have to figure out all the business of anames and MX records and how to set up a subdomain.

And considering that routers issue ipv4 addresses automatically, offer user-friendly GUIs for binding addresses to devices and forwarding ports, it's not really comparable is it?

Re: Is there hope for IPv6?

#228

Post by amaccuish » Sat, Jan 05, 2019, 9:33 PM UTC

Can anyone explain to me. So right now for v4, we have NAT, and several ways to get a port open and pointed at us. With v6, every device has its own public address, like how the internet was intended. And as sensible network admins, we should have a default deny incoming firewall policy for v6 traffic. But surely that will prevent these "end-to-end" apps from working, and now they don't even have protocols like UPnP to bypass the firewall and request ports to be opened?

Re: Is there hope for IPv6?

#229

Post by Pxtl » Sat, Jan 05, 2019, 9:35 PM UTC

rleigh wrote: post #127

Pxtl wrote: post #47

Earlier quoted context omitted.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

Most common routers and systems will automatically register and resolve names automatically on the local network. Plus there's zeroconf on top of that. You don't need to manually edit bind zone files for your local network unless you really want to.

I have literally never ever seen a cheap consumer router that did anything "automatically" successfully other than run DHCP and provide access from the LAN to the WAN.

Re: Is there hope for IPv6?

#230

Post by 4bpp » Sat, Jan 05, 2019, 9:37 PM UTC

gerdesj wrote: post #225

4bpp wrote: post #198

Earlier quoted context omitted.

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now.

Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.)

> - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh

I wondered if this may be the case; I may need to rerun some tests.

> - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day.

A website I navigate to may, but how will the carrier fingerprint my browser?

All in all, it seems like we are talking about very different threat models to privacy/security. You are worried about the likes of Google and Facebook profiling you, whereas I am worried about the likes of $intellectualpropertymonopolist sending me a $20k bill for identifying me in a torrent, or experiencing a nasty surprise at $nationalborder (or at home, [1]!) for something I said on an internet forum.

(This does not seem like an abstract or overblown threat to me; I've seen 2 out of the 3 things above happen to friends and even one schoolmate more than 2 times.)

[1] https://www.theguardian.com/uk/2012/nov/12/teenager-arrested...