Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is there hope for IPv6?

internetgovernance.org

Post reply on HN
Print view View original

261–270 of 399 posts

Re: Is there hope for IPv6?

#261

Post by zokier »

kens wrote: post #36
hn_throwaway_99 wrote: post #15

I hope (but am skeptical) that folks look at the overall failure of ipv6 from a deployment perspective to understand the root causes of why it failed (some may think "failure" is too strong a word, but I remember v6 being "just around the corner" in 2000, yet in 2019 I'm still connecting to a GCP database with v4). Coming up with a solution that looks like a huge technological advancement, with no real respect for th…

It seems like a lot of technology transitions go smoothly, while others painfully drag on for a decade (ipv6, Python3). Are there any common root causes for the semi-failures? Has anyone written about why some succeed and some don't?

But is either Python3 or IPv6 really a failure? Sure the migration has been slow, but has still been rolling on pretty consistently forwards. There are no major reversal in the trends of either IPv6 or Py3k adoptation, and especially for IPv6 there is pretty much no alternative out there.

Maybe just a decade is not all that long period and the tech community is too impatient due the historically rapid pace of changes.

Re: Is there hope for IPv6?

#262

Post by Dagger2 »

bartwe wrote: post #241
Dagger2 wrote: post #211

Earlier quoted context omitted.

Isn't it? I thought we were talking about NAT, not about RFC1918. Even NAT in combination with RFC1918 doesn't give you security. The use of RFC1918 would certainly limit the set of people that could connect to your LAN machines, but it would be hard to call the result secure since anybody sharing your upstream L2 network, plus your ISP and anyone who can trick, force or coerce them into cooperating could still acces…

Terminology shifted, when NAT is talked about it is generally considered to be MASQ NAT to RFC1918 ranges

Even then, that would still only put you into the situation in the second paragraph of my previous post. You would still need a firewall, and if you have a firewall then shifting to RFC1918, adding MASQ NAT or even doing both won't help, because inbound connections are already blocked.

Re: Is there hope for IPv6?

#263

Post by vetinari »

pas wrote: post #214
vetinari wrote: post #96

Earlier quoted context omitted.

Elsewhere, the ISPs are doing the IPv6 rollout in the worst possible way imaginable: DS-Lite with no PCP for AFTR (i.e. no way to have incoming IPv4), and allocating only /64 subnet, where their CPE is mandatory in router mode, no way to switch it to bridge mode (thus losing control of your own gateway. I'm talking about you, UPC/Liberty Global). For just consuming the web, it is fine. For switching from public IPv4,…

NAT traversal (hole punching) works for CGN well, doesn't it? sure you need a coordinator/RP between to CGNed users, but that is not really an issue as far as I know.

Hole punching works for applications that are designed for it, and can invoke the coordinator. Sometimes, you just want plain old incoming connection (in my case, VPN).

BTH, I've never tested whether it works with CGNAT or not. It would be additional hop to jump if I would give up my IPv4 address, which obviously I'm not going to.

Re: Is there hope for IPv6?

#264

Post by gbrayut »

pedrocx486 wrote: post #242
gerdesj wrote: post #225

Earlier quoted context omitted.

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

>- If you go around memorising addresses then you are doing IT wrong in general. Because I'll surely have an TLD for my local nginx and for my home router...

Just use home.arpa from https://tools.ietf.org/html/rfc8375 with a custom DNS server or host file. Or one of the many dynamic DNS systems.

Re: Is there hope for IPv6?

#265

Post by devdas »

4bpp wrote: post #198
phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

More issues with IPv6 that are relevant for me as a techie: - Memorising an IPv4 address is about as easy as memorising a phone number, which is to say, fairly easy. I remember the iPv4 addresses of both my rental servers, every device on my home LAN, a bunch of public DNS servers if things go wrong, ...; there's no way I'm going to be able to do that for IPv6. - At least last time I tested it (more than 10 years ago…

NATs break end to end. This might be acceptable in a HTTP(s) only world though.

Of course, some people aren't only using the Internet for browsing.

The Internet of things will end up needing unique endpoints, and NAT does not play will with those either.

India has a lot of people, and quite a few of them will be IPv6 only (or behind a very degraded carrier grade NAT). If you are talking to customers/clients/vendors there, assume you need IPv6.

Memorising IP addresses isn't done in any larger scale network, you use DNS.

NATs work well at about the scale of a single household, beyond that, they keep making things worse.

Re: Is there hope for IPv6?

#266

Post by devdas »

pedrocx486 wrote: post #242
gerdesj wrote: post #225

Earlier quoted context omitted.

I'm a techie too but I think: - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. - In general…

>- If you go around memorising addresses then you are doing IT wrong in general. Because I'll surely have an TLD for my local nginx and for my home router...

.local?

Re: Is there hope for IPv6?

#267

Post by Dagger2 »

geofft wrote: post #181
phicoh wrote: post #179

Earlier quoted context omitted.

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performanc…

The most recent figures I've heard were that something like 40-60% of traffic (by bytes) on a dual-stacked client ISP will go over v6. I heard that stat about 4-5 years ago, so it seems reasonable to expect it to be even higher nowadays.

Another advantage is that v6 is easy to hand off early, but if you're CGNATing v4 then your v4 traffic has to go via your CGNAT routers. For cost reasons you probably want as few of those as possible, which means v4 traffic may need to go further to reach them. T-Mobile in the US is like this; v6 traffic is passed off as soon as possible and gets a relatively direct network path, but v4 traffic has to go all the way to one of their datacenters to get NATed. That can add a lot of latency.

Re: Is there hope for IPv6?

#268

Post by devdas »

geofft wrote: post #181
phicoh wrote: post #179

Earlier quoted context omitted.

There are a couple of reasons: - There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder. - A second problem it that you may lose geographical resolution if customers for a…

Do these arguments not apply to IPv6 customers speaking to legacy IPv4 sites? They also have to go through IPv4 NAT, it's just that the NAT is converting it to a public IPv6 address instead of a CGNAT IPv4 one. Wouldn't law enforcement and ad targeting be equally unhappy by piles of IPv6 users being converted to the same IPv4 address? If enough of the Internet is running IPv6 that you save significantly on performanc…

But you would have far fewer connections behind the IPv6 - IPv4 NAT.

Then the performance problems are limited to sites without IPv6.

Re: Is there hope for IPv6?

#269

Post by 4bpp »

gerdesj wrote: post #239
4bpp wrote: post #230

Earlier quoted context omitted.

> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now. Most of the things I do with memorised a…

Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.) Me too. Wireshark, nmap and co are in regular use in my job. All browsers are playing nanny, more and more apart from the likes of Links (which I also use quite often). A lack of https is already flagged and I suspec…

Well, my assumption was always that in a scenario such as: ISP makes me share my public-facing IP with 15 randos -> I get on a torrent for Sony Corporate Secrets [full pack] [2018].zip -> Sony's legal department connects a honeypot and harvests all IPs it sees on it and sends out subpoenae to identify everyone who is in a friendly jurisdiction, the circumstance that I'm NATted by my provider will actually do nontrivial work in reducing the probability that I am ultimately identified in a legally actionable way (especially if it were to take Sony a while to process its data). Is this not accurate?

Re: Is there hope for IPv6?

#270

Post by Wowfunhappy »

Osiris wrote: post #259
gerdesj wrote: post #250

Earlier quoted context omitted.

You can buy a DNS domain for a few quid per year or you can use a dynamic DNS service such as freeDNS for err free. If you go around exposing services on the internet then you should know how to do it properly. If you can get a name on it then you can put a SSL certificate on it (cheers Lets Encrypt). If you have a SSL cert on it then you can be fairly sure you are talking to your gear and not a MitM if you take othe…

With IPv4 you don't HAVE to buy a domain for your local network. You can do just fine with IP addresses. With IPv6, you probably will need to just to make it sane. That adds a whole new step, and a complex one that most people (general public) won't know how to do.

To be fair, most of the general public doesn't know what an ip address is.

I'm in the group that you're speaking of—I have a personal server set up that I can log into remotely, but the prospect of setting up a domain and TLS is very daunting. But, I don't think people like me are all that common.

Post reply on HN