Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling IPv6 support for GitHub Pages

github.blog

Post reply on HN
Print view View original

81–90 of 148 posts

Re: Enabling IPv6 support for GitHub Pages

#81

Post by kjs3 »

mabbo wrote: post #30
curiousmindz wrote: post #3

It boggles my mind that IPv6 has such a slow roll out (it's been a thing since the early 2000s = twenty years ago). I would have thought that all the major tech companies supported it years ago on all their infrastructures, websites and apps. But there are still a lot of hold outs. What about IPv6 makes it such a chore to become widespread?

I recall being at Amazon some years ago when we were running out of IP addresses internally. A natural answer was "Why don't we all just switch to IPv6?". The senior principle project manager in charge put it very simply: "The number of routers that don't support IPv6 that we'd need to replace exceeds the world-wide yearly production of IPv6 routers capable of replacing them. At our current rate of growth, we have le…

Great story; I don't buy it. I haven't purchased a commercial-grade router (for values of more than just 'Cisco' or 'Juniper') that couldn't support IPv6 (admittedly for better and worse levels of 'support') since the early 2000s. If Amazon wanted them, they would have been supplied. Maybe it's "no one can supply routers with the IPv6 support we want (snowflake emoji)" or "we can't deploy the routers fast enough operationally". But not enough v6 capable routers is a stretch.

And even so...this anecdote is/was 'many years after the fact', so what's the issue now? Easy: they don't need it enough to spend the money to operationalize it.

Re: Enabling IPv6 support for GitHub Pages

#82

Post by lokedhs »

kalleboo wrote: post #76
lokedhs wrote: post #66

Earlier quoted context omitted.

In what way doesn't Ubiquity sorry it? I'm using only Ubiquity gear at home, and my network is fully IPv6. My router is an Edgerouter by the way. I do recall seeing some of the configuration wizard stuff not having options for IPv6 in the past, but that's just for initial configuration anyway. Once you are done with that you do everything from the config tree anyway.

If you configure an EdgeRouter completely through the command line then yes it does support it. The web UI though, is completely missing things like IPv6 firewall if you just quickly want to add a rule with a few clicks. On the Unifi gear, the IPv6 UI that is there is marked "beta"

Thanks for the information. Since my firewall configuration is a bit more complex than what was supported by the simplified UI I never really used it.

Just to be clear, one can configure the IPv6 firewall through the UI. One just has to use the config-tree rather than the easy firewall configuration.

Re: Enabling IPv6 support for GitHub Pages

#83

Post by kjs3 »

wmf wrote: post #58
throw0101a wrote: post #29

Earlier quoted context omitted.

> It boggles my mind that IPv6 has such a slow roll out (it's been a thing since the early 2000s = twenty years ago). IPv4 had just as slow a roll out in some ways. TCP/IP had its flag day in 1983: * https://en.wikipedia.org/wiki/Flag_day_(computing) There was early commercialization of the Internet around ±1990, but it didn't really start taking off until around 1994: * https://en.wikipedia.org/wiki/Commercializatio…

So it took 15 years to build the entire Internet from scratch but it's taking over 20 years to upgrade to a new version.

What does one have to do with the other?

Re: Enabling IPv6 support for GitHub Pages

#84

Post by kjs3 »

BenjiWiebe wrote: post #68
throw0101a wrote: post #52

Earlier quoted context omitted.

> 2. I'm used to the pseudo security that a NAT gives. If you wish to do this with IPv6 you can with ULA and NPTv6: * https://en.wikipedia.org/wiki/Unique_local_address * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... > 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness. For those wondering: ping works by sending ICMP(v4) echo request packets. If you wis…

Please don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.

Amen, brother. Someone like your CEO at somewhere like his lake house at the end of a dodgy DSL line from Cletus's ISP and Bait Shop.

I kid, I kid...they didn't sell bait.

There are a lot of unpleasant failure modes to blocking ICMP without completely understanding the implications.

Re: Enabling IPv6 support for GitHub Pages

#85

Post by GrayShade »

throw0101a wrote: post #49
Slix wrote: post #42

Earlier quoted context omitted.

> I'm used to the pseudo security that a NAT gives. In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? On my Netgear R6700, I can't figure it out from the UI or from forum posts/help content. And without being certain, I don't want to turn on IPv6. Even though…

> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. A…

All right, but assuming I have a dynamic DNS setup, how do I connect to one of the hosts in my network?

I think most OSes do that privacy thing where they periodically randomize the suffix of their v6 address.

Re: Enabling IPv6 support for GitHub Pages

#86

Post by kazen44 »

throw0101a wrote: post #45
Macha wrote: post #43

Earlier quoted context omitted.

That's a different concern though - Promoting the whole use case of the internet vs migration from one protocol to another. If we compare the http to https migration, Firesheep in 2010 demonstrated that maybe migration was the right thing to do rather than just an optional security feature for banks, Lets Encrypt was released to the public in 2014 and by like... 2019 basically all of the internet was HTTPS. There is…

> Lets Encrypt was released to the public in 2014 and by like... 2019 basically all of the internet was HTTPS. This is apples and oranges: absolutely zero software upgrades needed to be done to get HTTPS going and/or Let's Encrypt running. I was able to get LE going on our F5 appliances in a few working days with zero changes to the base system/appliance software by simply installing the dehydrated ACME client and al…

7 years for a core router is on the low end aswell. High end routers consist of a chassis which can last a decade or more easily. usually the line cards inside the chassis are replaced to allow higher band with, but the control plane can stay in place for a very long time.

Re: Enabling IPv6 support for GitHub Pages

#87

Post by kazen44 »

lokedhs wrote: post #63
AceJohnny2 wrote: post #11

Earlier quoted context omitted.

Years ago, the French ISP `Free`, after much dragging of feet, enabled IPv6 support for their customers. Performance was abysmal, 2x-10x slower than IPv4. Turns out many of the routers out there can perform IPv4 table lookups in the data-plane (fast-path), but IPv6 is delegated to the control-plane (slow-path), for much slower performance.

I see the opposite right now, with transfer rates being about the same but latency over IPv4 being quite bad compared to IPv6: Pinging www.google.com with IPv6: $ ping www.google.com PING www.google.com(sc-in-x67.1e100.net (2404:6800:4003:c02::67)) 56 data bytes 64 bytes from sc-in-f103.1e100.net (2404:6800:4003:c02::67): icmp_seq=1 ttl=108 time=4.46 ms 64 bytes from sc-in-x67.1e100.net (2404:6800:4003:c02::67): icmp…

theoretically, ipv6 routing itself is far faster because the header is far simpler to parse.

also, the ipv6 space is far less fragmented then ipv4. this could lead to more direct routing aswell.

Re: Enabling IPv6 support for GitHub Pages

#88

Post by lazide »

Dylan16807 wrote: post #69
lazide wrote: post #59

Earlier quoted context omitted.

Fat lot of good that will do you with your project that needs to be completed next year or your company is hosed no? And once you do the fix - which won’t require ipv6 or will use a different vendor - then you won’t be talking to them anyway. The underlying issue is that there is a lot of momentum with v4, and hacks mostly work and work faster and easier, so most people end up going that way. So it keeps the momentum…

> Fat lot of good that will do you with your project that needs to be completed next year or your company is hosed no? You can do both. > And once you do the fix - which won’t require ipv6 or will use a different vendor - then you won’t be talking to them anyway. It depends on whether you actually want to fix it. > The underlying issue is that there is a lot of momentum with v4, and hacks mostly work and work faster…

That’s nice, but clearly not how the majority of the purchasing departments work right now, correct?

And if most people don’t buy that way - then it isn’t easy to get solid equipment that can do things that way - which makes it hard to get the equipment you need.

Re: Enabling IPv6 support for GitHub Pages

#89

Post by kazen44 »

lokedhs wrote: post #64
throw0101a wrote: post #49

Earlier quoted context omitted.

> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. A…

Ping will still likely work. At least I can ping all my machines on my private network. However, I'm not able to ssh into it or anything else, because all traffic is dropped. It all depends on firewall configuration, but I think you may unnecessarily scare people by suggesting they're wide open just because ping works.

ICMP should be allowed anyways because of MTU path discovery.

stop disabling ping

Re: Enabling IPv6 support for GitHub Pages

#90

Post by fulafel »

IshKebab wrote: post #20
curiousmindz wrote: post #3

It boggles my mind that IPv6 has such a slow roll out (it's been a thing since the early 2000s = twenty years ago). I would have thought that all the major tech companies supported it years ago on all their infrastructures, websites and apps. But there are still a lot of hold outs. What about IPv6 makes it such a chore to become widespread?

Give it another 20 years... https://www.google.com/intl/en/ipv6/statistics.html

Note that this is measuring clients of Google services. It's useful for tracking consumer ISPs, but applications that really benefit from e2e connectivity have been and will be moving faster.
Post reply on HN