Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enabling IPv6 support for GitHub Pages

github.blog

Post reply on HN
Print view View original

121–130 of 148 posts

Re: Enabling IPv6 support for GitHub Pages

#121

Post by bipson »

curiousmindz wrote: post #3

It boggles my mind that IPv6 has such a slow roll out (it's been a thing since the early 2000s = twenty years ago). I would have thought that all the major tech companies supported it years ago on all their infrastructures, websites and apps. But there are still a lot of hold outs. What about IPv6 makes it such a chore to become widespread?

Even at organizations that have considerably smaller networks than Google, Amazon, Facebook and Co there are just seemingly insurmountable numbers of "small" problems that discourage all the involved parties to adopt.

We had IPv6 at our research area 10 years ago. Admins changed, and it was wind down bit by bit, because "it made problems". Not only that, I learned that the the general view over all of the admin-staff in our organization (a larger "Technical university" in Europe) agreed that IPv6 "makes problems" and nobody wants it.

Change is painful...? It is a shame, but what can you do?

Re: Enabling IPv6 support for GitHub Pages

#122

Post by dx034 »

voiper1 wrote: post #15
metalliqaz wrote: post #9

Earlier quoted context omitted.

the Internet is almost out of IPv4 addresses, and the ones that are left are becoming expensive to obtain. Rather than hide whole blocks of users behind NAT, they can just use IPv6.

>Rather than hide whole blocks of users behind NAT, ... which creates all sorts of routing issues. If you don't have your own publicly accessible IP address it creates all sorts of connection issues.

I don't want to have my own IP, at least not without frequent changes. My servers should have static IPs but having static IPs at home or for mobile devices only makes tracking easier..

Re: Enabling IPv6 support for GitHub Pages

#123

Post by ju-st »

jauer wrote: post #37
mabbo wrote: post #30

Earlier quoted context omitted.

I recall being at Amazon some years ago when we were running out of IP addresses internally. A natural answer was "Why don't we all just switch to IPv6?". The senior principle project manager in charge put it very simply: "The number of routers that don't support IPv6 that we'd need to replace exceeds the world-wide yearly production of IPv6 routers capable of replacing them. At our current rate of growth, we have le…

Facebook's answer was "fine, we'll build our own routers" (in the datacenter, which is where quantity comes in, and is now v6-only (with few exceptions): https://www.internetsociety.org/resources/deploy360/2014/cas... Major tech companies have constraints, but when they decide to move, they can move almost anything. It would be cool to see how constraints and problem solving approaches differed among the FANG compani…

It's impressive they did that already in 2014!

Re: Enabling IPv6 support for GitHub Pages

#124

Post by throw0101a »

commandersaki wrote: post #106
throw0101a wrote: post #56

Earlier quoted context omitted.

> I don’t really understand the benefits, would you mind explaining them to me ? Want to run a public service with end-to-end connectivity? Go to your RIR to request an IPv4 block and be put on a waiting list. Or break out your cheque book and be prepared to cough up $35+/IP for the privilege: * https://auctions.ipv4.global * https://ipv4marketgroup.com/ipv4-pricing/ * https://ipv4connect.com/marketplace Or get an IP…

You'd still need IPv4 to connect with the Internet.

Plenty of folks are IPv6-only. Mobile on T-Mobile for example:

* https://www.youtube.com/watch?v=nNMNglk_CvE

Re: Enabling IPv6 support for GitHub Pages

#125

Post by throw0101a »

BenjiWiebe wrote: post #68
throw0101a wrote: post #52

Earlier quoted context omitted.

> 2. I'm used to the pseudo security that a NAT gives. If you wish to do this with IPv6 you can with ULA and NPTv6: * https://en.wikipedia.org/wiki/Unique_local_address * https://en.wikipedia.org/wiki/IPv6-to-IPv6_Network_Prefix_Tr... > 3. All those ICMPv6 messages sniffing (and snooping?) really don't fill me with joy joy happiness. For those wondering: ping works by sending ICMP(v4) echo request packets. If you wis…

Please don't block ttl exceeded packets... It will cause some very hard to troubleshoot network issues for someone somewhere sometime.

I agree… but some folks seem to think blocking ping and traceroute give you some kind of extra security.

Re: Enabling IPv6 support for GitHub Pages

#126

Post by throw0101a »

GrayShade wrote: post #85
throw0101a wrote: post #49

Earlier quoted context omitted.

> In consumer routers, port forwarding is the exact same thing as an inbound traffic firewall. But when I turn on IPv6, what is the equivalent? Is my printer still protected from random inbound internet traffic? Copy-pasting from a previous discussion a little while ago: --- IPv4+NAT does not remove any more classes of problems than IPv6+firewall. Firewalls under IPv6 work exactly the same way as they do with IPv4. A…

All right, but assuming I have a dynamic DNS setup, how do I connect to one of the hosts in my network? I think most OSes do that privacy thing where they periodically randomize the suffix of their v6 address.

Given the number of addresses available in a /64 IPv6 subnet, pick a value to statically assign to it and use that. If you have a SSH bastion host / jump box, perhaps pick ::22 as the end address part.

A friend assigned ::25 for the service vIP of his SMTP server/process, and ::143 for IMAP. Your web(mail) host could be ::80 and/or ::443. All on the same host (if you wish). If you have an HA setup you can have the vIP failover by using (e.g.) keepalived.

Using tokens may be of some interest as well:

* https://man7.org/linux/man-pages/man8/ip-token.8.html

You can have a public prefix address, as well as a local 'private' ULA address at the same time. In some ways I wish the best practice would be for IoT devices and appliances (like printers) only have link-local addresses, and perhaps ULA if advertised, with global addresses only configured via config switch. It would perhaps allay some the concerns that people have (like you do).

Re: Enabling IPv6 support for GitHub Pages

#127

Post by throw0101a »

wmf wrote: post #58
throw0101a wrote: post #29

Earlier quoted context omitted.

> It boggles my mind that IPv6 has such a slow roll out (it's been a thing since the early 2000s = twenty years ago). IPv4 had just as slow a roll out in some ways. TCP/IP had its flag day in 1983: * https://en.wikipedia.org/wiki/Flag_day_(computing) There was early commercialization of the Internet around ±1990, but it didn't really start taking off until around 1994: * https://en.wikipedia.org/wiki/Commercializatio…

So it took 15 years to build the entire Internet from scratch but it's taking over 20 years to upgrade to a new version.

How often were people upgrading computers in the 1990s and 2000s? How often are people upgrading now?

For a lot of folks when they get to good enough they stop. Understandable.

But the "good enough" of IPv4 has taken a lot of effort in the last few years. How much gnashing of teeth has NAT caused and having to invent TURN and STUN and a bunch of others things?

Anyone remember Skype supernodes?

With IPv6 you "just" have to do firewall hole punching without all the drama of packet tuple munging.

And good luck with double-(CG-)NAT hole punching.

Re: Enabling IPv6 support for GitHub Pages

#128

Post by zokier »

xxpor wrote: post #67
zokier wrote: post #23

Earlier quoted context omitted.

I think its more of a matter of perception than anything. IPv6 adoption has gone pretty smoothly imho, there hasn't been any major blowbacks or anything; for example the Google IPv6 adoption chart trend is steadily increasing. Another thing you can see from Google IPv6 charts that before 2011 IPv6 adoption was near zero. This matches pretty well with IPv4 exhaustion; IANA pool was exhausted in 2011, and APNIC followe…

Someone pointed out recently on NANOG the thing that probably killed a TON of IPv6 momentum was when they missed the deadline to get it included in Windows 95. Approximately no one was on the internet before then. (Yes yes you nerds were, but most people weren't)

Seems pretty far fetched to me that there would have ever been a chance to have IPv6 in Win9x. For comparison, afain FreeBSD was the forerunner with IPv6 support, and they got it in 2000. So I'd say they "missed the deadline" by 5+ years. It was probably around 2005 when we realistically had somewhat usable IPv6 support at base OS level.

Re: Enabling IPv6 support for GitHub Pages

#129

Post by geofft »

azernik wrote: post #108
geofft wrote: post #77

Earlier quoted context omitted.

> What about IPv6 makes it such a chore to become widespread? IPv6 is not just a straightforward extension of IPv4 to bigger addresses (plus some cleverness for how to route between them, if at all). There's a whole lot of other complexity in the protocol. There's a way you're supposed to get addresses that's not DHCP, and a good chunk of clients don't have or only recently got a DHCPv6 implementation. You're suppose…

Having implemented SLAAC and address anonymization: These are very, very simple protocols.

Oh, sure, but my point isn't about implementation complexity, it's about network architecture.

SLAAC doesn't work the way DHCP works. Do you have an IPAM tool that assigns addresses? Do you have a VMM/private cloud where addresses are in a database and you set up firewall rules? Do you have a guest wifi network where you assign a quarantine IP with a short lease and then a real IP once they authenticate? None of that works with SLAAC.

Especially if you have an existing IPv4 network and are rolling out dual-stack and have no interest in breaking IPv4, adding IPv6 via SLAAC is hardly a matter of adding another column in your schema. It's an architectural change.

Again, maybe that change is good, but that's the chore - not implementing the protocol (which is basically ip link | sed | ip addr add).

For privacy addresses, if you were considering implementing IPv6 before they were widespread, you'd have to figure out a way to keep from leaking them. The obvious approach is NAT, but that's effectively not an option. So you decide not to make IPv6 available to clients, only servers that already have fixed IPv4 addresses and don't roam. Or you do manual (non-SLAAC, non-DHCPv6 because that wasn't an option) configuration. Once they became available and common in people's clients, sure, but that means we didn't have "20 years" for people to offer IPv6 on guest wifi networks, we had a lot less.

Same with NATs. Implementing "not using a NAT" is absolutely trivial; you just... don't. Redesigning your network architecture not to use one, however meritorious it may be, is a massive task.

Re: Enabling IPv6 support for GitHub Pages

#130

Post by throw0101a »

apple4ever wrote: post #80
throw0101a wrote: post #55

Earlier quoted context omitted.

> Why change something that works? Because it does not work. Want to run a public service with end-to-end connectivity? Go to your RIR to request an IPv4 block and be put on a waiting list. Or break out your cheque book and be prepared to cough up $35+/IP for the privilege of global connectivity: * https://auctions.ipv4.global * https://ipv4marketgroup.com/ipv4-pricing/ * https://ipv4connect.com/marketplace

A friends company that was able to buy two /24s under $2K each and get them pretty quick. When I signed up for a new data center internet connection, both my ISPs charged me something like $25/month for a /24. IPv4 addresses are still relatively cheap to get.

Remember when IPv4 addresses were assigned/given out for free? Pepperidge Farms remembers. :)

When did the company purchase them? Was it a private sale or through a broker(?)? I'm curious as to the process, especially if it was more recent.

Post reply on HN