Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: IPv6-only still pretty much unusable

news.ycombinator.com

Post reply on HN
Print view View original

331–340 of 649 posts

Re: Tell HN: IPv6-only still pretty much unusable

#331

Post by Dagger2 »

AdrianB1 wrote: post #290
MindTooth wrote: post #101

In Norway, it's required[0] for all public sectors to have IPv6. We are not there yet, but I believe the push will only increase with time. Especially all new internal networks must be IPv6, and IPv4 is optional. [0]: https://lovdata.no/dokument/SF/forskrift/2013-04-05-959?q=ip... (Sorry that it's in Norwegian.)

Norway is not big enough on Internet scale to make a difference. Equipment and software companies will put in balance the cost vs the benefit and may decide to ignore that market.

Perhaps not by themselves, but every country that does this adds to the weight of the argument.

Re: Tell HN: IPv6-only still pretty much unusable

#332

Post by rwky »

We enable IPv6 on CDNs e.g. Cloudfront/Cloudflare and load balancers, never had an issue and I do see IPv6 traffic hitting them. Apart from that it doesn't see much use. Personally I don't use IPv6 since I've never had and ISP with at home or on mobile living in the UK.

Re: Tell HN: IPv6-only still pretty much unusable

#333

Post by gnfargbl »

ipython wrote: post #314

I have to say I’m super disappointed in the ignorance and negativity in the comments on this thread. Ignorance of both the difficulties inherent in upgrading a fixed size wire protocol designed for a research network fifty years ago, and the widespread adoption of ipv6 for real customer deployments. Heck most of you are probably using ipv6 through your mobile carrier and don’t even know it!

I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol.

Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with it, and the 0.001% that do have time and space to become experts. IPv6 isn't like that -- it needs to be a consumer grade protocol that people can understand and work with. It either fails that test, or perhaps at best scrapes a borderline pass. We deserved better.

Re: Tell HN: IPv6-only still pretty much unusable

#334

Post by Dagger2 »

AnIdiotOnTheNet wrote: post #156
JshWright wrote: post #15

Earlier quoted context omitted.

Maybe it's because we're in the former Time Warner Cable/Road Runner part of Spectrum's territory, but we've had IPv6 for years now.

Sure, as long as you're ok with having a constantly changing prefix. At least that's how it is for home connections and it nullifies nearly all the benefits of v6.

You don't need a fixed prefix to get most of the benefits of v6.

DNS is a thing.

Re: Tell HN: IPv6-only still pretty much unusable

#335

Post by nottorp »

pantalaimon wrote: post #293
nottorp wrote: post #263

Earlier quoted context omitted.

Ok, i'll bite. > Auto generated addresses are usually in the form of "prefix - device_id" so even if a node has a lot of addresses, they are all mostly the same > Internet/non-local IPv6 addresses break the rules a bit and don't use a device_id in their addresses in order to protect user privacy So a device needs to have both an internal address and an "Internet/non-local" address in IPv6? Plus one for WAN and Link-L…

The internal address is optional, it's only useful if you want to have a known address if your uplink is down so you can do maintainance. You only need two addresses: - a global address - a link-local address

Not clear. How do i reach a device in my local network? Via the optional internal address if my uplink is down and via my link-local address if my uplink is up?

Is the link-local address any good if i'm on wifi but want to ssh into a wired host in my home?

Are you getting my point yet?

Edit: actually I won't wait. The point is it's needlessly overcomplicated. It was done by a commitee that didn't even consider people could try to set up their home network. It's good enough for the enterprise (except cloud sellers it seems) and the plebs should just buy a router.

They also didn't consider someone would try to use the command line, since those addresses are not typable.

Re: Tell HN: IPv6-only still pretty much unusable

#336

Post by Dagger2 »

topspin wrote: post #312

> The GitHub API and its code load endpoints are not reachable via IPv6 Should it matter that GitHub or whatever doesn't support IPv6? I understood that it is possible to bridge the divide through an IPv6 IPv4 gateway. IPv6 is designed to incorporate the IPv4 32 bit address space as a segment of the IPv6 address space and automatically translating between the two is relatively straightforward. At least that what I be…

That's NAT64. It's something that Hetzner could and should be providing for their customers, but as far as I can see they aren't.

Re: Tell HN: IPv6-only still pretty much unusable

#337

Post by ActorNightly »

cj wrote: post #178
yesco wrote: post #122

Earlier quoted context omitted.

A confusing aspect of IPv6 is that it's actually a much simpler protocol than IPv4, you often end up assuming you need to configure a bunch of stuff that you really don't have to. The most common example would be NAT, despite the complexity it adds to IPv4, people often get comfortable with idea of setting up complex subnet hierarchies and feel lost when that all just disappears with IPv6. The key things to remember…

I have the technical ability to set up a well structured VPC in AWS with private/public subnets, but I wouldn't know where to start if asked to set up an ipv6-only network. Is the general model of public/private subnet still valid? Or are you saying in a ipv6-only world, there's no need for separate subnets? There's something about a server not being assigned an IP address at all that makes me sleep easy at night (in…

Its pretty much the same.

The reason why NAT with ipv4 works is because routers by default do not forward any incoming traffic from outside to inside host unless there is an entry in the lookup table based on ports or based on port forwarding rules. The important thing to realize is that the local ip addresses (192.x, 10.x, e.t.c) don't actually matter - they can be replaced with any schema as far as router is concerned, and made public. And this is because the core routing logic of the entry table based on port doesn't change.

Ipv6 implementation doesn't really differ in this. With IPV6 routers can deny incoming traffic to the particular machine without a previous outgoing request connection, just like in the IPV4 NAT implementation. Receiving end knowing the full ip address of the machine (and even then, with privacy extensions, that ip address will no longer be valid in a day) doesn't really do anything against you security wise.

However, unlike IPV4, if you actually want to set up connectivity across networks and in fact enable routers to forward traffic based on the ip address, you don't have to deal with NAT translation, udp hole punching, e.t.c.

And furthermore, forcing harder endpoint security is a good thing. Routers are notoriously easy to exploit in a lot of cases, and once an attacker is on a router, NAT is worthless. Likewise for IoT devices that can be exploited through http based attacks against central servers also give you the same access.

Re: Tell HN: IPv6-only still pretty much unusable

#338

Post by zamadatix »

gnfargbl wrote: post #333
ipython wrote: post #314

I have to say I’m super disappointed in the ignorance and negativity in the comments on this thread. Ignorance of both the difficulties inherent in upgrading a fixed size wire protocol designed for a research network fifty years ago, and the widespread adoption of ipv6 for real customer deployments. Heck most of you are probably using ipv6 through your mobile carrier and don’t even know it!

I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol. Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with…

IPv6 is very similar to IPv4 it's just IPv4 wasn't a consumer grade protocol either. The problem isn't the protocol it's that there is little incentive for the average user to switch to anything else on their own volition when most didn't even really set up what they are switching from (and already working on today) anyways.

Re: Tell HN: IPv6-only still pretty much unusable

#339

Post by AnIdiotOnTheNet »

Dagger2 wrote: post #334
AnIdiotOnTheNet wrote: post #156

Earlier quoted context omitted.

Sure, as long as you're ok with having a constantly changing prefix. At least that's how it is for home connections and it nullifies nearly all the benefits of v6.

You don't need a fixed prefix to get most of the benefits of v6. DNS is a thing.

I can do dynamic DNS on v4 too.

It also complicates firewalls, because now they need to deal with the prefix switching on them and updating their rules to match. As I recall this was only recently added to pfSense.

Re: Tell HN: IPv6-only still pretty much unusable

#340

Post by yyyk »

rnhmjoj wrote: post #111
redox99 wrote: post #69

Earlier quoted context omitted.

It's been decades. The vast majority of network equipment already has been replaced multiple times since IPv6 became a thing that people "understood" we would switch in the future. The difference is that instead of their ipv6 being broken, partial, or correct but non functioning because it needs additional configuration, it would properly work and support with the much simpler "ipv4+"

But IPv4+ is incompatible, so it requires to maintain two network stacks until reasonably everything has moved over to it. You need to duplicate the configuration for DNS, routing, firewalls etc., exactly as for dual stack IPv6. I don't really see a difference.

IPv6 is a slightly different model, different enough that you can't just copy the configuration from IPv4, and that adds a significant implementation burden. If IPv4+ had been created instead, we'd probably all be already using it.

That said, it's obviously way too late to go that direction. The only successor to IPv4 is IPv6. Choosing the wrong model just made sure we'd have to go dual-stack for a loong time.

Post reply on HN