Tell HN: IPv6-only still pretty much unusable • Hacker News Board

Re: Tell HN: IPv6-only still pretty much unusable

#561

Post by temp2022acc » Thu, Dec 08, 2022, 3:19 PM UTC

hanche wrote: post #230

myself248 wrote: post #114

I propose a real simple solution: Major providers pledge to take this seriously. They toss a rule in their routers that just drops all ipv4, for 1 minute, starting at noon UTC. At 12:01 UTC, revert the change and ipv4 works again. Do this every day. The following week, up it to 2 minutes. The incentive will happen.

Or as a friend of mine suggested, more than ten years ago and only half in jest, I think: just block all porn sites on IPv4 (but not on IPv6). The demand for IPv6 will soon be overwhelming.

That's a novel tactic, love it!

Re: Tell HN: IPv6-only still pretty much unusable

#562

Post by Dagger2 » Thu, Dec 08, 2022, 3:19 PM UTC

AtlasBarfed wrote: post #512

lowbloodsugar wrote: post #417

Earlier quoted context omitted.

OMG! What were we all thinking! Thank you redox99 for figuring this out. Only now that you have pointed out this idea is it suddenly obvious. But, since this is, you know, the entire internet , can you maybe write a more detailed specification? So like, when my TCP stack creates a presumably backwards compatible IPv4 header, where does it put the extra 4 bytes? Or do we only send these IPv4+ packets to devices that w…

Please look at the structure of an IP header. Note the "options and padding" section. Also SECTIONS of the internet (that is, routers) can have IPV4+ packets wrapped in IPV4 packets that will transmit them through "IPV4-old" only branches. We pretend like the major routing backbones aren't known and fairly set in stone, and that routers don't know about each other. Yeah, his approach doesn't fix the Comcast-doesn't s…

You should learn a bit about v6 before criticizing it for not doing things that it is doing. You're basically reinventing 6to4.

> Also, oh yes please give me more fucking ports. IPv6 keeping the same number of ports is stupid.

IP doesn't have ports.

Re: Tell HN: IPv6-only still pretty much unusable

#563

Post by Dagger2 » Thu, Dec 08, 2022, 3:21 PM UTC

otabdeveloper4 wrote: post #549

connicpu wrote: post #224

Earlier quoted context omitted.

I got a brand new router recently, IPv6 was still disabled by default! I honestly can't understand the reasoning, I don't even buy the internet visibility argument because the default incoming connection rules for IPv6 after I enabled it were deny-all. We really have a long way to go still in getting equipment everywhere enabled on it.

IPv6 is a security liability and provides no benefit to the user.

Both of those statements are wrong. It provides benefits to the user and it's no more of a security vulnerability than having any other networking protocol is.

If anything, v4 is more of a vulnerability because it's so easy to scan and because NAT increases the complexity enough that most people don't understand how their networks work.

Re: Tell HN: IPv6-only still pretty much unusable

#564

Post by GICodeWarrior » Thu, Dec 08, 2022, 3:27 PM UTC

justin_oaks wrote: post #461

Arnavion wrote: post #384

Earlier quoted context omitted.

If you want failover-independent IPs you can keep using NAT, ie NPTv6, at the gateway level and not bother with giving public IPs to your LAN machines.

That's possible, but my understanding is that NPTv6 is strongly discouraged. Part of the point of IPv6 is do away with NAT and the problems caused by it. I was hoping there was a better way.

NPTv6 is different from IPv4 NAT and doesn't really have the same issues.

A different solution I've seen proposed for networks with multiple ISPs is to advertise both public prefixes to the network and let each client endpoint figure out which egress to use. This seems like a worse idea though.

The most official approach is to get your own public IPv6 prefix and work with your ISPs to BGP route that to you on both links. However, home and small business ISPs generally don't offer this.

Re: Tell HN: IPv6-only still pretty much unusable

#565

Post by mplabelspace » Thu, Dec 08, 2022, 3:33 PM UTC

gnfargbl wrote: post #333

ipython wrote: post #314

I have to say I’m super disappointed in the ignorance and negativity in the comments on this thread. Ignorance of both the difficulties inherent in upgrading a fixed size wire protocol designed for a research network fifty years ago, and the widespread adoption of ipv6 for real customer deployments. Heck most of you are probably using ipv6 through your mobile carrier and don’t even know it!

I think you're being unfair to the audience. The main complaints here aren't about the consequences of those legacy problems, they're about the fact that IPv6 is just such a mediocre designed-by-committee protocol. Your point about mobile networks kind of illustrates this. There are all sorts of weird and wonderful protocols used in the mobile world, and it doesn't matter because 99.999% of us never have to deal with…

>I think you're being unfair to the audience. The main complaints here aren't >about the consequences of those legacy problems, they're about the fact that IPv6 >is just such a mediocre designed-by-committee protocol.

That's every standard protocol.

>Your point about mobile networks kind of illustrates this. There are all sorts of >weird and wonderful protocols used in the mobile world, and it doesn't matter >because 99.999% of us never have to deal with it, and the 0.001% that do have >time and space to become experts. IPv6 isn't like that -- it needs to be a >consumer grade protocol that people can understand and work with. It either fails >that test, or perhaps at best scrapes a borderline pass. We deserved better.

Wireline networks aren't any different, gobs of weird and wonderful protocols in MEF, carrier TE, DOCSIS, etc. Implementation issues drive 90% of the problems described. And don't think for a second that those kinds of issues are unique - all of this happened the same way in IPv4. It just happened so long ago that most either were not around for it, or forgot the pain. that shit box was classful in its original state. The difference now is that a bunch of people can see the sausage getting made and they don't like the ingredients, even though they've likely been eating the sausage for years.

Re: Tell HN: IPv6-only still pretty much unusable

#566

Post by Avamander » Thu, Dec 08, 2022, 3:36 PM UTC

jedberg wrote: post #228

Every couple of months, I enable dual-stack on my home network, to see if it works. And inevitably I get a terrible experience. Some sites fail to load, others load after a huge delay (presumably because we're waiting for an ip6 timeout of some sort) and some things just don't work right. I'm always too lazy to figure out why these things don't work, but I turn off dual stack and everything works fine again. I'm a ne…

I think regular consumers have more ordinary setups and those work totally fine in a lot of places.

That aside, out of interest I blocked outgoing port 80, now that is fun. So many things break in weird and bizarre ways. It's also interesting to see how many things are potentially vulnerable to eavesdropping.

Re: Tell HN: IPv6-only still pretty much unusable

#567

Post by Dagger2 » Thu, Dec 08, 2022, 3:36 PM UTC

AtlasBarfed wrote: post #504

throw0101a wrote: post #300

Earlier quoted context omitted.

> I would switch to that "IPv4+" system if it existed.. I am willing to use latest software/standards to future-proof my setup, but duplicating all the work is too much for me. And exactly how would you accomplish this switch to a larger address space? Please explain the steps exactly how they would be done. Because IPv4 has 32 bits of address. Anything after IPv4 needed >32 bits of address. How exactly do you fit in…

It's like no protocol has ever been extended or revised. Ever. Let's pretend there isn't an Options and Padding section in the IP header: "Options and Padding - A field that varies in length from 0 to a multiple of 32-bits. If the option values are not a multiple of 32-bits, 0s are added or padded to ensure this field contains a multiple of 32 bits." Wow, like I CANNOT think of how that would be used to add more bits…

There is in fact an options section in v4, and I think it's pretty obvious how it could be used: you could put extra address bits there.

The problem is... how do you get those extra address bits to work?

If you think through that question and produce a working answer, your working answer is going to be roughly the same as v6 -- and have the same issues v6 does. Almost as if the people that designed v6 weren't completely clueless.

Re: Tell HN: IPv6-only still pretty much unusable

#568

Post by otabdeveloper4 » Thu, Dec 08, 2022, 3:41 PM UTC

Dagger2 wrote: post #563

otabdeveloper4 wrote: post #549

Earlier quoted context omitted.

IPv6 is a security liability and provides no benefit to the user.

Both of those statements are wrong. It provides benefits to the user and it's no more of a security vulnerability than having any other networking protocol is. If anything, v4 is more of a vulnerability because it's so easy to scan and because NAT increases the complexity enough that most people don't understand how their networks work.

Three decades of IPv6 mis-adoption shows otherwise. "Running out of IPv4 addresses" is not a problem you face unless you're an internet service provider or a mobile network.

99.99999% of the rest of us don't care because we use 192.168.0.0/16 or 10.0.0.0/8 when we have to do networking.

Yes, NAT is complex. That sucks. No, blindly stating "you don't need NAT and you're holding it wrong" is just plain incorrect.

Please make NAT easier to use and configure, don't sweep it under the rug and pretend like the world can function without it.

Re: Tell HN: IPv6-only still pretty much unusable

#569

Post by Dagger2 » Thu, Dec 08, 2022, 3:50 PM UTC

onphonenow wrote: post #503

salmo wrote: post #367

Earlier quoted context omitted.

They took much more on with IPv6 than IPv4 replacement. The spec goes much deeper than IPv4 did, replacing ARP, DHCP, etc. It's a product of its time, including a lot of over-engineering by committee. Many of the problems they tried to address didn't pan out to be real issues. You can read the RFCs and compare. IPv4 w/ more bits is a lot more simple. Yes, older network gear wouldn't deal with it well, but that's not…

No kidding - they got rid of dhcp and more but it’s a nightmare getting networks to work with just ipv6 concepts- everything from provisioning phones (dhcp options to push config / NetBoot stuff) and more. Layer in privacy extensions, renumbering on uplink wan flapping (slow too - the failover is pathetic compared to NAT wan failover) - icmp traffic differences - firewalls need to be much more careful with ipv6 and r…

Layer 3 exists as a layer of routing and aggregation on top of layer 2. Aggregation necessarily consumes address space, so L3 needs to be bigger than L2 to accommodate the full L2 address space. The L2 address space is 64 bits and the next power of 2 up from 64 is 128, so here we are.

96 bits would probably be enough too, but having large subnets has a few benefits -- it allows for securing NDP by using the extra space for a cryptographic key, and also it makes it much, much harder to scan for active hosts from outside the network.

Plus, can you imaging the wailing and teeth gnashing we'd be getting if v6 wasn't a power of 2 bits long?

Re: Tell HN: IPv6-only still pretty much unusable

#570

Post by Dagger2 » Thu, Dec 08, 2022, 3:54 PM UTC

adev_ wrote: post #539

redox99 wrote: post #32

IPv6 has been one of the biggest failures in the last couple of decades. And I don't mean adoption, I mean the standard itself. If IPv6 were IPv4 with more octets, then we would all have been using it for like a decade. Yes, I understand it would still require some breaking changes, but it would have been a million times easier to upgrade, as it would be a kind of superset of IPv4 (1.2.3.4 can be referred as 0.0.0.0.…

> Edit: To make everything a bit clearer, the idea with this "ipv4+" is that you don't need the complexity of running both ipv4 and ipv6 as you do now. I find that very wild optimism. - You will still get two incompatible address space V4 and V4+ and that would imply: -> You still need to modify your software to adapt for V4+ for the transition. -> Most of your middlebox and firewall rules will get in the way for any…

Which is weird, because there is a business incentive: money. But instead, companies seem to be willing to pay out huge amounts of money to not deploy v6.