Live data from Hacker News

AWS to start charging for IPv4 usage, but critical services don't support IPv6

old.reddit.com

51–60 of 245 posts

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#51

[flagged]

You can't extend the size of the ipv4 packet headers unfortunately without breaking backwards compatibility, so we're stuck with with the address size.

However, we're pretty stupid how we use ipv4. A connection identifier is actually 48 bits, which is a massive pool. Currently nearly everything on the internet runs 32 bit ipv4 address with a 16bit port number. The vast majority of internet traffic waste the last 16 bits because of convention (Hey only accept HTTP/SSL connections on port 443! lol)

We could extend ipv4 a couple hundred years by adopting SRV records, which would be a painless change compared to swapping ipv4 to ipv6. That puts the last 16 bits of the total 48 bits to work.

The other part of the ipv4 packet is a bunch of flags that are pretty dangerous and nobody uses. Those might be able to be used as identifiers, but it'd be pretty not-backwards compatible.

I'm a critic of the ipv6 transition because of the players promoting it in a certain way that is detrimental to the consumers. However, one thing ipv6 gets correct is the concept of network flows and the removal of a ton of cruft from the ipv4 packets. In that regard ipv6 is very well designed.

Anyway, I will continue to turn off ipv6 and block it on all the devices and networks I operate, as it offers no benefit to me personally, only downsides, and it's just one more thing to monitor for privacy.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#52

[flagged]

> * "OMG Every device needs a publicly addressable IP!!!"

> ok, but why?

So we can get rid of STUN/ICE/etc and make peer-to-peer easier. All you're left with is hole punching through your SPI firewall (no worse than today).

> Are you _really_ just going to allow random traffic into your network?

I don't know why this misconception is so wide spread: globally addressable ≠ globally reachable.

Firewalls still exist with IPv6.

Before I recently changed ISPs, I was with one which gave out IPv6, and so all devices had an address (including things like my printer). But I couldn't initiate connections from the outside in—only replies to internally-initiated messages were let in by my Asus.

Even if things were wide open—which they were not—good luck scanning a /64.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#53

One day will come, when network admins will be so happy to finally turn off IPv4 on their stack. When router manufacturers will feel happy to support only IPv6. It is definitely coming within my lifetime. So, these intermediate steps are just cooking the final dish. Peace. ;)

Once GitHub works with ipv6 I’ll start to take it seriously.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#54

[flagged]

> * "OMG Every device needs a publicly addressable IP!!!" > ok, but why? So we can get rid of STUN/ICE/ etc and make peer-to-peer easier. All you're left with is hole punching through your SPI firewall (no worse than today). > Are you _really_ just going to allow random traffic into your network? I don't know why this misconception is so wide spread: globally addressable ≠ globally reachable . Firewalls still exist w…

> So we can get rid of STUN/ICE/etc and make peer-to-peer easier. All you're left with is hole punching through your SPI firewall (no worse than today).

Do you really think Roomba is going to let you run your Robot Vacuum without contacting, er permission, from their data center in Virginia?

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#55

[flagged]

> ok, but why? Because NAT breaks a lot of services. > Is that going to change with ipv6? Yes. You no longer need NAT, so port negotiation is much easier (even when inbound is blocked) > Are you _really_ just going to allow random traffic into your network? Common misconception! Even without NAT, the router can have port/traffic policies. There's just no address translation happening. There's a lot of good stuff abou…

[flagged]

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#56

[flagged]

I'd argue having to run STUN and TURN relays imposes additional costs on service operators and therefore increases centralization instead of decreasing it. Furthermore, if Amazon (of all companies) was pushing for IPv6, we'd see a little more IPv6 support at least on their public endpoints, as I commented elsewhere.

As for public reachability, most OSes have a firewall of sorts (nftables, pf etc.) and can be configured to block traffic by default; on consumer OSes they already do so. There's also the local unicast range fc00::/7, which seems conveniently forgotten about in these kinds of comments.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#57

[flagged]

I think a lot of other commenters complaining about the parent commenter missing the IPv4/6 header size are missing the forest for the trees here. The main problems with IPv6 (that are why most customer-facing components are not switching to it anytime soon) are simple:

1. The address space is ludicrously unwieldy. Humans are good at remembering long numbers. We're quite bad at remembering random strings outside of pure muscle memory. For the cases where you're manually fiddling with IPv6 space in situations where a domain name isn't mapped to an IP (ie. home networks), the reality is that IPv6 is only a negative. Telling people to go to "192.168.2.1" to log in on their router is easy. Telling them to punch in a long IPv6 address that includes the A-F range isn't. (And that's without getting into colon collapsing 0000 ranges which just reeks of "did anyone run this past a human being", because this makes even less sense to people who barely get "I need to type the address on the ISP router sticker in my browser").

2. The complete lack of even a one-way compatibility layer with IPv4 (so communicating from an IPv6 to an IPv4, which should be possible in a tech stack) means that even if you take the slow movement of hardware to IPv6 space into account, the offering simply isn't worth it until everyone switches over. Right now the standard offer for home ISPs is CGNAT + IPv6 if they offer the latter, is not solving anything - the reality is that if you give an IPv6-only offer, your customers just straight up can't access ~40% of the internet (and by law of institutions, that will include parts of the internet they really need because the people running it are restricted by yellow tape and budgets to also move to IPv6), so all we get is the worst of both worlds where IPv4 is still running out of space and IPv6 isn't ready to replace it.

Would it really have been too much work to slightly compromise on address space for IPv6 to just allocate a region to old IPv4 addresses, where the relevant low-level bits of the stack just switches over to the IPv4 protocol if it detects that region? If that were the case, the transition process would go much smoother and we probably wouldn't be haranguing about getting public entities to sell off their address space, just to delay the inevitable.

Those are the reasons why IPv6 isn't replacing anything beyond a slow crawl of "maybe I should set an AAAA record" (and considering like 80% of the DNS+VPS providers I've used in the past decade just dump the /16 when you pick a VPS from a dropdown in the address, which obviously fails to work, it's also clear that hosting companies don't consider it a real priority either). When it comes to core infrastructure like this, backwards compatibility isn't a "nice to have" or to be "thrown out because it was based on bad ideas". It's a requirement, no matter how insane the original product might have looked.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#58

Earlier quoted context omitted.

> * "OMG Every device needs a publicly addressable IP!!!" > ok, but why? So we can get rid of STUN/ICE/ etc and make peer-to-peer easier. All you're left with is hole punching through your SPI firewall (no worse than today). > Are you _really_ just going to allow random traffic into your network? I don't know why this misconception is so wide spread: globally addressable ≠ globally reachable . Firewalls still exist w…

> So we can get rid of STUN/ICE/etc and make peer-to-peer easier. All you're left with is hole punching through your SPI firewall (no worse than today). Do you really think Roomba is going to let you run your Robot Vacuum without contacting, er permission, from their data center in Virginia?

How is this at all related to global addressability?

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#59

[flagged]

Here is something very simple, with no self flogging and no circus hoops. I do not want to pay for a number. There is no shortage of numbers. In fact there is an infinite amount of them. There are many things I am forced to pay for and their prices keep going up and up and more things get added every year. Well on this one I fight back. I do not wish to pay for the use of an arbitrary number just so my device can be connected to a network.

Re: AWS to start charging for IPv4 usage, but critical services don't support IPv6

#60

[flagged]

the trick is actually to add the extra bytes on the back end.

192.168.8.9.0.1.2.3

old devices get accessed the old way. new devices "know" about the add ons. The new part of the address travels inside "as data" so it gets delivered.

as company firewalls and routers switch to new, the whole company needs only one "old" ip. To get the ball rolling, spend some time deploying before it's switched on.

All those early adopters who have class A networks? They can go first this time too, freeing up their class A's quickly to facilitate the transition for everybody else.

source: this was my idea for phone numbers back when they kept rejiggering area codes.

Post reply on HN