Live data from Hacker News

Tell HN: Hacker News now supports IPv6

news.ycombinator.com

221–230 of 396 posts

Re: Tell HN: Hacker News now supports IPv6

#221
post #134

Earlier quoted context omitted.

Another person who does not understand IPv4. IPv4 isn't a text based protocol where IP addresses are parsed like DNS. It's a binary protocol where addresses are recorded in binary and adding more address space WOULD BE A BREAKING CHANGE.

Not at all. We could have taken one of the unassigned /8's at the time and allocated it to v6 transitional addressing (the failure to address 4->6 reachability is IMO why v6 failed). For the sake of this example lets use 53.0.0.0/8. All new addresses start with 00110101 followed by the first three bytes of the new v6 prefix. The prefix acts as a flag that indicates it is a new address and routers read an additional 5…

> The prefix acts as a flag that indicates it is a new address and routers read an additional 5 bytes from the beginning of what would be the data section of a traditional v4 packet to get the complete address.

Your proposal, as usual for these kinds of proposals, fails to consider how would an "old world" endpoint talk to a "new world" endpoint. An "old world" endpoint wouldn't know about these "additional 5 bytes", and would both send packets without them to "new world" endpoints (confusing them) and treat them as data bytes when receiving from "new world" endpoints. The only solution would be to upgrade all the computers on the "old world" first, but once you have to do that you could move them all to the "new world" instead.

If what you want is just the addressing (for instance, you already have 192.0.2.1, and want to use it for IPv6 without needing to obtain an IPv6 address first), there's already 6to4, which has most of the properties you want: it exists on top of IPv4, your router announces the IPv4 prefix, and IPv6 packets sent to it are transparently routed to a relay router which encapsulates them inside IPv4 packets destined to that IPv4 address (in the other direction, your encapsulated packets are sent to a relay router which extracts the IPv6 packet and forwards it). I've used this in the past to give full IPv6 connectivity to a site which had only a single IPv4 address, and it worked well.

Re: Tell HN: Hacker News now supports IPv6

#222
post #36

Does ipv6 result in higher latencies? I could see larger addresses increasing latency, but then again I could also see a more efficient protocol resulting in lower net latency. I should probably read a book describing the differences.

It shouldn't. There is no checksum in header so that is one thing that doesn't need to be calculated, even if it can be done in hardware. And more efficient routing should mean smaller tables to lookup things from so being faster.

Re: Tell HN: Hacker News now supports IPv6

#223
post #182

I am so surprised by the hate for IPv6 in this thread. I have been deploying IPv6 for more than ten years and it really improve many situations (beside larger addresses). I have to admit, there is a learning curve. But I want to encourage everybody involved in configuring computers to learn. Also I want to rent about Cisco not using /64 for link local by default, thus being incompatible with BSD systems. Link local m…

>I am so surprised by the hate for IPv6 in this thread. I find that HN views IPv6 noticeably more harshly than many other communities I have been a part of (e.g. networking subreddits and gaming communities). I am curious of the reason behind this.

Networking communities understand the way it works and the improvements it's making.

Gamers understand the consequences of not having it when they want to play with their friend but both are behind CGNAT and they can only play games with a server run by someone else and not any that use P2P multiplayer.

HN users can afford the $2/month/server that AWS or whoever charges today and besides your standard SPA + REST API doesn't really care how many layers of NAT and proxies it's behind.

Re: Tell HN: Hacker News now supports IPv6

#224
post #182

I am so surprised by the hate for IPv6 in this thread. I have been deploying IPv6 for more than ten years and it really improve many situations (beside larger addresses). I have to admit, there is a learning curve. But I want to encourage everybody involved in configuring computers to learn. Also I want to rent about Cisco not using /64 for link local by default, thus being incompatible with BSD systems. Link local m…

IPv6 will rid us from the abomination of domestic NAT.

IPv6 will, finally, enabled the real internet: all p2p protocols will start to work seamlessly. I am thinking a super simple no-dns IP (audio|video) phone protocol listening only on tcp 1 port, new bittorrent like protocol for live streaming, etc.

Since IPv6 has been almost everywhere in my country for years: enjoying ssh session everywhere (ipv6 mobile internet), without any domestic NAT to configure.

But, still... steam... github... and some "rogue" (:P) smtp servers.

That said for HN, where is the champagne?

Re: Tell HN: Hacker News now supports IPv6

#225
post #103

As someone who grew up on IPv4, i will miss it, but the leap to 340 undecillion unique addresses is exciting in many ways so i think i can learn to live with this transition. If we ever need more than that, i can't even imagine what that future would look like.

I grew up with IPv4 (1.2.3.4) and I was expecting IPv6 to just be 1.2.3.4.5.6 with backward compatibility so that 1.2.3.4 would just be 0.0.1.2.3.4 and the 1.2.3.4 dude wouldn't need to change their address. And the IPv8 would be 0.0.0.0.1.2.3.4 whenever we need it, but probably not for a long time When I saw all the double-colons and slashes and monstrosities like f00f:00f:::ea//dead::beef/3 I just kept using IPv4.…

Exactly this misconception comes up (often multiple times) every time there’s a discussion about IPv6 on HN.

No, it’s not possible without running into the exact same problems that we had with IPv6 (which actually has various compatibility mechanisms, to the point where now some mobile networks are IPv6 only but still work to let people access IPv4).

The problem with your proposal is the same issue we have now - something that only talks the old protocol can’t possibly talk to something in the new protocol (without the same kind of hacks we use with IPv6 like NAT64/464XLAT), since IP addresses in headers are fixed sized. Which also means that any router in the middle can’t possibly route packets to networks with the expanded addresses. So we have the exact same issue - everything needs to be upgraded to deal with your new scheme, but unless that all happens on the one same day, you need to be able to deal with the old addresses. So you need dual stack, just like with IPv6 until everything is transitioned.

So basically all you’d have with this kind of proposal is exactly the same problems, but it would be more confusing why older devices can’t talk to the newer devices since the addresses would look very similar!

Re: Tell HN: Hacker News now supports IPv6

#226

Earlier quoted context omitted.

I don't understand what you mean by complicating firewall rules,except maybe that you now need to use IPv6 addresses instead of IPv4 addresses in some of the rules. It's not like NAT without a firewall gave any security in 2024.

there is no nat w/o a "firewall" and yes, it will be more secure

> there is no nat w/o a "firewall"

Actually, there is! People normally don't notice because NAT is usually co-located with a stateful firewall (since both need connection tracking to work, unless it's the rarer 1:1 NAT). But you can run NAT with firewall disabled, and in that case, it's possible in some cases for a device on the outside to access a device on the inside.

For instance, suppose a NAT router with 192.168.0.x/24 on the inside, and 192.0.2.1/24 on the outside. A malicious device at 192.0.2.2, on the same level 2 network as the router, wants to attack a host inside the NAT. The malicious device can send a packet with IPv4 destination address 192.168.0.x and the Ethernet destination address of the 192.0.2.1 router; if that router has its stateful firewall disabled, it will accept the packet and route it to the target device.

That is: what "protects" devices on a NAT without a firewall is not the NAT, but the use of non-globally-routeable addresses within the NAT, since a packet from the outside won't find a route to your NAT router; but if someone manages to route the packet to your NAT router anyway, it'll be accepted unless a firewall rule blocks it.

(If you want non-globally-routeable IPv6 addresses, you can use ULA addresses, which have similar properties to the IPv4 private addresses.)

Re: Tell HN: Hacker News now supports IPv6

#227
post #182

I am so surprised by the hate for IPv6 in this thread. I have been deploying IPv6 for more than ten years and it really improve many situations (beside larger addresses). I have to admit, there is a learning curve. But I want to encourage everybody involved in configuring computers to learn. Also I want to rent about Cisco not using /64 for link local by default, thus being incompatible with BSD systems. Link local m…

IPv6 will rid us from the abomination of domestic NAT. IPv6 will, finally, enabled the real internet: all p2p protocols will start to work seamlessly. I am thinking a super simple no-dns IP (audio|video) phone protocol listening only on tcp 1 port, new bittorrent like protocol for live streaming, etc. Since IPv6 has been almost everywhere in my country for years: enjoying ssh session everywhere (ipv6 mobile internet)…

Is it possible for me, or worse, a normal person, to claim or request an ipv6 address that they can keep and use like a phone number? I'm used to dynamic allocation for residential ipv4 addresses and never bothered to beg ARIN for some or rent since from an ISP. Having an address you could keep and bring with you would be great and avoid a lot of the difficulties of DNS.

Re: Tell HN: Hacker News now supports IPv6

#228
post #194
post #183

Earlier quoted context omitted.

FWIW; SLAAC works by setting the local part to the mac address. So, if you have knowledge of your mac address (which is what you say you are using for DHCP) then you will know the fe80:: IPv6 IP too, which, while not globally routable is probably what you want based on this comment.

Wait SLAACs aren't globally routable? I thought the whole idea behind IPv6 was to not use NAT?

There's an education here that unfortunately I don't have the time to give you.

SLAAC is the replacement for DHCP, it provides a local prefix address (fe80::) and optionally (and, crucially: additionally) provides a publicly routable IP if there's a public prefix available.

You can think of the subject being split into two components:

As a base: You will get a local IP

On top: you get DNS/Public routing.

Here's a bit more about how it works: https://www.networkacademy.io/ccna/ipv6/stateless-address-au...

Re: Tell HN: Hacker News now supports IPv6

#229

Earlier quoted context omitted.

I think it’s a bit more nuanced than that. The UX of IPv6 is still decidedly inferior. Typing a curl command etc or in general manually typing and remembering IPs is decidedly more difficult with IPv6 vs IPv4. I think IPv6 needs either a killer command line tool or aliasing scheme to overcome that stigma.

The aliasing scheme is called DNS.

Clearly that is not sufficient enough for a variety of reasons else we wouldn’t be having this conversation in the first place

Re: Tell HN: Hacker News now supports IPv6

#230
post #227

Earlier quoted context omitted.

IPv6 will rid us from the abomination of domestic NAT. IPv6 will, finally, enabled the real internet: all p2p protocols will start to work seamlessly. I am thinking a super simple no-dns IP (audio|video) phone protocol listening only on tcp 1 port, new bittorrent like protocol for live streaming, etc. Since IPv6 has been almost everywhere in my country for years: enjoying ssh session everywhere (ipv6 mobile internet)…

Is it possible for me, or worse, a normal person, to claim or request an ipv6 address that they can keep and use like a phone number? I'm used to dynamic allocation for residential ipv4 addresses and never bothered to beg ARIN for some or rent since from an ISP. Having an address you could keep and bring with you would be great and avoid a lot of the difficulties of DNS.

Hurricane Electric gives out free ipv6 blocks that you can assign however you want.

I get an ipv6 for my phone through Wireguard that way.

Post reply on HN