Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Internet

tailscale.com

Post reply on HN
Print view View original

141–150 of 315 posts

Re: The New Internet

#141

Post by teddyh »

DyslexicAtheist wrote: post #90
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)

Regarding DNSSEC:

• Blog post: https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...>

• As a podcast episode: https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-fo...>

Re: The New Internet

#142

Post by teddyh »

tomjen3 wrote: post #137
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

I think that is excessively negative take. Tailscales value proposition is also "you can connect to your network wherever you are, safely, and others cannot". That does not go away because of IPsec.

Network- and location-based security is ultimately unworkable. It’s like if you, in order to work, had to go to a ”virtual office” to even send mail to your colleagues. Mail, and related internet-enabled services, should be accessible from anywhere, and be secured at the end points, not at the network layer. (Most attacks are internal, anyway.)

Re: The New Internet

#143

Post by throw0101d »

Borg3 wrote: post #99
wmf wrote: post #24

Earlier quoted context omitted.

Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.

Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IP…

> Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that?

Negotiation. IPsec using IKEv2 (RFC 4306/7296) started with (e.g.) 3DES when it was initially released, but now allows for AES (RFC 3602, 3686, etc), as well as other algorithms:

* https://www.iana.org/assignments/ikev2-parameters/ikev2-para...

> What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done.

For anyone curious, the technical criteria for choosing the (then-labelled) IPng:

* https://datatracker.ietf.org/doc/html/rfc1726

And the evaluation of the available candidates and why the winner was chosen:

* https://datatracker.ietf.org/doc/html/rfc1752

One of the IPng candidates, SIPP, indeed did extend addressing from 32-bits to 64-bits (RFC 1710, RFC 1752 § 7.2), but it was deemed that it may not enough and another transition would be even more difficult, so they went with 128-bits (RFC 1752 § 9).

Adding mechanisms for auto-configuration was one of the criteria for IPng; per RFC 1726 § 5.8:

    CRITERION
       The protocol must permit easy and largely distributed
       configuration and operation. Automatic configuration of hosts and
       routers is required.
    
    DISCUSSION
       People complain that IP is hard to manage.  We cannot plug and
       play.  We must fix that problem.
       
       We do note that fully automated configuration, especially for
       large, complex networks, is still a topic of research.  Our
       concern is mostly for small and medium sized, less complex,
       networks; places where the essential knowledge and skills would
       not be as readily available.
       
       In dealing with this criterion, address assignment and delegation
       procedures and restrictions should be addressed by the proposal.
       Furthermore, "ownership" of addresses (e.g., user or service
       provider) has recently become a concern and the issue should be
       addressed.
       
       We require that a node be able to dynamically obtain all of its
       operational, IP-level parameters at boot time via a dynamic
       configuration mechanism.
       […]
In a world of IoT, not having to have a BOOTP/DHCP(v4) seems like decent foresight.

Re: The New Internet

#144

Post by sulandor »

throw782349872 wrote: post #78

I've been an active Tailscale user for years now, preaching the Gospel of Wireguard Control Planes to all who will listen (and many who won't) in both my personal and professional life. It's been really disheartening to watch the steady enshittification of Tailscale, Inc. I knew it was coming with 100% certainty once they raised 100mil in 2022. It's still heartbreaking because the product itself is quite good. The wo…

thanks for your insights.

> The worst part is because Tailscale, Inc got there "first"

never heard of nebula but please clarify where they got first.

i'm sure you are aware that branded/purposebuilt vpn's existed long before the first iphone.

Re: The New Internet

#145

Post by teddyh »

sulandor wrote: post #103
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

> The eternal problem with companies like it's not a problem specific to any kind of corporation or corporations per se, but organizations or even broader, solutions. though, do you really think that having a solution to a problem is worse than just having the problem?

It is a problem if a company makes a lot of money ”solving” the problem, but:

• This does not really solve the problem, since a real solution would be to change the internet to make the problem go away

• A company making a lot of money gets to have an enormous influence on what is considered reasonable to standardize on. See for instance Google’s and Microsoft’s influence on things like the W3C. (Or if Tailscale is allowed to define what ”The New Internet” will be.)

Re: The New Internet

#146

Post by throw0101d »

Borg3 wrote: post #135
growse wrote: post #116

Earlier quoted context omitted.

> What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done. Tell me you've never had to seriously design and operate networks at scale without telling me etc... This is a bit like Chesterton's fence - until you understand why (for example) ARP is a hilariously bad design and a major problem when trying to design networks at scale, then you can't understand why someone might want…

Its not so easy. First, yeah I was operating networks, not maybe hyperscalers, but 200+ switches. Yes, ARP had a its problems, like ARP poisoning, but they are all sorted out already. IPv6 took its ND and bring a lot of other problems that we are solving AGAIN . Pure waste of time and effort. Also, please cut the crap about IoT and Hyper IP networks centrally managed. Thats just serveral huge corporations. Majority i…

> Its not so easy. First, yeah I was operating networks, not maybe hyperscalers, but 200+ switches. Yes, ARP had a its problems, like ARP poisoning, but they are all sorted out already.

ARP poisoning is the least of ARP's problems.

It can potentially have a blast radius that can bring down networks, and if it was actually sorted out, then things like BGP EVPN would not need to have been invented. One of touted benefits of BGP EVPN is reduced ARP and Layer 2 broadcasts.

I've seen ARP storms bring down even 'small' company networks (dozen switches for ~200 people) because someone fed a simply desktop switch back in on itself and the access layer switch in the closest could not do STP with the simple switch.

Re: The New Internet

#147

Post by teddyh »

hnarn wrote: post #124
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

This sounds like a reasonable point, but the more I think about it, the more it sounds like digital flagellation. IPv6 was released in 1998. It had been 21 (!) years since the release of IPv6 and still what you're describing had not been implemented when Tailscale was released in 2019. Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? It's easy to paint companies as bad actors,…

It is a problem when, for instance, Google chooses not to implement SRV (and later HTTPS) DNS record support in their web browser. The problems which SRV (and now HTTPS) DNS records solves is not a problem for Google, since they solved the problem by sheer scale and brute force, and Google only benefits from everybody else still having the problem; it’s a great moat for them.

Re: The New Internet

#148

Post by throw0101d »

throw0101d wrote: post #118
yjftsjthsd-h wrote: post #58

Earlier quoted context omitted.

> If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions…

> […] I think the far more common view is rather that v4 is fine and its only problem is solved by NAT. The only reason why NAT is "solving" the problem is because IPv6 is taking some of the pressure off. T-Mobile US has 120M subscribers: * https://www.statista.com/statistics/219577/total-customers-o... And they went to IPv6-only: * https://www.youtube.com/watch?v=QGbxCKAqNUE There's no way that would work in a no-IP…

Self-follow-up:

Google says India is 74% IPv6:

* https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

How would connectivity for 10^9 people work with only IPv4? See also China. Each of those countries is 2^30 people, plus add another 2^30 for the continent of Africa, and you're already over 2^31. IPv4 is 2^32 addresses.

Re: The New Internet

#149

Post by tomjen3 »

teddyh wrote: post #142
tomjen3 wrote: post #137

Earlier quoted context omitted.

I think that is excessively negative take. Tailscales value proposition is also "you can connect to your network wherever you are, safely, and others cannot". That does not go away because of IPsec.

Network- and location-based security is ultimately unworkable. It’s like if you, in order to work, had to go to a ”virtual office” to even send mail to your colleagues. Mail, and related internet-enabled services, should be accessible from anywhere , and be secured at the end points, not at the network layer. (Most attacks are internal, anyway.)

Why should you have access to the SSH host for my pie?

Or, more to the point, the server that I use to run my RSS feed reader?

Or my NAS?

Tailscale makes these more secure and more accessible for me. They are never meant to have the world access them.

Now for email and a few other things, sure, their nature is that they need to access the world.

Re: The New Internet

#150

Post by ZhongXina »

teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

No, we definitely don't want "automatic IPSec" (especially IPSec!), or really any enforced encryption at the network level, even if it's something sane at this moment like WireGuard. Look at old VPN protocols or authentication schemes like RADIUS which have glaring security holes and are impossible to fix because of compatibility issues, and they're running at much smaller scales than the whole internet. Hell, the way the industry is solving TCP ossification problems is by throwing TCP away and reimplementing it on top of UDP, that should tell us something.
Post reply on HN