Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The IPv6 Transition

potaroo.net

Post reply on HN
Print view View original

211–220 of 433 posts

Re: The IPv6 Transition

#211

Post by welterde »

x3n0ph3n3 wrote: post #50
Plasmoid wrote: post #27

Earlier quoted context omitted.

Time has not been kind to this article. It's basically a compete list of fallacies that people believe about ipv6.

Oh, is IPv6 now backwards compatible with IPv4? No? I guess not a complete list of fallacies.

IPv6 clients (or in theory any kind of IPv4 successor) can reach IPv4 servers via some kind of translation layer (for example NAT64) - so IPv6 is backwards-compatible with IPv4 in that direction. The inverse direction (IPv4 client to IPv6 server) is however not possible, since IPv4 is not forward-compatible with any possible successor, because it is not possible to encode more information into 32-bit than 32-bit.

Re: The IPv6 Transition

#212

Post by tptacek »

beeflet wrote: post #203
tptacek wrote: post #200

Earlier quoted context omitted.

That's a retcon. People used Blogger because it was more convenient than setting up Apache and PHP on a webserver of their own. Linux nerds for whom doing that is no big deal are an infinitesimal fraction of everyone who blogged.

why does it have to be such a big ordeal? A blog is pretty much just a static site. Is it unimaginable that someone uses a HTML editor like microsoft word or something to write a blog and then copies it into the folder of a static web server? I'm sure it would be way simpler if people had the time to figure out P2P and the associated UI, it's not fundamentally super complicated versus client-server.

Just the idea of having an always-on computer anywhere in your home excludes probably more than 80% of everyone who has ever written a blog. IPv4 is not why people use hosted services.

Re: The IPv6 Transition

#213

Post by camgunz »

I'm pretty naive about this stuff, but IMO IPv6 is a lot more empowering than v4. You aren't dependent on some owner of v4 addresses for access, you don't need to manage--and aren't forced into--NAT, and you (probably) get to use all of your ports.

My conspiracy theories about why v6 hasn't taken off are: people make money off v4 leases, and email spam blacklists become pretty useless in v6. But again, very naive here.

Re: The IPv6 Transition

#214

Post by magicalhippo »

Affric wrote: post #96
redprince wrote: post #53

Earlier quoted context omitted.

That was in fact one of the promises of IPv6: Restore the network of peers where every host is in principle a server and a client and communication between peers is unhindered unless a policy is enforced saying otherwise (on the machine, on a firewall, etc.). > having a public address is actually a security and privacy risk. Services can be turned off or a firewall instructed not to pass traffic from the internet (by…

> in Germany we have the peculiar horror of getting the IPv6 address and all delegated prefixes changed on every redial. This is oh so very German. In normal times it is massively overkill. I have to wonder if, heaven forbid, the things these sort of German things are meant to mitigate come to pass again if they will make any difference or if they are a largely symbolic act designed to demonstrate ideological opposit…

Got the same here in Norway. I've had the same dynamic IPv4 address from my ISP since I moved here over 6 years ago. I get a new IPv6 prefix every time the line goes down, modem needs reboot, moon is full etc.

Re: The IPv6 Transition

#215

Post by SmartHypercube »

I've always wanted to give IPv6 more chances to see if I can take advantage of its features early, but every attempt has left me very disappointed. Issues I noticed during my recent research:

- GitHub does not support IPv6.

- Docker containers do not have IPv6 by default.

- Many programs default to listening on 0.0.0.0 or 127.0.0.1 when they start, which means they only listen on IPv4. On Linux, listening on :: defaults to listening on both IPv4 and IPv6 simultaneously, but few programs do this. Python asyncio even disabled this feature[1].

- I've always heard that using IPv6 can sometimes lead to high latency or low bandwidth on certain websites, or even resource loading failures. Why isn’t there a convenient tool to compare these differences? It would be great if browsers could switch between IPv4-only, IPv6-only, and dual-stack modes. I’d like to seriously compare the effects on some websites rather than being silently affected.

- Two large ISPs, Hurricane Electric and Cogent, do not have IPv6 peering[2], so they are not interconnected, and many other ISPs have similar issues.

- Very few VPS providers offer /64 IPv6 addresses, which would allow different containers to be assigned freely within a machine. Some only provide a single /128, while others offer very few addresses per machine.

- Many people might only know how to use iptables/nftables for firewalls and forget about IPv6, leading to situations where using IPv6 can bypass the firewall. I’m not talking about issues caused by the lack of NAT (NAT is not a good firewall!), but more generally about cases where you want to disable forwarding between two network interfaces.

I stumbled upon two old posts that I found quite amusing:

In 2011, someone said[3] “It's not terribly useful to have IPv6 only websites at the moment. Check back in 5-10 years though ;)”

In 2014, someone said[4] “The Internet is growing really fast, in a few years, the IPv6 network will be bigger than IPv4, so, with IPv4, you'll be out of the real Internet. Go ahead man! Upgrade your IP!! Change is a good thing.”

[1]: https://github.com/python/cpython/blob/5f5c0b9c23238dc0a1fdb...

[2]: https://adminhacks.com/broken-IPv6.html

[3]: https://www.reddit.com/r/ipv6/comments/gnh69/what_ipv6only_w...

[4]: https://askubuntu.com/questions/309461/how-to-disable-ipv6-p...

Re: The IPv6 Transition

#216

Post by magicalhippo »

zaphoyd wrote: post #71
growse wrote: post #9

Earlier quoted context omitted.

I'm not sure I've ever heard this view expressed by serious, competent network engineers. I have heard it a lot from the home hobbyist though, but I'm not sure how much that demographic matters in the grand scheme of things.

I also find it really weird as the killer (only?) app for IPv6 is that home hobbyists can run servers with low overhead! Additionally, like a sibling comment notes, a home hobbyist has full control over at least half, often more, of their addresses and can easily choose addresses for their network that are as short or shorter and easier to remember and organize vs a v4 network where you have no letters to work with m…

It's not weird. Many ISPs have dynamic prefixes, and even with "just" 56 bits that prefix is long and not very memorable.

Thus ULA is a must on the inside, and DynDNS is still required for anything internet facing.

Re: The IPv6 Transition

#217

Post by eptcyka »

theamk wrote: post #120
uobytx2 wrote: post #90

People posting have mentioned that IPv4 is working for what they use the internet for. But of course it is. When NATs has been required for your whole life, how could the internet have built features that needed p2p routing? Just convince businesses to build something that requires special router configuration? And still wouldn’t work on phones or with ISPs that require CG NAT? You got what worked out of the box. You…

Why do people assume IPv6 means "easy p2p"? Even if NAT will be gone one day, the stateful firewalls won't. Every every home router would still ship with "deny all incoming" by default, and every corporate network would have the same setting as well. Same as IPv4, IPv6 serving would still need registration with border device, either manual by user, or via UPnP-equivalent.

With how trivial generating new addresses in IPv6 is, it'd be cool to have a host block all incoming traffic on its own and have each service that deserves to be reached over the listen on an address unique to the service.

Re: The IPv6 Transition

#218

Post by azalemeth »

NelsonMinar wrote: post #162
imoverclocked wrote: post #147

Earlier quoted context omitted.

I hadn’t put that quite together. I wonder how many people would value IPv6 if they knew it meant less CAPTCHAs.

CAPTCHAs are the main reason I turned IPv6 on. No idea if it will actually help in practice, it's hard to measure. The other Starlink hassle is the geocoding for user IPv4 addresses is wildly wrong. I'm in Grass Valley, CA near Sacramento but sites all think my IP is either in Seattle or Los Angeles, depending on the week. This makes streaming services a huge PITA, I have to jump through hoops to convince them I'm in…

Or, as an alternative, we try to convince people that geoIP lookups are at best uncertain and at worst actively misleading -- and perhaps shouldn't be taken at face value. I personally think this would be a great thing. For paid services that allegedly need to know where you are geographically located, use your billing address. For advertisers it's one less bit of useful information...

Re: The IPv6 Transition

#219

Post by jiggawatts »

xvilka wrote: post #202

GitHub and Microsoft Azure still aren't IPv6-ready.

Azure is... getting there. Slowly.

The Portal now loads for me on IPv6, which then blocks me from accessing certain PaaS resources because they only work with IPv4 rules in their firewalls.

Speaking of which, it grinds me gears that every Azure PaaS service implements firewall rules in a unique and special way. The syntax is different, the parameters are different, the capabilities are different, and the output logs are also incompatible just for extra fun.

Re: The IPv6 Transition

#220

Post by jiggawatts »

kstrauser wrote: post #137
TacticalCoder wrote: post #106

One of my biggest issue is: how do you even detect exfil when ICMP is mandatory in IPv6 for the other protocols to even just work? IPv6 looks so Rube-Goldbergy to my eyes that if I squint just a little tiny bit and put a very thin thinfoil hat on, I could nearly swear this complexity is there by design. For example so backdoors allowing exfil through ICMP are impossible to detect. IPv6 is chatty. So chatty. There are…

ICMP is required for IPv4 to work correctly, too. It's often completely blocked by cargo culting net admins who then wonder why their things fail that ICMP would have fixed.

I have a laundry list of issues like this:

Firewalls stopped sending RST packets (or any other kind of error) by default on all ports more than a decade ago. This is great for Internet-facing security, but has converted from easily diagnosed instant failures on internal networks to 30 second timeouts... which are indistinguishable from "host is down".

Don't worry! Just ping the host... err... can't do that either because of overly paranoid admins like you mentioned.

Next, spend a week trying to figure out why packets seem to go only one way through a cloud VPN only to discover that Path MTU Discovery uses ICMP and without which VPNs are basically broken.

Fun.

Post reply on HN