Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

91–100 of 519 posts

Re: Why IPv6 is so complicated

#91

Post by gucci-on-fleek »

XorNot wrote: post #55
9dev wrote: post #34

Earlier quoted context omitted.

There are no more acronyms. SLAAC means automatic client configuration. That's the only one you need. > give up control of your home network. What does that even mean? What do you gain by deciding your Apple TV should be at 192.168.0.3? With IPv6, you can just `ping appletv` and it works fine. What more "control" do you need?

I mean generally I want fixed IPs on my local network for robustness. With IPv6 I actually want it more and it becomes possible since we can just use the MAC address as an IP address. I have IPv6 service at my ISP right now but I'm hesitant to turn it on on my local network because it does make my firewalling concerns much more critical.

> I mean generally I want fixed IPs on my local network for robustness.

Same here, which is why I use DHCPv6. It's pretty easy to set up, nearly everything supports it, and it's super reliable.

The only catch is that Android refuses to support DHCPv6 for some reason, which is kinda annoying since it means that you need to keep SLAAC enabled if you have any Android devices on your network. Which means that your DHCPv6-supporting devices will end up with two addresses, but there aren't any real downsides to that.

Re: Why IPv6 is so complicated

#92

Post by wongarsu »

gucci-on-fleek wrote: post #58
hnlmorg wrote: post #53

Earlier quoted context omitted.

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a tr…

> The nice thing about NAT [...] I really do think IPv6 missed a trick by not offering that IPv6 supports NAT [0], and nearly all routers make it easy to enable. The primary differences compared to IPv4 is that no-NAT is the default, and that it's more heavily discouraged, but it still works just as well as it does with IPv4. [0]: In the same way that IPv4 "supports" NAT, meaning that the protocol doesn't officially…

But would we have said the same in 1996 or 2000? Part of the adoption curve seems to be that it took years to abandon some of the bad ideas around IPv6 and readopt some of the better ones from IPv4. And a good chunk of the complexity of IPv6 is that some of the early ideas are very persistent, both in some deployed systems and in people's minds

Re: Why IPv6 is so complicated

#93

Post by stingraycharles »

IvyMike wrote: post #8
stingraycharles wrote: post #4

Earlier quoted context omitted.

How I wish that djb time stamped his articles, as I feel like this article is over a decade old but I can’t tell with certainty.

https://web.archive.org/web/20021203075817/https://cr.yp.to/...

Yeah, 24 years old. It’s crazy how little has changed in 24 years, other than most of the major sites now supporting IPv6 (with some notable exceptions, such as AWS and GitHub).

Re: Why IPv6 is so complicated

#95

Post by 9dev »

nottorp wrote: post #69
XorNot wrote: post #55

Earlier quoted context omitted.

I mean generally I want fixed IPs on my local network for robustness. With IPv6 I actually want it more and it becomes possible since we can just use the MAC address as an IP address. I have IPv6 service at my ISP right now but I'm hesitant to turn it on on my local network because it does make my firewalling concerns much more critical.

> since we can just use the MAC address as an IP address With IPv4 you need to remember ... one number per machine. The one at the end, since it's usually a /24 and everything has the same prefix. I'm sure it's trivial to remember mac addresses from different vendors with no connection to each other too :) > Isn't it really stable hostnames that you want? Hostnames are another layer. Your apple tv example may adverti…

That’s kind of my point, though. There is no reason at all to remember IP addresses.

Re: Why IPv6 is so complicated

#96

Post by 9dev »

j16sdiz wrote: post #86
9dev wrote: post #34

Earlier quoted context omitted.

There are no more acronyms. SLAAC means automatic client configuration. That's the only one you need. > give up control of your home network. What does that even mean? What do you gain by deciding your Apple TV should be at 192.168.0.3? With IPv6, you can just `ping appletv` and it works fine. What more "control" do you need?

> you can just `ping appletv` and it works fine. How many service does it take to make this work? mDNS is quite fragile.

I haven’t seen a bog-standard router yet that didn’t just do it out of the box.

Re: Why IPv6 is so complicated

#97

Post by 9dev »

j16sdiz wrote: post #83
9dev wrote: post #56

Earlier quoted context omitted.

DHCP requires explicit configuration; it needs a range that hopefully doesn't conflict with any VPN you use; it needs changes if your range ever gets too small; and it's just another moving part really. With SLAAC, it's just another implementation detail of the protocol that you usually don't have to even think about, because it just works. That is a clear benefit to me.

When it fail, you find there is no option to tune its behaviour. Plug in a rough router and see quickly you can find it.

What kind of failure are you referring to? What would you want to tune? You can still easily locate all devices on your network.

Re: Why IPv6 is so complicated

#98

Post by nottorp »

9dev wrote: post #88
nottorp wrote: post #76

Earlier quoted context omitted.

You're assuming there is only one internet connection in my home network, for example. The "easy" trick where your ISP gives you routable addresses does not work when there's more than one exit. Still want to help? :) And really... everyone is pushing for SSL everywhere - among other things so that the ISP doesn't MITM your traffic. Why would you allow the ISP to know what machines are inside your home network then?

This doesn’t change anything about the NAT or firewall story, and having two different connections is complex with IPv4 just as well. Aside from being a fairly exotic setup for personal use anyway. What would your ISP do with the information that there are 73 unique addresses in your network at this point in time? Especially given that devices may mint any number of them for different reasons, so you can’t even reall…

> Aside from being a fairly exotic setup for personal use anyway.

So I should cancel one of my pipes because the "commitee" overcomplicated things in the name of autoconfiguration?

> What would your ISP do with the information that there are 73 unique addresses in your network at this point in time?

Sell it of course. Good info for targeting marketing/political propaganda per household.

> I haven’t seen a bog-standard router yet that didn’t just do it out of the box.

Which one, the one from ISP A or the one from ISP B? :)

Re: Why IPv6 is so complicated

#99

Post by threiw »

eqvinox wrote: post #84
threiw wrote: post #77

Earlier quoted context omitted.

I fixed the problem once for all. Now my program even refuses to start, if IPv6 is enabled. I am not going to spend time debugging problem, that can be easily prevented. Pretty valid solution on private networks and local only kubernetes deployments. If customer wants proper ipv6 support, we can sign a contract and talk about it. But do not expect me to support some technology for free, just because it is enabled by…

Nah, you didn't fix anything, you just moved the problem around. (Worst case, you moved the problem to your finance department, for buying IPv4 address space. But even if you didn't do that, at some point sooner or later you'll get pressure to support IPv6. And then you'll have to "un-fix" everything you did, and fix the actual problem. Maybe it'll be after you're retire, but I wouldn't take bets on that.) [ed.: best…

As I wrote, we use internal networks and k8s. Most of our nodes can not even access internet. I would welcome pressure to support ipv6, it means juicy fresh contract and money.

> you didn't fix anything, you just moved the problem around.

I do not get this attitude "ipv6 is inevitable". So far no customer even asked about it. We have way more urgent problems like cloudflare blocking, ddos from clankers, state regulations...

If the problem actually becomes real in like 20 years. The clankers will probably solve it in like 10 seconds. There is zero benefit right now to deal with headaches of dual routing and addressing.

Re: Why IPv6 is so complicated

#100

Post by hnfong »

eqvinox wrote: post #84
threiw wrote: post #77

Earlier quoted context omitted.

I fixed the problem once for all. Now my program even refuses to start, if IPv6 is enabled. I am not going to spend time debugging problem, that can be easily prevented. Pretty valid solution on private networks and local only kubernetes deployments. If customer wants proper ipv6 support, we can sign a contract and talk about it. But do not expect me to support some technology for free, just because it is enabled by…

Nah, you didn't fix anything, you just moved the problem around. (Worst case, you moved the problem to your finance department, for buying IPv4 address space. But even if you didn't do that, at some point sooner or later you'll get pressure to support IPv6. And then you'll have to "un-fix" everything you did, and fix the actual problem. Maybe it'll be after you're retire, but I wouldn't take bets on that.) [ed.: best…

> at some point sooner or later you'll get pressure to support IPv6

I've been told that for 20+ years. Nothing has changed.

Post reply on HN