Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

111–120 of 519 posts

Re: Why IPv6 is so complicated

#111

Post by eddythompson80 »

threiw wrote: post #77
eqvinox wrote: post #68

Earlier quoted context omitted.

Or, you could've fixed your server's configuration. Probably would've been faster than to "disable, remove and nuke ipv6". In general, the mistake is that it says "0.0.0.0" or "0.0.0.0:8080" somewhere where it should really say "::" or "[::]:8080". (IPv6 sockets by default accept IPv4 connections, unless you disable that either system-wide or on the specific socket.) By the way, I do agree the colon was a really poor…

I fixed the problem once for all. Now my program even refuses to start, if IPv6 is enabled. I am not going to spend time debugging problem, that can be easily prevented. Pretty valid solution on private networks and local only kubernetes deployments. If customer wants proper ipv6 support, we can sign a contract and talk about it. But do not expect me to support some technology for free, just because it is enabled by…

Yeah, I’ll sign a contract so you can “support” a configurable bind address. That’s post-doc level of comp-sci stuff right there.

I’ll also sign the “numbers bigger than 2^32” contract and a “weird looking characters in text” contract.

Re: Why IPv6 is so complicated

#112

Post by themafia »

hnlmorg wrote: post #53
ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a tr…

It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.

Re: Why IPv6 is so complicated

#113

Post by jjav »

ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

> In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”.

Topic drift, but for younger people who didn't live it, that's how it used to be!

For most of the 90s my workstation in the office (at several employers) was directly on the Internet. There were no firewalls, no filtering of any kind. I ran my email server on my desktop workstation to receive all emails, both from "internal" (but there was no "internal" really, since every host was on the Internet) people and anyone in the world. I ran my web server on that same workstation, accessible to the whole Internet.

That was the norm, the Internet was completely peer to peer. Good times.

Re: Why IPv6 is so complicated

#114

Post by 9dev »

hnlmorg wrote: post #110
9dev wrote: post #63

Earlier quoted context omitted.

The price you pay is that it's more difficult to reason about what is accessible from elsewhere, because all devices are represented by your router from the outside, and there are no great ways to opt out of that. With NAT removed, you've still got the firewall rules, and that's fairly easy to reason about for me: Block anything from outside to inside, except X. Allow A talking to B. Allow B to receive Y from outside…

> and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CISO, etc in large infrastructure environments. That’s a whole different problem and half the time the people signing off that change either aren’t familiar with the infrastructure (which me…

> But we aren’t talking about someone technical glancing at their home routers firewall.

Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort.

For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the work to do so. And I am confident in saying it is absolutely able to deliver on any kind of corporate network scenario, even moreso than IPv4.

Re: Why IPv6 is so complicated

#115

Post by themafia »

bryden_cruz wrote: post #28

I recently had to set up basic IP-based country detection in Nginx for a project. Parsing and handling IPv4 is trivial. The second I had to account for IPv6 string formats and update the Geo databases to match, the complexity just spiked for no good reason. It feels like we traded address exhaustion for parsing nightmares.

inet_pton/inet_ntop handle AF_INET6.

Re: Why IPv6 is so complicated

#116

Post by hnlmorg »

9dev wrote: post #114
hnlmorg wrote: post #110

Earlier quoted context omitted.

> and that's fairly easy to reason about for me But we aren’t talking about someone technical glancing at their home routers firewall. We are talking about explaining a network topology to enterprise teams like change management, CISO, etc in large infrastructure environments. That’s a whole different problem and half the time the people signing off that change either aren’t familiar with the infrastructure (which me…

> But we aren’t talking about someone technical glancing at their home routers firewall. Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort. For network admins in commercial settings, this is even less of an excuse. IPv6, the protocol, is fairly well documented and understandable if you put in the wor…

> Are we not? Because I suppose most people here are only disgruntled by a new protocol that changes how their home router works, and having to spend some learning effort.

I did make the context pretty clear when I said:

> the problem with enterprise is…

Also, you completely missed my point when you said:

> if you put in the work to do so. And I am confident in saying it is absolutely able to deliver on any kind of corporate network scenario, even moreso than IPv4.

My point wasn’t that IPv6 cannot deliver enterprise solutions. It’s that some of the design around it makes the process of deploying enterprise solutions more painful than it needed to be.

Re: Why IPv6 is so complicated

#117

Post by XorNot »

9dev wrote: post #95
nottorp wrote: post #69

Earlier quoted context omitted.

> since we can just use the MAC address as an IP address With IPv4 you need to remember ... one number per machine. The one at the end, since it's usually a /24 and everything has the same prefix. I'm sure it's trivial to remember mac addresses from different vendors with no connection to each other too :) > Isn't it really stable hostnames that you want? Hostnames are another layer. Your apple tv example may adverti…

That’s kind of my point, though. There is no reason at all to remember IP addresses.

I don't care to remember them, but I do want them to be consistent so there's no dependency in DNS.

My home network isn't the Internet and isn't large: DNS is a much more complicated system to keep running then just fixed IP addresses in that circumstance.

Above a certain scale, that flips but not at the home level.

Re: Why IPv6 is so complicated

#118

Post by themafia »

muppetman wrote: post #11

This annoys me, especially the last “It takes at least 25 years” rhetoric. It didn’t take 25 years for SSL. SSH. Gzip encoding on HTTP pages. QUIC. Web to replace NNTP. GPRS/HSDPA/3G/4G/5G They all rolled out just fine and were pretty backwards and forwards compatible with each other. The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. I’m sure there’s many reasons that’s the case but my god. What does your ISP s…

> It didn’t take 25 years for SSL.

It wasn't even on the map until 1994. Prior to that it was an ad-hoc mess of "encryption" standards. It wasn't even important enough to become ubiquitous until Firesheep existed.

Even then SSL just incorporated a bunch of things that already existed into an extensible agreement protocol, which, in the long run, due to middleware machines, became inextensible and the protocol somewhat inelegant for it's task. 30 years later and it's due for a replacement but we're stuck with it. Perhaps slow adoption isn't a metric that portends doom.

Re: Why IPv6 is so complicated

#119

Post by grandinj »

wongarsu wrote: post #87

A lot of it seems to boil down to "IPv6 was too early". Had IPv6 been developed a couple years later DHCP would have been mature, and SLAAC would have never been invented (since DHCPv6 is fairly obvious when you have good experiences with DHCP). Also it would have given all the alternative protocols (especially OSI) time to try (and likely fail) to gain traction, freeing IPv6 from the obligation to cram in all of the…

A couple of years later ipv6 became unnecessary. A big driver for ipv6 at the time was routers not being able to manage the increasing size of the core routingtable. Then 2 years later betterhardware and routing table compression became available and ipv6 became unnecessary.

Re: Why IPv6 is so complicated

#120

Post by imtringued »

nslsm wrote: post #18
ggm wrote: post #7

India on around 80% in the apnic labs active measurement of end users. https://stats.labs.apnic.net/ipv6/in They report nearly a billion users, predominantly in mobile. So, "only" 750 to 800 million users. Think about that: 3x the population of the USA using it most of the time, in one economy. Here's the rankings: https://stats.labs.apnic.net/ipv6/XA?o=cINw30x1r1 This is a different measure to Google's. They measure…

Now compare average income to see how much this matters.

This has nothing to do with income.

The problem here is that India alone would be consuming 20% of the IPv4 address space.

Post reply on HN