Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

151–160 of 519 posts

Re: Why IPv6 is so complicated

#151

Post by Ekaros »

ExoticPearTree wrote: post #133
Hikikomori wrote: post #109

Earlier quoted context omitted.

>In the enterprise space, if you mention globally reachable address space, the discussion tends to end pretty fast because “its not secure”. Those people love their NAT. Was also designed in the early 90s before security was taken seriously.

> Was also designed in the early 90s before security was taken seriously. True, but since then it has transformed into “no one gets in because we have _private_ IP addresses”…

I would need to ask the follow up question. Okay so what happens when someone gets in? Say some idiot install something they should not. Or there is some vulnerability in something you allow in?

Extra layers is good. But it does not mean you can forgo anything else.

Re: Why IPv6 is so complicated

#152

Post by Dagger2 »

b112 wrote: post #148
AndrewDucker wrote: post #33

Earlier quoted context omitted.

That still means replacing every part of the chain.

There are lots of legacy things in tcp/ip headers. One of them can be for the extra octlet. When ipv4 legacy flies around, that oclet will be null or 0. The entire internet could route just fine, especially if you put the extra octlet at the end. 1.1.1.1 gets an extra 1.1.1.1.newoctlet. So every existing IP gets a bonus 255 new IPs, and for now, routing of those is hardlocked to that IP, and it works with all legacy…

You're at the very beginning, baby steps stage of inventing IPv6 there.

You aren't the first person to come up with the idea of adding extra bits to IP addresses to make them longer. The problem isn't finding somewhere to stash the extra bits in the packet format (which is trivial; you can simply set the next-protocol field to a special value and then put the bits at the start of the payload), it's getting all software to use those extra bits -- and getting that to work requires doing all of the new AF family, new sockaddr struct, new DNS records, dual stack/translation/tunnels etc etc that v6 does.

Please consider that maybe the people working on v6 weren't actually complete imbeciles and did in fact think things through.

Re: Why IPv6 is so complicated

#153

Post by Dagger2 »

grandinj wrote: post #119
wongarsu wrote: post #87

A lot of it seems to boil down to "IPv6 was too early". Had IPv6 been developed a couple years later DHCP would have been mature, and SLAAC would have never been invented (since DHCPv6 is fairly obvious when you have good experiences with DHCP). Also it would have given all the alternative protocols (especially OSI) time to try (and likely fail) to gain traction, freeing IPv6 from the obligation to cram in all of the…

A couple of years later ipv6 became unnecessary. A big driver for ipv6 at the time was routers not being able to manage the increasing size of the core routingtable. Then 2 years later betterhardware and routing table compression became available and ipv6 became unnecessary.

Uh, no it didn't? Routing table size is still something of a problem, especially as v4 continues to fragment more and more, but also the main driver was insufficient IP addresses in v4 and that problem hasn't even slightly gone away.

Re: Why IPv6 is so complicated

#154

Post by Dagger2 »

stingraycharles wrote: post #93
IvyMike wrote: post #8

Earlier quoted context omitted.

https://web.archive.org/web/20021203075817/https://cr.yp.to/...

Yeah, 24 years old. It’s crazy how little has changed in 24 years, other than most of the major sites now supporting IPv6 (with some notable exceptions, such as AWS and GitHub).

That's because the problems he's describing come from v4 rather than v6, and v4 hasn't changed in a long time.

Re: Why IPv6 is so complicated

#155

Post by Ekaros »

b112 wrote: post #148
AndrewDucker wrote: post #33

Earlier quoted context omitted.

That still means replacing every part of the chain.

There are lots of legacy things in tcp/ip headers. One of them can be for the extra octlet. When ipv4 legacy flies around, that oclet will be null or 0. The entire internet could route just fine, especially if you put the extra octlet at the end. 1.1.1.1 gets an extra 1.1.1.1.newoctlet. So every existing IP gets a bonus 255 new IPs, and for now, routing of those is hardlocked to that IP, and it works with all legacy…

Pray tell me exactly where in the IP packet you put those extra octets. In a way that it affects zero other devices?

Re: Why IPv6 is so complicated

#156

Post by Dagger2 »

muvlon wrote: post #44
9dev wrote: post #20

Earlier quoted context omitted.

> The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. SLAAC is easily the thing I love most about IPv6. It just works. Routers publish advertisements, clients configure themselves. No DHCP server, no address collisions, no worry. What's bugging you about it?

What problem is this actually solving? I've deployed DHCP countless times in all sorts of environments and its "statefulness" was never an issue. Heck, even with SLAAC there's now DAD making it mildly stateful. Don't get me wrong, SLAAC also works fine, but is it solving anything important enough to justify sacrificing 64 entire address bits for?

SEND secures NDP by putting a public key into those 64 bits, and also having big sparse networks renders network scanning rather useless at finding vulnerable hosts, so there are reasons to make subnets /64 other than SLAAC.

Also we can always reduce the standard subnet size in 4000::/3 if we ever somehow run out of space in 2000::/3 (and if we don't then we didn't sacrifice anything to use /64s).

Re: Why IPv6 is so complicated

#157

Post by Dagger2 »

baq wrote: post #81
nslsm wrote: post #21

Earlier quoted context omitted.

So, like ipv4, but you lose the protection and privacy afforded by the NAT?

What protection? What privacy? Smoke and mirrors, mostly. NAT is a firewall with extra steps. IPv6 reduces complexity. Privacy (illusion of it, anyway, just like in ipv4 NAT) is handled by private addresses. …and if you really want to, NAT for ipv6 just works.

It's the illusion of a firewall too.

NAT changes the apparent destination address of a connection, it doesn't filter them. If a connection arrives with the destination address already set to one of your machines, NAT won't prevent it.

Re: Why IPv6 is so complicated

#158

Post by Dagger2 »

XorNot wrote: post #55
9dev wrote: post #34

Earlier quoted context omitted.

There are no more acronyms. SLAAC means automatic client configuration. That's the only one you need. > give up control of your home network. What does that even mean? What do you gain by deciding your Apple TV should be at 192.168.0.3? With IPv6, you can just `ping appletv` and it works fine. What more "control" do you need?

I mean generally I want fixed IPs on my local network for robustness. With IPv6 I actually want it more and it becomes possible since we can just use the MAC address as an IP address. I have IPv6 service at my ISP right now but I'm hesitant to turn it on on my local network because it does make my firewalling concerns much more critical.

Honestly, it sounds more like your network is fragile rather than robust. A robust network would be able to handle the IPs changing, rather than needing them permanently set to some specific value.

Re: Why IPv6 is so complicated

#159

Post by zem »

hnlmorg wrote: post #64
zem wrote: post #48

Earlier quoted context omitted.

have that be the invisible bottom layer. come up with a list of 256 common words, one per byte, and have that be the human visible IP address. mentally reading a string of words, however nonsensical, is way easier than a soup of undifferentiated hex digits.

Easier if you’re a native English speaker. Harder if you’re not. My only gripe with IPv6 addresses is they look too similar to MAC addresses. But as a representation, I think they’re absolutely fine.

fair point about native english speakers, but there's also no reason this scheme can't be localised

Re: Why IPv6 is so complicated

#160

Post by Dagger2 »

hnlmorg wrote: post #53
ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

The nice thing about NAT is it makes the security model easier to reason about. By this, I don’t mean it’s more secure, because I know it isn’t. But it is a lot easier to see and to explain what has access to what. And the problem with enterprise is that 80% of the work is explaining to other people, usually non-technical or pseudo-technical decision makers, why your design is safe. I really do think IPv6 missed a tr…

Nope, it doesn't. The security model is based on your firewalls and routing, not on NAT. NAT just gets in the way and makes it harder to understand what's going on.

For example, on a normal home network, if you don't have a firewall on your router then your ISP can connect to anything on your network. Even when they don't control the router and even if you're NATing.

If you didn't realize this then apparently NAT didn't make it easier to reason about after all.

Post reply on HN