171–180 of 519 posts
Earlier quoted context omitted.
Easier if you’re a native English speaker. Harder if you’re not. My only gripe with IPv6 addresses is they look too similar to MAC addresses. But as a representation, I think they’re absolutely fine.
fair point about native english speakers, but there's also no reason this scheme can't be localised
Earlier quoted context omitted.
It's just one firewall rule at the border to block all inbound traffic to a subnet or a range unless related to an outbound connection. Now you have identical security to a NAT. The huge win is you can forget about port forwarding and later just open the ports you need to the hosts you need or even the whole host if required.
Is it really identical when the receiving party can now identify every workstation at your internal network and track them separately? For example, any website can now not only log that the traffic originated from org A, but specifically from org A, workstation N. I wonder, is privacy implication is not important enough for people to worry about this?
GeoIP databases and Cookies exist. So I'm not sure how your threat profile has increased here.
> I wonder, is privacy implication is not important enough for people to worry about this?
The most you can do over what is already possible is attempt an inventory or unit count of my office; however, you'd have to get every computer in my office to go to the same website that you control. Then you'd have to control for upgrades and other machine movements. I don't think this enables anything in particular.
Earlier quoted context omitted.
So, like ipv4, but you lose the protection and privacy afforded by the NAT?
NAT is not a security device. A firewall, which will be part of any sane router's NAT implementation, is a security device. NAT is not a firewall, but is often part of one. Any sane router also uses a firewall for IPv6. A correctly configured router will deny inbound traffic for both v4 and v6. You are not less secure on IPv6.
So firewall is actually worse than NAT.
There is no working solution to ipv6 dual WAN failover, 30 years later... A critical design flaw that was simply ignored by the designers despite being used in almost any SME network. inb4 no you can't have all lan devices have multiple ipv6 addresses and choose for themselves, typically 1 WAN is cheap and the second WAN is expensive/slow and should be used only for WAN1 failover Inb4 no you can't just advertise new…
This annoys me, especially the last “It takes at least 25 years” rhetoric. It didn’t take 25 years for SSL. SSH. Gzip encoding on HTTP pages. QUIC. Web to replace NNTP. GPRS/HSDPA/3G/4G/5G They all rolled out just fine and were pretty backwards and forwards compatible with each other. The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. I’m sure there’s many reasons that’s the case but my god. What does your ISP s…
> The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. SLAAC is easily the thing I love most about IPv6. It just works. Routers publish advertisements, clients configure themselves. No DHCP server, no address collisions, no worry. What's bugging you about it?
ping somehostname
Earlier quoted context omitted.
What problem is this actually solving? I've deployed DHCP countless times in all sorts of environments and its "statefulness" was never an issue. Heck, even with SLAAC there's now DAD making it mildly stateful. Don't get me wrong, SLAAC also works fine, but is it solving anything important enough to justify sacrificing 64 entire address bits for?
* privacy addresses are great * deriving additional addresses for specific functions is great (e.g. XLAT464/CLAT) * you don't get collisions when you lose your DHCP lease database * as Brian says, DHCP wasn't quite there yet when IPv6 was designed * ability to proactively change things by sending different RAs (e.g. router or prefix failover, though these don't work as well as one would hope) * ability to encode mnem…
There is no working solution to ipv6 dual WAN failover, 30 years later... A critical design flaw that was simply ignored by the designers despite being used in almost any SME network. inb4 no you can't have all lan devices have multiple ipv6 addresses and choose for themselves, typically 1 WAN is cheap and the second WAN is expensive/slow and should be used only for WAN1 failover Inb4 no you can't just advertise new…
Earlier quoted context omitted.
* privacy addresses are great * deriving additional addresses for specific functions is great (e.g. XLAT464/CLAT) * you don't get collisions when you lose your DHCP lease database * as Brian says, DHCP wasn't quite there yet when IPv6 was designed * ability to proactively change things by sending different RAs (e.g. router or prefix failover, though these don't work as well as one would hope) * ability to encode mnem…
Privacy addresses... Isn't it silly to talk of privacy if the prefix doesn't change?
"I wish to participate in a global telecommunications network and I wish to connect immediately to all my friends and be available to them 24/7 and I wish to play games with strangers across the country and I wish to receive all my email within 300ms with no spam and I wish to watch the latest news from Iran in 4K streaming Dolby"... but priiiiivacy!
Earlier quoted context omitted.
IPv4 has exact same problem, the NAT is working here because devices does not actually have proper Internet connection, all connections are terminated on NAT and reassembled after. Actual solution could be extending TCP and UDP or make a new transport layer procotol that handles changing addresses, similar to what QUIC do. But we cannot do it exactly because things like NATs existing, thus QUIC build was build on oss…
Ipv4 does NOT have this problem. The typical setup is always NAT for ipv4 lan, so external address can be changed with minimal disruption. All ipv4 apps that require hole punching assume they will need to "discover" the external address anyways, for every new p2p connection. In contrast to the vast majority of ipv6 apps which assume their ipv6 address is identical to external ipv6 address, as this is(was) the main ma…
NAT is a hack that let us get 30+ more years out of IPv4, nothing more. Sadly, we now have a generation of engineers who thinks NAT is normal.
Earlier quoted context omitted.
> The whole SLAAC/DHCPv6/RA thing is a total clusterfuck. SLAAC is easily the thing I love most about IPv6. It just works. Routers publish advertisements, clients configure themselves. No DHCP server, no address collisions, no worry. What's bugging you about it?
I like the ability to ping somehostname on the local network and have it work (where ping can be any command or browser). That's easy with DHCP+DNS, and either impossible or amazingly ugly with DLAAC.