Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Hits 50% IPv6

blog.apnic.net

Post reply on HN
Print view View original

111–120 of 496 posts

Re: Google Hits 50% IPv6

#111

Post by inigyou »

stingraycharles wrote: post #102
inigyou wrote: post #82

Earlier quoted context omitted.

Every ISP has to pay Hurricane Electric for their tunnels, that's why it's free to you. If enough people start using HE tunnels, ISPs will get native IPv6. But you can't use HE tunnels because every website you visit will block you. You also can't use them from CGNAT or if your home router doesn't have a DMZ.

And wouldn’t it add a considerable latency?

Possibly. They let you pick your nearest server, and HE is a tier-1 ISP which a lot of your packets may traverse already.

Re: Google Hits 50% IPv6

#112

Post by jeroenhd »

Leonard_of_Q wrote: post #58
mmwelt wrote: post #46

Interesting to see the per-country rates[1]. France is up to 85%, apparently! [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

The more mobile traffic, the more IPv6. Have a look at India, it is not as if everyone has a fibre connection running IPv6.

My home internet has IPv6 but my mobile carrier doesn't. IPv6 on mobile carriers is unfortunately still not universal.

Re: Google Hits 50% IPv6

#113

Post by inigyou »

lxgr wrote: post #86
jmyeet wrote: post #36

Earlier quoted context omitted.

All these systems are a reflection of the time that they were designed. IPv6 is 30 years old. At that time a lot of threats just didn't exist. One of my favorite is the decision to default to /64 blocks. There was a time when the designers believed that you'd use your 48 bit MAC address as part of this. Now we know that's a PII nightmare and nobody does it. Yet we're still stuck with the 128 bit addresses that came f…

The point of local networks of a minimum size of 64 bit isn't only to have MAC-based addresses (48 bit would have been enough for that, fwiw), but in general to support non-coordinated/probabilistic self-assignment schemes with negligible collision probability. Picking a random local address (which is very important for privacy, as you've mentioned) is much easier if you don't have to do an elaborate dance of listen,…

The best thing about SLAAC is that it forces your ISP to give you at least 64 bits. Otherwise you know Comcast would only give out a /128 and charge you for more, so you'd use NAT at home just like IPv4.

Re: Google Hits 50% IPv6

#114

Post by gucci-on-fleek »

fc417fc802 wrote: post #69
gucci-on-fleek wrote: post #55

Earlier quoted context omitted.

1. Peer-to-peer networking won't usually work correctly. And quite a bit of software uses P2P networking these days---BitTorrent, Zoom/Teams (via WebRTC), Tailscale, PlayStation/Xbox multiplayer, etc. Most of these services have automatic fallbacks when P2P networking doesn't work, but these fallbacks are usually slower and less reliable. 2. Most websites assume that 1 IPv4 address==1 household, so you'll often run i…

While true, neither of those are relevant in context (and I even explicitly acknowledged your first bullet in my comment above). It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that. I do of course appreciate that going via CGNAT to a clueless operator that eagerly adds IPv4 bans can be problematic but that's more…

> While true, neither of those are relevant in context (and I even explicitly acknowledged your first bullet in my comment above).

Yeah, I just mentioned that because P2P networking is used a lot more than most people think these days, since even things like Zoom that look like typical client–server web browsing actually use P2P networking internally.

> It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that.

Reliability and latency will be marginally better with IPv6 than with CGNAT, but this is so minor that I doubt that most people will notice this. And many CGNATs will RST connections that last too long, but most protocols have some sort of automatic retry/reconnect built in, so this shouldn't cause issues very often either.

IPv6 addresses are quite a bit cheaper than IPv4 addresses in most clouds, but since most servers still need to support IPv4, this doesn't help you directly. Supporting IPv6 means that others using the cheaper IPv6-only cloud services will be able to connect to your server, but this doesn't matter for consumer-only services.

So yeah, you're probably right that enabling IPv6 server-side won't have (m)any benefits.

> I do of course appreciate that going via CGNAT to a clueless operator that eagerly adds IPv4 bans can be problematic but that's more a question of why you as a consumer might want IPv6 connectivity not why a service provider would want to deploy it.

Being able to ban IP addresses without worrying about collateral damage is a pretty big benefit to the service provider though, for certain applications at least.

Re: Google Hits 50% IPv6

#115

Post by inigyou »

VorpalWay wrote: post #77
mritzmann wrote: post #7

Earlier quoted context omitted.

> a better web experience than IPv4 That's already the case. IPv6 is often faster because most ISPs these days use cgnat for IPv4.

I have yet to see any ISP use CGNAT here in Sweden. It seems to be a highly regional problem for some reason. Both on mobile and on broadband I get publicly routable IPv4.

That's because Sweden joined the internet relatively early when enough addresses were available. It's like that in most 1st-world countries. Places like Argentina, on the other hand, may have to share 8 IPv4 addresses per city.

Re: Google Hits 50% IPv6

#116

Post by BadBadJellyBean »

lxgr wrote: post #89
BadBadJellyBean wrote: post #39

Earlier quoted context omitted.

I don't think this is inherently a problem. It's good for home routers to have sensible defaults. Blocking incoming IPv6 connections is such a thing. Opening a port in the firewall shows the same kind of intent as forwarding a port with NAT. The burden is on the router manufacturers to expose these options in a sensible way. My router for example has a similar UI to forwarding a port with IPv4 and opening the port fo…

> I don't think this is inherently a problem. [...] My router for example has a similar UI to forwarding a port with IPv4 and opening the port for IPv6. Glad to hear that you don't have a problem with your router, but how does that relate to GPs problems with theirs?

It isn't. But It's also not an answer to GP.

The solution for them is "get a better router" because the problem is not the IPv6 protocol. Opening a port is not harder than creating a NAT forwarding and if your hardware can't do it then it's bad.

Re: Google Hits 50% IPv6

#117

Post by jeroenhd »

b112 wrote: post #3

And 32% is all llm/bots using AWS and other "pay for ipv4 IP" use cases.

Every scraper I have blocked seemed to use IPv4 primarily. Only when IPv4 gets blocked, some of them fall back to IPv6. Others just stay dead.

With AI companies using botnets ("residential proxies") for scraping, they're probably going to be in the 50% that doesn't use IPv6.

Re: Google Hits 50% IPv6

#118

Post by stcg »

mmwelt wrote: post #46

Interesting to see the per-country rates[1]. France is up to 85%, apparently! [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Anyone know why there is a high frequency signal on top of the long term trend in that graph?

https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Re: Google Hits 50% IPv6

#119

Post by TheDong »

ghusto wrote: post #108
inigyou wrote: post #81

Earlier quoted context omitted.

Everything that's needed besides letting computers talk to each other, that is. With ipv4 you have a two tier internet. Computers talk to servers, servers talk to servers, computers can't talk to computers so every video call must be routed through a server.

I hear this as a cited as a benefit of IPv6 a lot. Honest question: Isn't this at least a privacy issue, at most a security issue? SLAAC seems like what we already have with extra, breakable steps, which doesn't effectively address the privacy issue anyway.

Where's the privacy issue?

That the server can figure out that two computers in the same house are different since your laptop and phone no longer share the same ipv4 address but instead have two ipv6 address?

Your phone and laptop can just have multiple ipv6 addresses and rotate through them regularly... as apple does by default https://support.apple.com/en-ca/guide/security/seccb625dcd9/...

Security? NAT is not a firewall, you need a firewall, and switching to IPv6 does not remove your firewall.

Before IPv6: The server gets "1.2.3.4:56789" for your device. After IPv6: the server gets "1:2:3:4::56" or whatever for your device. In either case, if the server makes a connection to 1.2.3.4:56789 or 1:2:3:4::56, your router sees the packet and firewalls the connection. Cool.

Want to give me a concrete example of where IPv6 is hurting my privacy or security, because I've been using it for over a decade with zero mishaps, zero privacy issues, zero security issues (to my knowledge at least)

Re: Google Hits 50% IPv6

#120

Post by inigyou »

hdgvhicv wrote: post #100
inigyou wrote: post #88

Earlier quoted context omitted.

and anything P2P. Maybe that would have been a driver 20 years ago, but now everything is expected to be centralised. Our culture has shifted. Remember when people used to host their game servers? If you're under 16, you don't because it was never in your lifetime.

I have to open a hole in my firewall to host any service. Nat doesn’t change that. Unless you want to host multiple minecraft servers on the same port on different servers at home? Indeed hosting anything at home is such a rare workflow that someone wanting it can choose an isp which gives them the facilities they need. Unless you don’t live in a competitive market based economy and just have the single government ma…

The average person finds port forwarding much more confusing than "allow Minecraft y/n"
Post reply on HN