Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet centralization and the original sin of NAT

dreamstation.systems

Post reply on HN
Print view View original

51–60 of 197 posts

Re: Internet centralization and the original sin of NAT

#51

Post by Hizonner »

dboreham wrote: post #36

People have forgotten, or weren't alive, but NAT was created and deployed originally by users. The problem they were solving wasn't "how do we stop running out of addresses" but rather "how do we save money". That's because early ISPs had hit on the idea of charging more for more address space, as a way to differentiate between small and large customers. So you could buy a cheaper service with one IP and use NAT to g…

I was alive and don't think I've forgotten. What distinguished large from small users was the width of the pipe. Address space charging was never important as a revenue driver. There were some attempts to charge for address space to keep people from getting huge blocks they didn't use. The long term solution for that was, of course, supposed to be IPv6.

If I wanted to blame large corporate "users" for NAT (which I actually do), I would blame their obnoxious intransigent refusal to upgrade to IPv6. That part wasn't the ISPs' idea, but it had nothing to do with the cost of address space and everything to do with shortighted laziness. They were, in fact, willing to pay for IPv4 space to avoid having to do anything.

Re: Internet centralization and the original sin of NAT

#52

Post by Hizonner »

elric wrote: post #23

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…

> "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP.

If you try to use those port forwarding hacks, you force every single piece of software to deal with the fact that the IP address it sees for itself is not the IP address its peer sees for it. And you force every single protocol design to allow for that possibility. Add in UPNP, and now you have to implement a whole extra (badly designed) protocol in parallel with the actual application.

It's not trivial to even discover the address your peer is seeing; even now there's a huge diversity of nasty unreliable hacks for doing it.

HTTP isn't the world. In fact, HTTP becoming "the world" was another part of the problem.

Re: Internet centralization and the original sin of NAT

#53

Post by Hizonner »

elric wrote: post #50
preisschild wrote: post #33

Earlier quoted context omitted.

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. Its definitely the opposite. People started ignoring security because its "natted" anyways, even though NAT was never supposed to be security-critical. Thats what firewalls are for.

People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.

... because people (by which I mean software vendors who should have known better) irresponsibly failed to create secure systems for those average users to use. A whole lot of which came to be justified by "it'll be behind a firewall" thinking.

Re: Internet centralization and the original sin of NAT

#54

Post by vel0city »

silon42 wrote: post #21
eru wrote: post #13

Earlier quoted context omitted.

> Anyway, we'll get the whole non-nat with IPv6, let's see what that brings I'll believe it when I see it. So far it doesn't look like IPv6 will win anytime soon.

I absolutely plan to NAT my home, I don't see a good reason to do otherwise. I don't see a reason why my machine addresses should change over time... then again, most shouldn't have direct internet access anyway, a http proxy on firewall should be enough.

> I don't see a reason why my machine addresses should change over time

You can still use fixed addresses locally if you want, its not like IPv6 is forcing you to use the prefix assigned if you just want to communicate locally over never-changing addresses.

You can have your computers be fd01::1, fd01::2, fd01::3, etc, and talk to everything on their local addresses when wanting to stay local. And then when they want to talk on the public internet they can just use whatever public addresses like 2600:1700:53c2:2573:4c:c001:dead:beef based on whatever prefix your ISP gives you.

Its not like your devices have to only have a single IP address.

Re: Internet centralization and the original sin of NAT

#55

Post by TZubiri »

Sha1rholder wrote: post #49
hdgvhicv wrote: post #42

Earlier quoted context omitted.

IPv4 costs are tiny compared to the cost of providing an internet connection.

Not every place is the same.

Do you have any example where leasing an ipv4 block from a NIC directly costs more than 5$ per IPv4 address per year?

Re: Internet centralization and the original sin of NAT

#56

Post by NoMoreNicksLeft »

mikewarot wrote: post #46
NoMoreNicksLeft wrote: post #25

Earlier quoted context omitted.

>If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. This might not be a good thing. Perhaps if there had been no protection for those odious operating systems, they'd have died the horrible deaths they earned decades ago. We should only want to protect things we intend to keep, after all, and none of us…

All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code. I know of zero systems that can survive exposure to the raw Internet, unpatched and without admin…

>I know of zero systems that can survive exposure to the raw Internet

Sure. And as long as nothing has to survive exposure to the raw Internet, no one will build anything that could survive it. Not sure why that's so difficult to understand. You seem to think that the protection is the reaction to dangerous operating systems, when it's the cause.

Re: Internet centralization and the original sin of NAT

#57

Post by blindport »

elric wrote: post #23

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…

[dead]

Re: Internet centralization and the original sin of NAT

#58

Post by litoE »

TZubiri wrote: post #55
Sha1rholder wrote: post #49

Earlier quoted context omitted.

Not every place is the same.

Do you have any example where leasing an ipv4 block from a NIC directly costs more than 5$ per IPv4 address per year?

Yes. My ISP will rent me a single IPv4 address for $10 per month. Or I can use DHCP, where my IPv4 address can change at their whim.

Re: Internet centralization and the original sin of NAT

#59

Post by lstodd »

hdgvhicv wrote: post #41
lstodd wrote: post #20

Earlier quoted context omitted.

Well, any 3G or later mobile backbone is SIP+SCTP over IPv6. So in many ways it won already

My phone, on 4g, is not IPv6 At home it can be if I connect t to my ip6 ssid, but there’s a stateful firewall which may as well nat.

What your phone shows to app land is entirely different thing. I'm talking about the backbone.
Post reply on HN