Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet centralization and the original sin of NAT

dreamstation.systems

Post reply on HN
Print view View original

61–70 of 197 posts

Re: Internet centralization and the original sin of NAT

#61

Post by wmf »

TZubiri wrote: post #40
wmf wrote: post #6

Earlier quoted context omitted.

I'm having trouble decoding this but Tailscale is a VPN that can traverse NAT when necessary. Arguably Tailscale wouldn't be needed if NAT didn't exist but considering the timeline I'm not going to declare a conflict of interest.

You are describing the product technically, but I find how it is used more important. Do you use it? What do you use it for? If empirically most users use it to host a server on a machine with firewalled IP, then that's more descriptive than its technical featureset as listed on the tin.

I don't think any of us could know how most users use it.

Re: Internet centralization and the original sin of NAT

#62

Post by baron3dl »

miki123211 wrote: post #45

The designers of the internet made one fundamental mistake, namely applying meatspace norms to cyberspace. In the "real world", you don't really need that much security. Your actual security comes from the fact that all the worst criminals are already locked up, most of the would-be criminals are afraid of being locked up, and if somebody does actually commit a crime, they will get locked up and won't be able to do i…

I think about this frequently. IMO, geographic sparsity is the biggest difference. Every malcontent on the planet just can't reach my door, and the physical reality of movement through space means they can't reach my door, AND every other door on the planet, in the same way they can reach every IP, or practically every IP.

There's probably a field of study with vocabulary and accompanying proofs of significant rigor that prove or disprove this. Maybe they'll stop by our little subthread and clear it up.

Re: Internet centralization and the original sin of NAT

#63

Post by anamexis »

gatio wrote: post #32
teekert wrote: post #9

Earlier quoted context omitted.

It brings the requirement for a firewall on every endpoint with a unique address. My Phone often has an ipv6 address (found out this holiday wen I couldn't resolve one of sites because of an orphan ipv6 entry nobody noticed), and has little problems. Perhaps there is also "firewalling" on the router and the phone can't even have incoming connections. Not sure. In any case, the phone seems to do fine.

> Perhaps there is also "firewalling" on the router and the phone can't even have incoming connections. Not sure. Correct. Every home wifi router worth its salt will firewall incoming connections by default, whether v4 or v6. It's then possible (unless it's some shitty ISP-provided locked down device) to add specific allow rules, or allow all for a particular client. egress is typically wide open, although sometimes…

There's no home wifi router for an address assigned by the cell carrier.

Re: Internet centralization and the original sin of NAT

#64

Post by mhurron »

Hizonner wrote: post #53
elric wrote: post #50

Earlier quoted context omitted.

People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.

... because people (by which I mean software vendors who should have known better) irresponsibly failed to create secure systems for those average users to use. A whole lot of which came to be justified by "it'll be behind a firewall" thinking.

Did you forget dialup was a thing? No one created anything for home users thinking it would be behind some firewall because as said Windows didn't ship with one, and because the dominant way of customers getting online was dialup, giving a public IP to every user.

Software was created with no security because no one demanded it because no one cared. Technologies that came later did not create that situation.

Re: Internet centralization and the original sin of NAT

#65

Post by unethical_ban »

elric wrote: post #23

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…

NAT only serves as the janky inbound default deny because IPv4 doesn't have the address space. There are very few things NAT solves in a world without address exhaustion; the only one I can think of off hand is a janky method of forcing return routing in enterprise environments where symmetric rooting is needed.

In an alternate universe (or a current one with IPv6) every home router would have a default deny inbound security policy, and home admins could punch holes as needed the way they do today with port forwarding.

Re: Internet centralization and the original sin of NAT

#66

Post by exabrial »

I think its funny everyone thinks that ISPs, Device Manufacturers, and Cloud Providers are going to let your connect back directly to your "home" with IOT devices.

Absolutely not. They can charge your $9.99/mo so you can connect their craptastic app to their craptastic cloud so you can "use their app from anywhere".

Re: Internet centralization and the original sin of NAT

#67

Post by Hizonner »

exabrial wrote: post #66

I think its funny everyone thinks that ISPs, Device Manufacturers, and Cloud Providers are going to let your connect back directly to your "home" with IOT devices. Absolutely not. They can charge your $9.99/mo so you can connect their craptastic app to their craptastic cloud so you can "use their app from anywhere".

... and NAT was a big part of giving them the market power they now use to enforce that.

Re: Internet centralization and the original sin of NAT

#68

Post by Hizonner »

TZubiri wrote: post #55
Sha1rholder wrote: post #49

Earlier quoted context omitted.

Not every place is the same.

Do you have any example where leasing an ipv4 block from a NIC directly costs more than 5$ per IPv4 address per year?

Counting the cost of creating the company so you can actually deal directly with a NIC?

Every. Single. Individual. End. User. Device. Should. Be. Addressable. Given that there are more such devices out there then there are IPv4 addresses to begin with, cost doesn't even come into it.

Re: Internet centralization and the original sin of NAT

#69

Post by TZubiri »

litoE wrote: post #58
TZubiri wrote: post #55

Earlier quoted context omitted.

Do you have any example where leasing an ipv4 block from a NIC directly costs more than 5$ per IPv4 address per year?

Yes. My ISP will rent me a single IPv4 address for $10 per month. Or I can use DHCP, where my IPv4 address can change at their whim.

> Yes. My ISP will rent me a single IPv4 address for $10 per month.

At that price point you can get a small vm, but if you have a dedicated server you want to use on-prem, 10$/mo seems like a reasonable price.

> Or I can use DHCP, where my IPv4 address can change at their whim.

Check the dhcp.lease to make sure, I used to think that, then I looked at the dhcp lease and the IP was being reserved for up to 48 hours of disconnection. I went years without it ever being released.

Phone operators won't necessarily transmit this information to you, the true ISP operator is the DHCP server. Not only is it more knowledgeable, but DHCPd has no incentive to upsell you, just provides you with what it is configured to.

I'd even go as far as checking if you can send parameters during the dhcp lease request, maybe you can request a longer lease on the IP.

There's a right way to do things, it's not trivial to discern from the wrong way to do it, but once you see it, you notice that you lose almost nothing, it's not like the 'wrong' way is simpler, it's just 'wronger', all the way through. I guess the reason they persist is sunk-cost fallacy, the businesses and people that went with NAT then developed STUN, and then they developed ICE, and then they develop Tailscale, every time you need to invent a bigger spade to dig you out of the hole and into a deeper one.

Or you can just use IPv4. But aghast, you have to pay 10$/month (or learn DHCP)

Re: Internet centralization and the original sin of NAT

#70

Post by parasyte »

TZubiri wrote: post #40
wmf wrote: post #6

Earlier quoted context omitted.

I'm having trouble decoding this but Tailscale is a VPN that can traverse NAT when necessary. Arguably Tailscale wouldn't be needed if NAT didn't exist but considering the timeline I'm not going to declare a conflict of interest.

You are describing the product technically, but I find how it is used more important. Do you use it? What do you use it for? If empirically most users use it to host a server on a machine with firewalled IP, then that's more descriptive than its technical featureset as listed on the tin.

i personally have used it * to provide access to my home network, as though i am on the home network, while outside of said network * to connect several locations to the same business network

the first lets me provide locally hosted services without exposing them to the internet, by allowing members of the VPN ("tailnet" in their parlance) to connect to those services

the second was very handy to move a few users from a company in the process of shutting down to their homes, so they could continue to work like they had in the company network once the actual internal company network was shut down.

Post reply on HN