Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet centralization and the original sin of NAT

dreamstation.systems

Post reply on HN
Print view View original

81–90 of 197 posts

Re: Internet centralization and the original sin of NAT

#81

Post by tsimionescu »

TZubiri wrote: post #74
rcxdude wrote: post #43

Earlier quoted context omitted.

The fact that it's a VPN is also pretty important, despite the utility of it also dealing with NAT headaches for you. The main selling point is acting as a relatively efficient private overlay network, giving you a consistent private network even as devices move between different internet connections. (Something that NAT makes a bit harder but you don't get for free even if NAT isn't a factor)

I see it now, it's a bundle of both the practical and security aspects. I think the security aspects serve mostly as a marketing tool, potentially serving users who truly need a VPN. But if I see a user that exposes a server without a dedicated IP address, and they use tailscale for this, the way I would describe it is that they are adding a third party node that routes traffic for them (just to provide multiplexing)…

> But if I see a user that exposes a server without a dedicated IP address, and they use tailscale for this, the way I would describe it is that they are adding a third party node that routes traffic for them (just to provide multiplexing), so in terms of security, it's an additional unnecessary man in the middle.

If you are listening on a public IP, you can trivially be attacked by anyone on the Internet.

If you listen on a private IP that only Tailscale can reach directly, you can only be attacked by Tailscale itself, or by anyone who successfully infiltrated Tailscale's network.

Should you run plaintext protocols over Tailscale? Absolutely not. But you're going to receive orders of magnitude less malicious traffic on a server accessible only over Tailscale compared to a server listening on the public Internet.

Re: Internet centralization and the original sin of NAT

#82

Post by CrimsonCape »

Pesthuf wrote: post #31

Sending files to another would be easy if only the services that allow doing this - over WebRTC - didn’t sell out to sketchy advertisers constantly. I have to look up which service is still good to use every time.

Check out Bitbang:

http://github.com/richlegrand/bitbang-cli

I've been using it and it certainly has the potential. I signed up for Cloudflare's TURN server which you use with bitbang and it gets you 1TB free data transfer per month.

Re: Internet centralization and the original sin of NAT

#83

Post by tsimionescu »

sedivy94 wrote: post #19
vbezhenar wrote: post #10

I'm still not convinced that IPv6 is a good thing. I think that we should have doubled down on sharing IP addresses. Both for consumbers (NAT) and for servers (NAT, TLS/HTTP reverse-proxying). It just solves all problems with IP address exhaustion. And the fact that consumers can't just directly connect to each other is a feature.

IPv6, in a way, takes the concept of a MAC address and puts it on steroids. This became evident to me when I learned about EUI-64 addresses. And then my brain melted when I learned that any interface can be assigned an arbitrary number of unique addresses with varying purposes or contexts because the address space is truly *that big*. When I consider that quality of IPv6’s design, it communicates to me an old and ide…

Having actual unique stable IPv6 addresses for every device is the dream of every Ad vendor - no need to bother with the huge array of tracking techniques and the chicken and mouse game of fighting various tracking protection solutions, just log the stable IPv6 of the user's device across any service they use.

So, of course, we then got Privacy Addresses, or whatever the name is. Which now means that you don't actually have a stable unique public IP, it actually changes all the time, and legitimate tracking and logging of your own network activity actually becomes much more complicated on IPv6.

Re: Internet centralization and the original sin of NAT

#84

Post by CrimsonCape »

TZubiri wrote: post #40
wmf wrote: post #6

Earlier quoted context omitted.

I'm having trouble decoding this but Tailscale is a VPN that can traverse NAT when necessary. Arguably Tailscale wouldn't be needed if NAT didn't exist but considering the timeline I'm not going to declare a conflict of interest.

You are describing the product technically, but I find how it is used more important. Do you use it? What do you use it for? If empirically most users use it to host a server on a machine with firewalled IP, then that's more descriptive than its technical featureset as listed on the tin.

I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join.

I use it in 3 ways:

1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a smart plug. I keep it powered off mostly. I can turn the plug on remotely and power the mini pc. It runs "tailscale --advertise-routes" which then exposes every device at my house to the tailnet. No open ports, but suddenly my phone thinks that it is back at home with all my home PCs. 3. I take my laptop with me and use "tailscale serve" which serves as a pipe. I can pipe my home movies to a smart TV at your house. Just install the jellyfin app, and browse for servers, and my server in my house appears in the list at your house.

Re: Internet centralization and the original sin of NAT

#85

Post by cm2187 »

NATs are also firewalls. I think people forget that before NATs, when you would install Windows, the minute you connected it to the internet, you had to rush to update it before a virus would infect it. The OS of the 90s weren't secure enough to be exposed to the WAN.

Re: Internet centralization and the original sin of NAT

#86

Post by Dylan16807 »

elric wrote: post #23

Calling NAT the original sin is a serious exaggeration. Carrier Grade NAT (CGNAT) is a truly evil concept that restricts the freedoms of the CGNATed users. But regular NAT is fine as long as you can control it. "No one wanting to bother with port forwarding" is largely a matter of shitty UX on the home gateway side and laziness on the side of the operator. Same with UPnP. If anything, NAT has saved millions of wildly…

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

I doubt it.

Very few devices do port NAT without also doing firewalling, since firewalling is simpler.

Re: Internet centralization and the original sin of NAT

#87

Post by combyn8tor »

elric wrote: post #50
preisschild wrote: post #33

Earlier quoted context omitted.

> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet. Its definitely the opposite. People started ignoring security because its "natted" anyways, even though NAT was never supposed to be security-critical. Thats what firewalls are for.

People (by which I mean average computer users) didn't "start ignoring security", they never bothered to unignore it in the first place. Early Windows editions didn't even ship with a firewall at all, people were rawdogging the internet out of the box without ever stopping to consider the consequences.

I remember in the Windows 95/98 days asking my friend for his IP address and then browsing through my windows explorer to his mum's fully shared windows C drive. She had her computer plugged directly into the modem and was using ICS to share the net to my friends computer.

I sent them a screenshot of her shared drive through ICQ, and not long after she bought a router.

Re: Internet centralization and the original sin of NAT

#88

Post by Dylan16807 »

hdgvhicv wrote: post #42
Sha1rholder wrote: post #22

Earlier quoted context omitted.

In regions where IPv4 addresses are scarce, you may not even have a single public IPv4 address. I'm fortunate to have one, but still needs NAT.

IPv4 costs are tiny compared to the cost of providing an internet connection.

It's free money to your ISP. A lot of ISPs us CGNAT.

Re: Internet centralization and the original sin of NAT

#89

Post by mxkdjdjdb »

warkdarrior wrote: post #80
solatic wrote: post #47

> There’s lots of things you can blame for killing the open Internet, but I think NAT was one of the earliest. Running a server used to be trivial: run an executable, tell people your address, done... It also trained everyone to think client‐server is natural. “My device talks to The Cloud which talks to other devices” feels normal, when that feeling originated as an artifact of address scarcity. A lot of this feels…

> Running a server used to be trivial: run an executable, tell people your address, done... This works, until you have more than one person accessing your server. Then you need to worry about accounts, credentials, data isolation, etc. And then if a couple of people connect to your server and start using it, you have to worry about staying online, staying updated, backing up the data. But other than that... yes, triv…

I mean, no, you don't have to worry about all that stuff unless the business logic demands it. The OP is entirely correct for eg just serving a static file.

Re: Internet centralization and the original sin of NAT

#90

Post by thomastjeffery »

The consequences are so much more significant than people seem to realize.

Because of NAT, hierarchy (centralized servers) is the foundational design pattern of the internet, and anyone who wants any semblance of anarchy (decentralized networks) must use a workaround that is itself hierarchical and costly. We are all interconnected, but only a wealthy few can truly speak fist.

Post reply on HN