Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The world in which IPv6 was a good design

apenwarr.ca

Post reply on HN
Print view View original

101–110 of 199 posts

Re: The world in which IPv6 was a good design

#101

Post by anilgulecha »

okket wrote: post #75
anilgulecha wrote: post #68

One big UX mistake of IPv6: it was not made backward compatible with IPv4. (v6)0.0.192.168.1.10 == 192.168.1.10(v4). This simple design when planning and rolling it out would have meant incrementally updating the networking stack to also support v6. Now it turns out v4 and v6 are completely different, and no one has a big enough reason to make the change until everyone else makes the change. Hard chicken-egg problem.

Backwards compatibility can not work. You can not answer an IPv6 packet with IPv4. There is no room in the header for the much bigger source/return address. You can try to do hacks like NAT (like you probably do in your home IPv4 network, which breaks/stops any peer-2-peer protocol). The IPv6 version is called DNS64/NAT64, and it breaks even more things, e.g. DNSSEC. Because it not only requires network address trans…

I don't mean it that way. Yes, on-the-wire format would have changed, maybe there would have been a required transition from v4 to v4.1, which could then have been backward compatible to v6.

To be fair, I don't think the authors of v6 at the time realized how much friction an alternative IP stack would cause.

Re: The world in which IPv6 was a good design

#102

Post by floatboth »

aidenn0 wrote: post #42
tyingq wrote: post #2

>One person at work put it best: "layers are only ever added, never removed." Find this in the software world as well. Something about the java culture seems especially fascinated with multiple layers of abstraction. Edit: Ok, some factions of the culture. " Convenient proxy factory bean superclass for proxy factory beans that create only singletons"

Some infamous examples of such java classes (For some reason Spring always seemed to have more verbose names than other DI frameworks, which is saying something): SimpleBeanFactoryAwareAspectInstanceFactory SerializedEntityManagerFactoryBeanReference And this is totally not related to that sort of naming scheme, but in trying to remember those spring names, I stumbled upon this gem: http://git.eclipse.org/c/aspectj/o…

http://java.metagno.me/

Re: The world in which IPv6 was a good design

#103

Post by ptman »

runeks wrote: post #22
Animats wrote: post #18

What he's really arguing for is a circuit-switched network, so that connections can be persistent over moves. He just needs a unique connection ID. One amusing possibility would be to do this at the HTTPS layer. With HTTPS Everywhere, most HTTP connections now have a unique connection ID at the crypto layer - the session key. If you could move an HTTP connection from one IP address to another on the fly, it could be…

> One amusing possibility would be to do this at the HTTPS layer. With HTTPS Everywhere, most HTTP connections now have a unique connection ID at the crypto layer - the session key. As a network-ignoramus, who likes cryptography, I’ve long dreamt of a networking protocol where endpoints are defined, primarily, by a public key. All messages would be encrypted with the destination public key, and signed by the source p…

Host Identity Protocol was one attempt: http://infrahip.net/

Re: The world in which IPv6 was a good design

#104

Post by vertex-four »

beagle3 wrote: post #93
Dagger2 wrote: post #78

Earlier quoted context omitted.

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way. Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two web…

> I haven't received an AAAA DNS record to any request I've made through several countries

Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?

Re: The world in which IPv6 was a good design

#105

Post by beagle3 »

azernik wrote: post #82
beagle3 wrote: post #73

Earlier quoted context omitted.

Would a down voter care to explain why I am so wrong in their opinion?

Because a) statements in your comment are false, b) some proposals in your comment have already been implemented, and c) the ones that haven't are bad ideas. IPv6 has caught on (I'm commenting from an IPv6-only connection right now, on a residential US ISP). Most clients do perform RFC4941 suffix randomization. Replacing the prefix destroys one of the most useful features of IP addresses and in particular the larger…

Thank you for taking the time to explain. Let me try to word things a little better:

What is the percentage of US homes who are on an IPv6?

What is the percentage of websites on IPv6?

What are the number of web site hits that are IPv6 to IPv6? (in the US? in the world?)

The highest estimate I've ever seen for any of these is less than 20%, which - 20 years into IPv6, is in my opinion "not caught on". The mobile world when 3G arrived preferred carrier-grade-NAT to IPv6 (which was technically a better solution), which is in my opinion "not caught on".

Suffix randomization has been implemented, but is not universal in my experience; and it is essentially useless for privacy in one's home. It slightly blurs the distinction between my laptop and my son's iPad. And that's ALL it does.

Right now I enjoy getting an address from a pool of 16K addresses every time I reset my cable modem; And it is likely to transition soon to a carrier-grade NAT which would give me even more privacy.

It is likely that I should be taking crazy pills - I seem to remember the snowdens of yesteryear and facebook shadow profiles, which either I'm hallucinating or no one else seems to care about.

On the other hand, I have a startup idea to profit from the impending v6-complete-lack-of-privacy that I should probably start working on. If you can't beat them, profit off them.

Re: The world in which IPv6 was a good design

#106

Post by beagle3 »

vertex-four wrote: post #104
beagle3 wrote: post #93

Earlier quoted context omitted.

> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two web…

> I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?

I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this:

$ dig www.amazon.com AAAA @8.8.8.8

    ; > DiG 9.7.1-P2 > www.amazon.com AAAA @8.8.8.8
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER
Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.

Re: The world in which IPv6 was a good design

#107

Post by jgrahamc »

beagle3 wrote: post #106
vertex-four wrote: post #104

Earlier quoted context omitted.

> I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?

I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; > DiG 9.7.1-P2 > www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Maybe they hate my ISP, but also anything behind cloudflare…

> Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.

We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4).

https://blog.cloudflare.com/98-percent-ipv6/

Re: The world in which IPv6 was a good design

#108

Post by vertex-four »

beagle3 wrote: post #106
vertex-four wrote: post #104

Earlier quoted context omitted.

> I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?

I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; > DiG 9.7.1-P2 > www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Maybe they hate my ISP, but also anything behind cloudflare…

Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record. Unfortunately many sites can't be bothered to do that despite it being a 5-minute job, since not doing it doesn't currently break anything in most cases, and might break things for the minority with broken IPv6 configuration.

Cloudfront now supports IPv6, so the reasoning for not enabling it on Amazon.com is likely similar.

Re: The world in which IPv6 was a good design

#109

Post by beagle3 »

vertex-four wrote: post #99
beagle3 wrote: post #91

Earlier quoted context omitted.

> It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript. Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs…

> My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request http://www.bbc.co.uk/news/technology-16721338 - something I remember from recent-ish history. That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it. > I find it disingenuous that you completely dismiss the societ…

> That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it.

Verizon was also doing this for mobile customers in the US, perhaps still do. I vote with my wallet against these ISPs. You did have some control over it, for example, by using HTTPS. But IPv6 prefixes are so plentiful, that they are assigned one-per-customer which makes correlating logs incredibly trivial; Even things like this O2/Verizon still required some per-ISP effort; no such thing with IPv6; no need to inject headers. The prefix is your undeletable cookie.

> I don't. I think there's other, significantly better solutions for it. I don't think NAT provides reasonable privacy in and of itself.

It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them.

The NAT only affords as much privacy as suffix randomization (as has been noted in this thread), which is "very little" to "not at all".

What are those other "significantly better" solutions you are aware of ? I've been looking for them, and found none.

> And yet I can't get a real IP address for most of the things I'd like to.

Likely because you are on a residential ISP and it's not their business (my ISP will gladly sell me one if I switch to the "business class" service, which is exactly the same except it costs about twice as much; I'd pay more to NOT have a fixed IP address).

Get an Amazon free tier and tunnel through it. Or pay $2 for a lowly VPS to tunnel through.

I don't think your wish to experiment is somehow more important than my wish for privacy. Neither of us get to actually vote (except with our wallet), though.

Re: The world in which IPv6 was a good design

#110

Post by azernik »

beagle3 wrote: post #105
azernik wrote: post #82

Earlier quoted context omitted.

Because a) statements in your comment are false, b) some proposals in your comment have already been implemented, and c) the ones that haven't are bad ideas. IPv6 has caught on (I'm commenting from an IPv6-only connection right now, on a residential US ISP). Most clients do perform RFC4941 suffix randomization. Replacing the prefix destroys one of the most useful features of IP addresses and in particular the larger…

Thank you for taking the time to explain. Let me try to word things a little better: What is the percentage of US homes who are on an IPv6? What is the percentage of websites on IPv6? What are the number of web site hits that are IPv6 to IPv6? (in the US? in the world?) The highest estimate I've ever seen for any of these is less than 20%, which - 20 years into IPv6, is in my opinion "not caught on". The mobile world…

Google puts global native IPv6 adoption among their users (i.e. proportion of incoming connections that are IPv6) at 17%-ish and exponentially/logistically increasing; the US numbers are much higher, at around 35% [https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...]. These numbers do not distinguish between mobile and fixed clients; I suspect that mobile deployment is higher than residential.

The server-side IPv6 adoption is not so great; see [http://www.delong.com/ipv6_alexa500.html] for deployment numbers. Luckily, most ISPs providing IPv6 (or at least, my personal one) provide a carrier-grade NAT64 gateway to allow access to IPv4 services from IPv6-only clients.

By web site hits, I have no idea - I don't know where to find those numbers.

IPv6 suffix randomization is enabled by default on Windows, OSX, and iOS. For Android, it probably varies (like everything else) by vendor, but my personal Android phone is using a random suffix. What are the machines you're using that aren't doing this?

Yes, suffix randomization doesn't hide which home connection you're on; but neither did old-school IPv4 + NAT. Sure, IPv6 didn't add that feature, but that's enough of a performance killer that it should be relegated to a separate system like TOR. The IPv6 prefix you are assigned by your carrier is a feature of whatever DHCPv6 setup they have; if they're assigning you the same prefix for every time you power-cycle your modem on IPv6 and they were not doing so with DHCPv4, that's super weird.

Post reply on HN