I spent a week without IPv4 to understand IPv6 transition mechanisms

> nobody can infer anything about your network

They can infer that one IPV6 address matches to exactly one device. (reverse is not true, one device may have multiple addresses per privacy extensions)

Once device is identified all its past traffic is discernible.

Changing addresses means identification needs to be done again but once done it can be associated with past addresses and again, all its history is visible.

Identification might just mean querying a data broker with HTTP headers.

NAT does not have this issue.

> The source address for external connections is effectively randomized

It's still unique to one device right?, even if random my argument still holds.

Or do you mean to say multiple devices can use the same address?

note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would routing work).

This is what I structured my inital argument on. Do you see any fallacy in logic?

It is unfortunate that businesses are behind in rolling out IPv6. I get the impression that IPv6-only is more doable and has more advantages for business. It is feasible to run NAT64 in business cause don't have to support as much old software like games that people want to play. It helps with internal addressing issues which get complicated in big companies with acquisitions. Finally, it adds a security barrier between IPv4 for external and IPv6 for internal.

But upgrading a working network is lots of trouble. Most existing businesses have plenty of public IPv4 addresses and don't have to conserve.

> Unconfigured/not activated firewalls usually fail reachable

Local firewalls on devices, maybe, but network firewalls generally are default-deny on untrusted interfaces, and between 0 and 1 interfaces are trusted by default.

Back in 2007 Apple's Airport Extreme Base Station shipped with a firmware that defaulted to allowing all IPv6 traffic, which was quickly pointed out in the tech media and fixed in a patch a few months later. A few of the garbage pile combo modem/router devices distributed by ISPs have had similar issues over the years as well. That's not normal behavior though, when it's observed it's rightfully considered a security flaw and tends to get the kind of attention vendors don't want.

If you know of a mainstream device that would "fail reachable" as you claim here, name and shame please.

> without explicit port forwarding or exposed hosts, NATs fail unreachable.

I work in VoIP and can say from plenty of direct experience this is not true. In the modern work from home era I've had to deal with a lot of the aforementioned garbage pile consumer devices and a recurring issue with some of our clients who had older phones is that their users' home routers did the laziest NAT possible and literally just opened a two way hole on port 5060 (SIP) so as long as the phone was communicating with our server and keeping the pinhole open *ANY* other traffic that hit port 5060 was also sent to the phone, which meant they got all kinds of "phantom calls" from bots looking for unprotected SIP relays.

Newer phones generally have an option to only accept SIP messages from trusted servers, but older ones sometimes don't so when combined with badly implemented NAT that happens.

And yea, obviously that's a consequence of a particularly bad NAT implementation, but your complaint is about an issue that would only occur in a particularly bad IPv6 implementation.