Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

151–160 of 198 posts

Re: New patches allow building Linux IPv6-only

#151

Post by throw0101c »

graemep wrote: post #127
ronsor wrote: post #125

Earlier quoted context omitted.

> The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID. So the same as the public IPv4 on a traditional home NAT setup?

Most home users do not have a static public IPv4 address - they have a single address that changes over time.

> Most home users do not have a static public IPv4 address - they have a single address that changes over time.

I'd be curious to know the statistics on this: I would hazard to guess that for most ISPs, if your router/modem does not reboot, your IPv4 address (and IPv6 prefix) will not change.

Re: New patches allow building Linux IPv6-only

#152

Post by throw0101c »

UltraSane wrote: post #67
iamnothere wrote: post #47

Earlier quoted context omitted.

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

You can have IPv6 firewalls emulate the behavior of NAT so it blocks unsolicited inbound traffic while allowing outbound traffic. If you get a /48 form your ISP you could rotate to a new IP address every second for the rest of your life.

> You can have IPv6 firewalls emulate the behavior of NAT so it blocks unsolicited inbound traffic while allowing outbound traffic.

Are there any (consumer?) firewalls that do not do this? I know Asus do this (and have for years).

AIUI most 'enterprise' firewalls have a default deny shipped from the factory and you have to actively allow stuff.

Re: New patches allow building Linux IPv6-only

#153

Post by icedchai »

craftkiller wrote: post #76
iamnothere wrote: post #47

Earlier quoted context omitted.

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there…

Most public wifi has client isolation enabled for this reason. Firewall or not, you can't communicate with other clients.

Re: New patches allow building Linux IPv6-only

#154

Post by traderj0e »

apitman wrote: post #49
rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

As sad as it makes me to admit, I don't think IPv6 is ever going to happen without government intervention. Adoption is flat at under 50% over the past year. IPv6 doesn't benefit big tech. SNI routing and NAT work pretty well for centralized platforms. AWS will gladly rent us IPv4 addresses until the end of time.

Another way to do ipv6 without government intervention is to make it 1. actually what people want, just v4 with more bits 2. have a reasonable migration path from v4. They made something overcomplicated that disregards all existing users, and now they act like this was the only possible way to avoid address exhaustion and it's everyone's obligation to switch. Even if the govt successfully forced v6, it'd be a downgrade.

Re: New patches allow building Linux IPv6-only

#155

Post by traderj0e »

miyuru wrote: post #32
sidewndr46 wrote: post #28

Earlier quoted context omitted.

Why, so you can inflict some personal pain on people without IPv6 access?

I am running IPv6 only servers, and I think it's fair that v4 only people feel the same pain some time in the future.

IPv6: only better than v4 if you kneecap v4, even then maybe not

Re: New patches allow building Linux IPv6-only

#156

Post by [deleted] »

gear54rus wrote: post #6
petcat wrote: post #4

It will be a neat experiment, but I think most software will break and will remain broken indefinitely and then people will turn to LLMs to try to automate fixing all of it and that will turn into a mess just due to the sheer amount of changes required with little scrutiny.

Perhaps it's time to submit patches that allow building it without IPv6 instead. Countless hours of configuration meddling will be saved.

[deleted]

Re: New patches allow building Linux IPv6-only

#157

Post by Marsymars »

zadikian wrote: post #135
Marsymars wrote: post #99

Earlier quoted context omitted.

> Suddenly, your smart lightbulb is accessible by everyone. Not a great idea. The answer here is kinda that Wi-Fi isn't an appropriate networking protocol for lightbulbs (or most other devices that aren't high-bandwidth) in the first place. Smart devices that aren't high bandwidth (i.e. basically anything other than cameras) and that don't need to be internet accessible outside of a smart home controller should be us…

Silliness of smart bulbs aside, I would hope the answer is how ipv6 is actually safe for this, not that you should just not use wifi.

Well Thread uses ipv6 in a safe way for this, nobody ever complains about how they wish their Thread network only used ipv4. :)

Re: New patches allow building Linux IPv6-only

#158

Post by traderj0e »

iamnothere wrote: post #42

This may be a “joke”, but it’s disturbing to see people clamoring to deny others their freedom in a FOSS context. Want to use IPv6? Fine. But don’t try to remove v4 support from people who have built stable networks around it. You won’t be able to force the world to switch to IPv6 with tricks like this, any more than you can force old industrial machines to stop using ancient 486es as controllers. There is a lot of o…

v6 was meant to succeed v4, not work alongside it. https://datatracker.ietf.org/doc/html/rfc8200#section-1

Re: New patches allow building Linux IPv6-only

#159

Post by throw0101c »

everdrive wrote: post #52
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> hollowing can crash the target process if the payload isn't carefully matched to the host process architecture. So here's the thing. My ISP does _not_ rotate my IPv4 address, but _does_ rotate IPv6. Why? I'll never know. Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this.

> Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this.

"No one"; LOL. I've participated in entire sub-threads on HN with people insisting that NAT = security. I've cited well-regarded network educators/commentators and vendors:

* https://blog.ipspace.net/2011/12/is-nat-security-feature/

* https://www.f5.com/resources/white-papers/the-myth-of-networ...

Re: New patches allow building Linux IPv6-only

#160

Post by vel0city »

zadikian wrote: post #139
guntars wrote: post #131

Earlier quoted context omitted.

Well I mean “those guys” did a good job and the network administrator might need to do some debugging.

I never have to debug why my dhcp server isn't handing out ipv4 addresses or deal with conflicts, but if I did, it'd break mdns too. mdns is an extra moving part to deal with.

I've had numerous issues with dhcp servers over the years and clients not understanding their responses. Acting like they never have issues is just burying your head in the sand. mDNS often works just fine on most common OSes, if you don't explicitly block them.
Post reply on HN