Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

161–170 of 198 posts

Re: New patches allow building Linux IPv6-only

#161

Post by throw0101c »

ErroneousBosh wrote: post #83
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? What would be the advantage in it?

>> Why don't you want every device to have a public IP?

> What would be the advantage in it?

Not having to deal with ICE/TURN/STUN. Being able to develop P2P applications without having to build out that infrastructure (anyone remember Skype's "supernodes"?).

Re: New patches allow building Linux IPv6-only

#162

Post by throw0101c »

cyberax wrote: post #90
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? Suddenly, your smart lightbulb is accessible by everyone. Not a great idea. > With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers. There is no guarantee with IPv6 that hole punching works. It _usually_…

>> Why don't you want every device to have a public IP?

> Suddenly, your smart lightbulb is accessible by everyone. Not a great idea.

Why would it be "accessible by everyone"? My last ISP had IPv6 and my Asus (with the vendor firmware) didn't allow it. My printer automatically picked up an IPV6 address via SLACC and it was not "accessible by everyone" (I tried connecting to it externally).

Re: New patches allow building Linux IPv6-only

#163

Post by knorker »

iso1631 wrote: post #110
knorker wrote: post #38

Earlier quoted context omitted.

So run fc00::/7 addresses with IPv6 NAT. That addresses all of your concerns, and you have that option.

Sure you can do that So what's the point in ipv6?

I mean, so many reasons. Not the least of which is carrier grade NAT is out. And that alone implies so much cost savings, performance increase, and home user flexibility .

I'm struggling to assume good faith on your question, since it's so strange. I feel like I need to start from scratch explaining the internet, since asking this question reveals a lack of knowledge about everything networking.

Re: New patches allow building Linux IPv6-only

#164

Post by aeonik »

throw0101c wrote: post #159
everdrive wrote: post #52

Earlier quoted context omitted.

> hollowing can crash the target process if the payload isn't carefully matched to the host process architecture. So here's the thing. My ISP does _not_ rotate my IPv4 address, but _does_ rotate IPv6. Why? I'll never know. Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this.

> Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this. "No one"; LOL. I've participated in entire sub-threads on HN with people insisting that NAT = security. I've cited well-regarded network educators/commentators and vendors: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ * https://www.f5.com/resources/white-papers/the-myth-of-networ...

That article is making a narrower claim than you're implying. It argues that NAT is not a security mechanism by design and that some forms of NAT provide no protection, which is true.

It also explicitly acknowledges that NAT has side effects that resemble security mechanisms.

In typical deployments, those side effects mean internal hosts are not directly addressable from the public internet unless a mapping already exists. That reduces externally reachable attack surface.

So, the disagreement here is mostly semantic. NAT is not a security control in the design sense, but it does have security-relevant effects in practice.

I personally do consider NAT as part of a security strategy. It's sometimes nice to have.

Re: New patches allow building Linux IPv6-only

#165

Post by guntars »

zadikian wrote: post #139
guntars wrote: post #131

Earlier quoted context omitted.

Well I mean “those guys” did a good job and the network administrator might need to do some debugging.

I never have to debug why my dhcp server isn't handing out ipv4 addresses or deal with conflicts, but if I did, it'd break mdns too. mdns is an extra moving part to deal with.

By debugging I mean just checking if you have not blocked broadcast packets at the firewall or some similar misconfiguration. I doubt it’s actual bugs when it doesn’t work. On your second point, it’s actually more resilient than DHCP because it works with IPv6 too.

Re: New patches allow building Linux IPv6-only

#166

Post by IshKebab »

guntars wrote: post #131
IshKebab wrote: post #129

Earlier quoted context omitted.

I didn't write any mDNS software. Blame those guys.

Well I mean “those guys” did a good job and the network administrator might need to do some debugging.

What network administrator?

Re: New patches allow building Linux IPv6-only

#167

Post by jrm4 »

password4321 wrote: post #146
jrm4 wrote: post #77

Earlier quoted context omitted.

[flagged]

> ALL THE HEAVY LIFTING THERE > MUCH MORE IMPORTANT I haven't done the exhaustive research but props in advance for being the only person shouting in caps on HN. Definitely one way to proclaim one's not AI-ness without forced spelling errors.

Didn't even think about that. Interesting.

Re: New patches allow building Linux IPv6-only

#168

Post by Guvante »

bombcar wrote: post #102
craftkiller wrote: post #78

Earlier quoted context omitted.

Privacy extensions are enabled by default on OSX, windows, android, and iOS: https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapt... On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)

They are now - I'm not sure when they implemented them but I know Windows at least would do some really stupid stuff very early on.

Aren't we talking about now?

No one is saying we should have activated IPv6 in its first iteration.

Re: New patches allow building Linux IPv6-only

#169

Post by Dagger2 »

traderj0e wrote: post #154
apitman wrote: post #49

Earlier quoted context omitted.

As sad as it makes me to admit, I don't think IPv6 is ever going to happen without government intervention. Adoption is flat at under 50% over the past year. IPv6 doesn't benefit big tech. SNI routing and NAT work pretty well for centralized platforms. AWS will gladly rent us IPv4 addresses until the end of time.

Another way to do ipv6 without government intervention is to make it 1. actually what people want, just v4 with more bits 2. have a reasonable migration path from v4. They made something overcomplicated that disregards all existing users, and now they act like this was the only possible way to avoid address exhaustion and it's everyone's obligation to switch. Even if the govt successfully forced v6, it'd be a downgra…

v6 mostly is just v4 with more bits, and it has a reasonable migration path from v4 too. I don't think a more reasonable migration path is even possible given the constraints of v4.

About the only thing new in v6 that's not already in v4 is SLAAC, which isn't very complicated. Routing works the same, the addresses work the same, DNS, TCP, firewalling etc all work the same. If anything they removed complexity by dropping broadcast and making NAT unnecessary.

People just have some very weird misconceptions about v6, and will frequently argue that e.g. it was badly designed for not doing a thing that it does actually do, or for not doing something impossible.

Re: New patches allow building Linux IPv6-only

#170

Post by Dagger2 »

aeonik wrote: post #164
throw0101c wrote: post #159

Earlier quoted context omitted.

> Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this. "No one"; LOL. I've participated in entire sub-threads on HN with people insisting that NAT = security. I've cited well-regarded network educators/commentators and vendors: * https://blog.ipspace.net/2011/12/is-nat-security-feature/ * https://www.f5.com/resources/white-papers/the-myth-of-networ...

That article is making a narrower claim than you're implying. It argues that NAT is not a security mechanism by design and that some forms of NAT provide no protection, which is true. It also explicitly acknowledges that NAT has side effects that resemble security mechanisms. In typical deployments, those side effects mean internal hosts are not directly addressable from the public internet unless a mapping already e…

Both of those articles are actually wrong. They say "if an unknown packet arrives from the outside interface, it’s dropped" and "While it is true that stateful ingress IPv4 NAT will reject externally initiated TCP traffic" respectively, but this is in fact not true for NAT, which you can see for yourself just by testing it. (It's true for a firewall, but not for NAT.)

The biggest security-relevant effects of NAT are negative. It makes people think they're protected when they aren't, and when used with port forwarding rules it reduces the search space needed to find accessible servers.

I agree it can be a useful tool in your toolbox sometimes, but a security tool it is not.

Post reply on HN