AWS Customers Cannot Escape IPv4 • Hacker News Board

Re: AWS Customers Cannot Escape IPv4

#171

Post by hughw » Fri, Sep 22, 2023, 5:20 PM UTC

dopylitty wrote: post #81

As an AWS customer I want to escape IP entirely. It's a waste of time managing these complex networking systems with their archaic protocols (IP, BGP, DNS, etc) Just let me strongly associate identities with my workloads and apply policy indicating which workloads should be able to send data with which other workloads. How data gets from one workload to another should not even be my concern, just make it happen.

Like Heroku? (disclaimer, haven't used Heroku in years, no idea what the state of it is now).

Re: AWS Customers Cannot Escape IPv4

#172

Post by Dwedit » Fri, Sep 22, 2023, 5:20 PM UTC

mabbo wrote: post #104

Many years ago when I was a junior dev at Amazon, there was a massive project internally to split up every internal system into regional versions with limited gateways allowing calls between regions. The reason? We had run out of internal IPv4 addresses. The Principal PM in charge of the "regionalization" effort was asked in a Q&A "why didn't we just switch to IPv6?". Her answer was something along the lines of "The…

Out of IP addresses? Just use NAT.

Re: AWS Customers Cannot Escape IPv4

#173

Post by whoknew1122 » Fri, Sep 22, 2023, 5:20 PM UTC

rekoil wrote: post #166

discodave wrote: post #137

Earlier quoted context omitted.

From memory, the regionalization project ran from approx 2014 to 2015 or 2016. There were also other reasons given, like the amount of internal software that used e.g. IPv4 addresses. Also, AWS likes to have 'lots of small things' instead of one big thing (regions, AZs, cells, two pizza teams, no (official) monorepo) so regionalization was part of that. Another big reason for regionalization, other than IPv4 exhausti…

Tell me more about these "pizza teams".

The idea is internal teams should be no bigger than what can be fed by 2 pizzas.

Re: AWS Customers Cannot Escape IPv4

#174

Post by SoftTalker » Fri, Sep 22, 2023, 5:23 PM UTC

LinuxBender wrote: post #158

talent_deprived wrote: post #153

Earlier quoted context omitted.

The biggest issue is IPv6 is a privacy, wide open wild west, there is no privacy on IPv6. Every device's IP is literally public, on the public Internet, 24/7. All so called privacy extensions or improvements do not change the lack of privacy of IPv6 and one more thing, the address structure sucks.

FWIW this does not have to be true for companies that do not wish to expose internal nodes. I'm not even talking about the privacy extensions . I realize that people beat the drums that one must not NAT IPv6 but it can absolutely be a NAT just like IPv4. I would actually expect in most companies that they don't even add IPv6 inside their datacenters, rather they just put a block of IPv6 addresses on some load balance…

> In the early days of IPv4 many big companies did not NAT IPv4. I was at a company that did this. Our workstations all had routable public IPv4 addresses.

A lot of big universities did this and even still do this to a large degree. They got huge IPv4 allocations early and there was no scarcity.

Re: AWS Customers Cannot Escape IPv4

#175

Post by paulddraper » Fri, Sep 22, 2023, 5:25 PM UTC

bushbaba wrote: post #41

fulafel wrote: post #4

It seems obviously against AWS incentives to offer working v6 - all their influencing tools ("well architected" criteria, certificates) strongly herd you towards building mazes of ambigously addressed 10.x RFC1918 networks, and not internet style architectures with end-to-end addressing. In the world of their recommendations, even the concept of a "public ip address" is a red flag, and AWS even recommends (for an add…

Maybe just maybe. Customers don’t really want IPv6 but are forced onto it. Ipv6 is not human usable and gets rid of a bunch of network design norms.

Humans don't use IP.

Computers do.

Re: AWS Customers Cannot Escape IPv4

#176

Post by chandlerswift » Fri, Sep 22, 2023, 5:26 PM UTC

michaelteter wrote: post #160

Sorry for the aside, but I hope the neveragain.de author will make a blog post about their site theme. I _really_ like it, and of course I would like to mostly copy it for my own personal site. That said, until the cost of IPv4 becomes really huge, few organizations are going to suffer the effort-cost of embracing IPv6. I would argue that the IPv6 sales story is unmemorable|unclear|weak. Also, it is arguable that mos…

Looks like the theme might be a lightly modified version of the GitHub Pages Hacker theme[0]?

[0]: https://github.com/pages-themes/hacker

Re: AWS Customers Cannot Escape IPv4

#177

Post by paulddraper » Fri, Sep 22, 2023, 5:26 PM UTC

dopylitty wrote: post #81

As an AWS customer I want to escape IP entirely. It's a waste of time managing these complex networking systems with their archaic protocols (IP, BGP, DNS, etc) Just let me strongly associate identities with my workloads and apply policy indicating which workloads should be able to send data with which other workloads. How data gets from one workload to another should not even be my concern, just make it happen.

Uh, you want the Internet without Internet Protocol?

Re: AWS Customers Cannot Escape IPv4

#178

Post by pnpnp » Fri, Sep 22, 2023, 5:26 PM UTC

mike_d wrote: post #22

pnpnp wrote: post #2

AWS has a way to go with their IPV6 services, but IPV6-only is very doable right now in EC2. I have a WireGuard server that was dual-stack. I turned off IPV4 to see what would happen, and it kept chugging along very nicely.

...if you are running one service and not really using AWS in any meaningful way other than as a VPS provider.

You’re not wrong, that’s why I prefaced it saying their services are lacking. I was just pleasantly surprised that EC2 supports it.

Re: AWS Customers Cannot Escape IPv4

#179

Post by talent_deprived » Fri, Sep 22, 2023, 5:27 PM UTC

LinuxBender wrote: post #158

talent_deprived wrote: post #153

Earlier quoted context omitted.

The biggest issue is IPv6 is a privacy, wide open wild west, there is no privacy on IPv6. Every device's IP is literally public, on the public Internet, 24/7. All so called privacy extensions or improvements do not change the lack of privacy of IPv6 and one more thing, the address structure sucks.

FWIW this does not have to be true for companies that do not wish to expose internal nodes. I'm not even talking about the privacy extensions . I realize that people beat the drums that one must not NAT IPv6 but it can absolutely be a NAT just like IPv4. I would actually expect in most companies that they don't even add IPv6 inside their datacenters, rather they just put a block of IPv6 addresses on some load balance…

I remember the days of non-NAT IPv4, though I'd forgotten until you mentioned it. I'd be OK with NAT IPv6, though the addresses are still ugly and difficult to reason about.

Re: AWS Customers Cannot Escape IPv4

#180

Post by paulddraper » Fri, Sep 22, 2023, 5:27 PM UTC

chungy wrote: post #10

mjevans wrote: post #3

It would really help if there were real ISP competition in the USA. There's only one actually broadband ISP provider where I rent, which is in the suburbs near Seattle. It's NOT a rural area by any definition, and yet Comcast is my only option. Their price and service reflect that reality...

> yet Comcast is my only option. Thank endless lobbying that make legally mandated monopolies a thing in this arena. They did it with phone companies too. It's not "just Comcast" by happenstance. It's "just Comcast" by legal regulation.

AFAIK, most areas in the U.S. have wireless ISPs available.