Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Hacker News now supports IPv6

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 396 posts

Re: Tell HN: Hacker News now supports IPv6

#171

Post by tuetuopay »

lmm wrote: post #66
Kab1r wrote: post #63

Earlier quoted context omitted.

I actually have the issue where my ISP gives me a single /64 and it makes it difficult to split between multiple LANs.

Published guidance says they're meant to give out at least a /56. I don't know that making autoallocation work on smaller subnets would help with this problem - ISPs that currently give out the smallest possible subnet would probably just switch to whatever the new smallest possible subnet was.

Some do give you one but in the most incorrect way possible. When I had fibre through Orange France, they properly allocated a /56 to my connection, but the ISP provided router only routed the first /64 from the block. The UI even proudly displayed the full /56 in all of its glory followed by a "xx/64 usable".

Oh and I ended up disabling IPv6 altogether as their router would crap itself with a modest amount of IPv6 traffic. Pulling ~10Mbps of IPv6 would completely DoS the router, as it would not even go as far as answering to ARP. Some quality hardware for sure.

Re: Tell HN: Hacker News now supports IPv6

#172

Post by Sami_Lehtinen »

dheera wrote: post #103
ceroxylon wrote: post #12

As someone who grew up on IPv4, i will miss it, but the leap to 340 undecillion unique addresses is exciting in many ways so i think i can learn to live with this transition. If we ever need more than that, i can't even imagine what that future would look like.

I grew up with IPv4 (1.2.3.4) and I was expecting IPv6 to just be 1.2.3.4.5.6 with backward compatibility so that 1.2.3.4 would just be 0.0.1.2.3.4 and the 1.2.3.4 dude wouldn't need to change their address. And the IPv8 would be 0.0.0.0.1.2.3.4 whenever we need it, but probably not for a long time When I saw all the double-colons and slashes and monstrosities like f00f:00f:::ea//dead::beef/3 I just kept using IPv4.…

Technically it's just 128 bits, it doesn't matter how you represent it. I've written this IPv4ES solution, which allows you to use 128 bit addresses using IPv4 format.

https://www.sami-lehtinen.net/blog/ipv4es-the-perfect-soluti...

Re: Tell HN: Hacker News now supports IPv6

#173

Post by mnordhoff »

p1mrx wrote: post #132
dheera wrote: post #103

Earlier quoted context omitted.

I grew up with IPv4 (1.2.3.4) and I was expecting IPv6 to just be 1.2.3.4.5.6 with backward compatibility so that 1.2.3.4 would just be 0.0.1.2.3.4 and the 1.2.3.4 dude wouldn't need to change their address. And the IPv8 would be 0.0.0.0.1.2.3.4 whenever we need it, but probably not for a long time When I saw all the double-colons and slashes and monstrosities like f00f:00f:::ea//dead::beef/3 I just kept using IPv4.…

2a09:: 2a11:: and 2409:: are even shorter than 8.8.8.8, though not quite as memorable. I'm not recommending those DNS servers, just highlighting that "vanity" IPv6 addresses exist now. It's possible that 2222:: or 3333:: could be allocated someday.

Related: https://www.sprint.net/>'s IP address was 2600:: for many years, but they sadly started using a DDoS mitigation service with different IPs.

Re: Tell HN: Hacker News now supports IPv6

#174

Post by orangeboats »

magicalhippo wrote: post #146
karlshea wrote: post #14

Earlier quoted context omitted.

You want a ULA (unique local address) instead of link-local. Link-local can sometimes mean needing to append the interface name to your address and a bunch of other weirdness. If you pick a ULA prefix and announce it (or assign some statically) everything pretty much just works. I’ve been using them internally for over a year and it’s been great, they basically feel like RFC 1918 addresses.

You'll also need a router that's not stuck in the 90's. I never got IPv6 working well until I switched from pfSense to OpenWRT, due to my residential ISP switching prefixes very frequently. For example, there was no way to get pfSense to not publish the public address of the router as the internal DNS, so every time the prefix changed internet effectively broke.

By the way, you can use a separate Linux box (if you have any) to announce your ULA and DNS using radvd. Just remember to set AdvDefaultLifetime to 0 or else your devices will attempt to route their packets to the Linux box.

It was what I did when I had a router that announced only public IPv6 prefixes to the LAN.

Re: Tell HN: Hacker News now supports IPv6

#175

Post by mort96 »

p1mrx wrote: post #69
notatoad wrote: post #54

Earlier quoted context omitted.

cool, but "read and change your data on all websites" is imho not worth the functionality. that seems ripe for takeover by some scammer.

IPvFoo author here. The problem is that there's no way to obtain the (hostname, ip) stream from Chrome/Firefox without requesting the "all websites" permission. In theory, browser vendors could define a narrowly-scoped permission that only reports (hostname, ip), or roll this functionality into the browser UI, but neither seems likely to happen. I made IPvFoo to promote IPv6 adoption, and wouldn't consider selling it…

I appreciate the honesty, and the reality is that most add-on developers have a price; a lot of people would probably sell their add-on for $10M.

But these things auto update. If a government (or even just a moderately big org) really wants to spy on someone, and they determine that said someone uses IPvFoo, $10M isn't a very large price to pay to just get complete access to the target's web browser.

This isn't specific to your add-on in any way, but, well... that seems ripe for takeover by someone nefarious.

Re: Tell HN: Hacker News now supports IPv6

#176

Post by globular-toast »

ceroxylon wrote: post #12

As someone who grew up on IPv4, i will miss it, but the leap to 340 undecillion unique addresses is exciting in many ways so i think i can learn to live with this transition. If we ever need more than that, i can't even imagine what that future would look like.

I grew up with IPv4 too but after learning and configuring my network for IPv6 I won't miss v4 at all. It's just so nice having each device with its real IP address rather than some private NAT thing. Then it's just firewall config if you want to run servers etc rather than messing with NAT configs.

Re: Tell HN: Hacker News now supports IPv6

#177

Post by mort96 »

pilif wrote: post #49
p-e-w wrote: post #31

Earlier quoted context omitted.

The last time I looked into this (which was a few years ago), ISPs were allocating blocks containing billions of IPv6 addresses to anyone who paid a nominal sum. So that vast address space might not last as long as it would seem...

One of the features of IPv6 is address autoconfiguration, obviating the need for a central authority like DHCP on v4. However, that only works with a /64 prefix and given that larger sites might want to have multiple subnets, that’s why most assignments are /56 or /48. But still. If all assignments were /48s, that would still leave room for 281 trillion networks which even I believe is enough for the foreseeable futu…

I don't understand why getting rid of DHCP is desirable. DHCP provides a nice central place where you can map MAC addresses to IP addresses instead of configuring it ad-hoc on every device which needs a static IP address (if you're lucky and the device even supports static IP!). Checking "Does my interface have an IP address?" is also a really really useful and quick analogue for "is the gear related to the LAN pretty much working or is something broken/misconfigured?".

As it is, all my interfaces just have these random IPv6 addresses configured which don't work most of the time. I don't get it.

Re: Tell HN: Hacker News now supports IPv6

#178

Post by orangeboats »

whatwhaaaaat wrote: post #89
Dwedit wrote: post #32

Earlier quoted context omitted.

Advantage: Not out of addresses.

We’ve been “running out of ipv4 space” since before i got a freakin us robotics modem.

When we initially ran out of IPv4 addresses, the effects aren't immediately felt since there was an inertia.

But nowadays the effect is more than visible (especially in my region, Asia-Pacific), with more and more ISPs putting their customers behind a CGNAT. Let me write a parody of one of the classics:

First, they put cellular users behind CGNAT, which is fine because mobile phones don't host services.

Then, they came for residential users on cheaper plans, which is fine because they are not powerusers and so are unlikely to host services.

After that, they put all residential users behind a CGNAT.

...

It is actually what I experienced throughout the last decade in Southeast Asia. Are the ISPs here doing this because they are being cheapskates? No. It's because we are genuinely running out of IPv4 resources forcing people to share them. We did not have the luxury of Western ISPs who were assigned millions of addresses, and buying the addresses is a costly endeavor nowadays with /16 IPv4 block literally costing millions today.

And if you think CGNAT is good, think again: (quoting one of my previous comments)

[...] you can't really build a truly-P2P network nor self-host a service on Internet when everyone is behind CGNAT. At some point, as IPv4 resources get scarcer, only corporates will have the ability to host services on the Internet, and I don't think it is in their interests to host Tor nodes, for example...

Re: Tell HN: Hacker News now supports IPv6

#179

Post by OJFord »

mort96 wrote: post #175
p1mrx wrote: post #69

Earlier quoted context omitted.

IPvFoo author here. The problem is that there's no way to obtain the (hostname, ip) stream from Chrome/Firefox without requesting the "all websites" permission. In theory, browser vendors could define a narrowly-scoped permission that only reports (hostname, ip), or roll this functionality into the browser UI, but neither seems likely to happen. I made IPvFoo to promote IPv6 adoption, and wouldn't consider selling it…

I appreciate the honesty, and the reality is that most add-on developers have a price; a lot of people would probably sell their add-on for $10M. But these things auto update. If a government (or even just a moderately big org) really wants to spy on someone, and they determine that said someone uses IPvFoo, $10M isn't a very large price to pay to just get complete access to the target's web browser. This isn't speci…

If your threat model includes a government...

Re: Tell HN: Hacker News now supports IPv6

#180

Post by tlb »

ale42 wrote: post #158
mike_d wrote: post #136

Earlier quoted context omitted.

> they were a deliberate choice so that computers doing string processing could never confuse the two types of addresses. Wait until you try to write an IPv6 address with a port number in standard notation.

Usually IPv6 addresses are enclosed in square brackets when a port number is involved. But it's true that in many configuration files IPv6s are a nightmare to put in, especially because you never remember what syntax you have to use: sometimes you even have to duplicate semicolons (that's what Exim does...). But I think this is rather a convention problem for the config files, rather a problem of IPv6 addresses thems…

The IPv6 people must have known that : was a common way to separate IPv4 and port numbers. IPv6 was standardized 4 years after the URL format which used a colon to denote a port number.
Post reply on HN