Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Software Infrastructure 2.0: A Wishlist

erikbern.com

Post reply on HN
Print view View original

191–200 of 202 posts

Re: Software Infrastructure 2.0: A Wishlist

#191

Post by jiggawatts »

znpy wrote: post #109
funcDropShadow wrote: post #93

Earlier quoted context omitted.

What do people like about NAT? I am guessing that the perceived increase in security. But perhaps there are more real or perceived advantages.

> What do people like about NAT? NAT allows people to be very dumb about networking. Either you "open a port" or you don't. It works very well as long somebody else is managing the network for you and you just ask for stuff to happen and then that somebody else has to actually make it work.

Replace the word NAT with Firewall and all security-related statements are the same.

Re: Software Infrastructure 2.0: A Wishlist

#192

Post by jiggawatts »

dx034 wrote: post #158
coddle-hark wrote: post #134

Earlier quoted context omitted.

This is what a firewall is for.

Most people use ISP provided routers at home, firewalls in those aren't necessarily great.

It would be literally the EXACT SAME firewall with IPv6 as with IPv4 NAT.

Most IPv6 routers are also IPv4 routers and behave exactly the same for both. They share the same router code, the same firewall, etc...

Re: Software Infrastructure 2.0: A Wishlist

#193

Post by jcelerier »

abraxas wrote: post #185
jcelerier wrote: post #86

I'm so happy to just develop desktop apps in C++ / Qt. I commit, I tag a release, this generates mac / windows / linux binaries, users download them, the end.

I want to live in that world again. It ended for me about 19 years ago when I left my last "desktop software" job. How do you manage to avoid "web stacks" in this day and age?

Most people still use desktop software for large projects ? Adobe stuff, music software, basically any advanced authoring software - the performance of the web platform is just not there for projects measured in dozens of gigabytes of media, hundreds of AVX2-optimized plug-ins, etc (and it's a field with a large tradition of benchmarking software between each other to find the most efficient, see e.g. dawbench)

Re: Software Infrastructure 2.0: A Wishlist

#194

Post by selfhoster11 »

js8 wrote: post #75
mikewarot wrote: post #27

Virtualization eventually will be seen as the unnecessary layer added to make up for operating systems that lack capability based security. It's going to take a decade to refactor things to remove that layer. Once done, you'll be able to safely run a process against a list of resources.

It already exists in the IBM mainframe. But nobody wants to write apps for it..

Likely because IBM mainframes are outside of the reach of hobbyists and SMEs.

Re: Software Infrastructure 2.0: A Wishlist

#195

Post by selfhoster11 »

abraxas wrote: post #185
jcelerier wrote: post #86

I'm so happy to just develop desktop apps in C++ / Qt. I commit, I tag a release, this generates mac / windows / linux binaries, users download them, the end.

I want to live in that world again. It ended for me about 19 years ago when I left my last "desktop software" job. How do you manage to avoid "web stacks" in this day and age?

I write backend code, and it's basically Java + Spring. No web technologies beyond HTTP in sight.

Re: Software Infrastructure 2.0: A Wishlist

#196

Post by mikewarot »

selfhoster11 wrote: post #194
js8 wrote: post #75

Earlier quoted context omitted.

It already exists in the IBM mainframe. But nobody wants to write apps for it..

Likely because IBM mainframes are outside of the reach of hobbyists and SMEs.

No, it's because the "capabilities" built into mainframes aren't accessible by users, only the system administrators. The granularity just isn't there.

Re: Software Infrastructure 2.0: A Wishlist

#197

Post by otabdeveloper4 »

dijit wrote: post #162
otabdeveloper4 wrote: post #159

Earlier quoted context omitted.

> the firewall instead says "do you want this port open to this device" [y/N] That's exactly what I don't want to do. I have over 20 devices in the home LAN at any given point in time; why do you want to make my life difficult for no good reason?

then don't click the "I want to open this device to incoming traffic" button? Honestly I think you don't understand what NAT is. Stateful firewalls basically work by watching your connections and then allowing the return traffic through. All firewalls are stateful, there are "stateless ACLS" in networking which are stupid and don't watch things; we're not talking about those ... in fact 99% of internet users will nev…

> Honestly I think you don't understand what NAT is.

Yes, I do. It's the "masquerade" rule in my router's firewall rules table.

> The only thing you "lose" is that your whole house looks like one device.

That's a feature, not a bug.

> You gain a significant reduction in latency, online games will work better and p2p networking (such as voip) will have significantly fewer problems

99.99999% of those problems are caused by shoddy Wi-Fi. IPv6 does nothing to fix it. (Directional antennas and a standard way to bridge L2 over Wi-Fi is the real solution; expanding the IPv4 address space does nothing.)

Again: what's the benefit of IPv6 to me? So far I only see downsides.

Re: Software Infrastructure 2.0: A Wishlist

#198

Post by otabdeveloper4 »

w7 wrote: post #171
otabdeveloper4 wrote: post #141

Earlier quoted context omitted.

Again: "you're doing it wrong" and "you're not allowed to like the NAT" are not valid criticisms. People like NAT because it's an easy batteries-included way to manage, secure and understand your LAN. Taking it away and forcing them to migrate to an incompatible zoo of firewall technologies for no benefit is asinine. > They're just sold to consumers as a single package. Exactly. How in the world is this a bad thing n…

It's less of a "you're doing it wrong" or "you're not allowed to like the NAT" and a more complex "you've incorrectly attributed your protection to NAT"

Trying to separate "NAT" from "stateful firewall" is pointless and only causes pain to the end user.

Re: Software Infrastructure 2.0: A Wishlist

#199

Post by otabdeveloper4 »

jiggawatts wrote: post #190
otabdeveloper4 wrote: post #160

Earlier quoted context omitted.

> Your home network and a cloud datacenter aren’t comparable. Of course they are. I didn't need to think about firewall automation before, and now I do. For what gain? > anyone competent Not an option for most people. Let's make networking and security things more foolproof, not less, okay?

You really are refusing to listen to what people are telling you. I have an Internet router, which uses NAT for IPv4, same as everyone else. If I want to punch a hole through for something like RDP or SSH, I have to use unique port numbers because I only have one Internet-facing IP address. Because there are only 3 billion IPv4 addresses for the whole World, all of them are regularly scanned by Bad People for open po…

Security by obscurity?

This problem is (correctly) solved by VPN.

Re: Software Infrastructure 2.0: A Wishlist

#200

Post by dijit »

otabdeveloper4 wrote: post #197
dijit wrote: post #162

Earlier quoted context omitted.

then don't click the "I want to open this device to incoming traffic" button? Honestly I think you don't understand what NAT is. Stateful firewalls basically work by watching your connections and then allowing the return traffic through. All firewalls are stateful, there are "stateless ACLS" in networking which are stupid and don't watch things; we're not talking about those ... in fact 99% of internet users will nev…

> Honestly I think you don't understand what NAT is. Yes, I do. It's the "masquerade" rule in my router's firewall rules table. > The only thing you "lose" is that your whole house looks like one device. That's a feature, not a bug. > You gain a significant reduction in latency, online games will work better and p2p networking (such as voip) will have significantly fewer problems 99.99999% of those problems are cause…

My dude. Please, I beg you, look at what NAT actually is.

You are so mistaken here I can’t help think you’re intentionally trolling us.

Post reply on HN