Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Customers Cannot Escape IPv4

tty.neveragain.de

Post reply on HN
Print view View original

191–200 of 316 posts

Re: AWS Customers Cannot Escape IPv4

#191

Post by NovemberWhiskey »

jiggawatts wrote: post #53
rewmie wrote: post #38

Earlier quoted context omitted.

I think your comment shows a high dose of ignorance and complete lack of research on the topic. The whole point of private link is to not route traffic over the internet, and instead flow traffic between private networks through private pipes. One of the primary usecases and design requirements for this service is regulatory compliance. They say right on the tin that the service is designed to send traffic over priva…

If you think that either Azure or AWS loop terabits of customer traffic between two of their own services "out to the Internet" and back just because the IPv4 octets don't start with a "10", then you're the one who's missing the big picture.

I am at a total loss to understand the link between this post and the prior one - can you explain?

Re: AWS Customers Cannot Escape IPv4

#192

Post by WorldMaker »

jiggawatts wrote: post #66
eddythompson80 wrote: post #39

Earlier quoted context omitted.

What a shit show. Seriously I can never rant enough about how awful Azure networking and their bullshit concepts is. Like they don’t know how to do networking, so they’re gonna introduce a bunch of shit and pretend that nonesense makes perfect sense because of their own ineptitude.

Most of the complexity is a side-effect of having to do IPv4 far past the scale where the ~17 million private addresses might be sufficient.

Some of the complexity seems to be the security theater of the lowest common denominator of customer demands. Companies invest too much money into incredibly expensive Palo Alto firewalls then demand Azure route through those too so that their cloud operations are as theatrically "secure" as their main network because look at all those amazing sunk costs invested in it.

Re: AWS Customers Cannot Escape IPv4

#193

Post by apparentorder »

chandlerswift wrote: post #176
michaelteter wrote: post #160

Sorry for the aside, but I hope the neveragain.de author will make a blog post about their site theme. I _really_ like it, and of course I would like to mostly copy it for my own personal site. That said, until the cost of IPv4 becomes really huge, few organizations are going to suffer the effort-cost of embracing IPv6. I would argue that the IPv6 sales story is unmemorable|unclear|weak. Also, it is arguable that mos…

Looks like the theme might be a lightly modified version of the GitHub Pages Hacker theme[0]? [0]: https://github.com/pages-themes/hacker

It's a Jekyll theme, https://news.ycombinator.com/item?id=37609543

Re: AWS Customers Cannot Escape IPv4

#195

Post by Dylan16807 »

forty wrote: post #184
Varriount wrote: post #102

Earlier quoted context omitted.

Why? What's the (supposed) fear?

I have a reason: we do per IP rate limiting. It's easy enough for IPv4 when the number of IPs is necessarily not too big to fit in a small redis for example, but for IPv6 everyone have at least a /64. I'm curious how people do it btw, if you have tips to share, I'm all hear. Do you simply rate limit IP ranges? Even limiting per /64, it's still potentially quite a lot of /64 to track.

When a bunch of households or cell phones are on the same IPv4 do you have any measures to compensate?

> Do you simply rate limit IP ranges? Even limiting per /64, it's still potentially quite a lot of /64 to track.

Yes you'd limit by /64 or slightly larger.

The live set of IPs shouldn't be very big.

Re: AWS Customers Cannot Escape IPv4

#196

Post by WorldMaker »

bushbaba wrote: post #41
fulafel wrote: post #4

It seems obviously against AWS incentives to offer working v6 - all their influencing tools ("well architected" criteria, certificates) strongly herd you towards building mazes of ambigously addressed 10.x RFC1918 networks, and not internet style architectures with end-to-end addressing. In the world of their recommendations, even the concept of a "public ip address" is a red flag, and AWS even recommends (for an add…

Maybe just maybe. Customers don’t really want IPv6 but are forced onto it. Ipv6 is not human usable and gets rid of a bunch of network design norms.

Some of these "not human usable" complaints about typing/memorizing/pattern matching IPv6 addresses remind me of how long the distributed version control industry struggled with content-addressed storage and how "human usable" it was or was not. As the legends go Monotone spent years of engineering and lots of complicated code trying to build nice human usable sequence numbers in a distributed fashion, and then git just said "do the simple, stupid thing: show the (prefix of the) hash, people will adapt" and people did.

IPv6 doesn't seem "human usable" sometimes in large part because you aren't actually using it. People adapt. The human skills in pattern matching are robust: there are new tricks to learn, but there were always tricks to learn. (IPv4 addresses aren't "human usable" either if you sit down to truly assess absolutely how many RFCs are involved to build the patterns "everyone" has internalized that seem "easy". They are easy because they are familiar, because you use them often, because you've already adapted to them.)

Re: AWS Customers Cannot Escape IPv4

#198

Post by p1mrx »

mannyv wrote: post #168

One major weirdness with ipv6 is that it occasionally works with ipv4 and it's unclear why. Example: we run a bunch of endpoints on ipv4, but get ipv6 IPs in our logs. How? Are there 6-to-4 translators out there at ISP edges? Unknowns in networking are bad.

It's impossible for an IPv4 endpoint to accept an IPv6 connection. Perhaps you have a dual-stack CDN with an unpublished IPv6 address that some users have found? Or your service is accepting third-party 'Forwarded' headers, which would allow HTTP clients to spoof their IP address.

Re: AWS Customers Cannot Escape IPv4

#199

Post by kaliszad »

jjoonathan wrote: post #136
aranchelk wrote: post #133

Earlier quoted context omitted.

Can you remember what year it was? I’ve got a slight suspicion you were given some bullshit or at least a creative treatment of facts e.g. everything had IPv6 support but FUD-filled network engineers didn’t want to turn it on. Most network devices I’ve encountered were dual-stack way before anyone I knew seemed to care about actually using IPv6 — I always assumed it was added for US government/military requirements.

Sure, everything supports IPv6 -- until you turn it on and rediscover the tickets that have been sitting at the bottom of the JIRA for the last decade.

As a matter of fact Ron Broersma who affiliated with Space and Naval Warfare Systems Command (SPAWAR) has a list of equipment that should be fully IPv6-only compliant including various management interfaces and more. The US Navy supposedly tests this in house in a IPv6-only network. 4 years later I imagine the situation only got better https://www.youtube.com/watch?v=9kQje5gSWw8

Also, AWS now have the majority of NICs and switches built in-house I imagine. The underlay network could be IPv6 or totally custom for what we know (but probably is IPv4).

Post reply on HN