Live data from Hacker News

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

washingtonpost.com

201–210 of 257 posts

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#201

Earlier quoted context omitted.

Great point and totally off-topic, but I wonder if there is someone who reads the NY Times each and everyday in full.

When you go to an all-you-can-eat buffet, do you eat all you can, or just until you are full?

Does your brain get full and have to empty itself before you can read more?

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#202
post #36

Earlier quoted context omitted.

I've tried subscribing to a few news sources, including WaPo, but I can't handle the political agendas (right, left, or any of it). I've had better luck with subscription based aggregators, but nothing exciting enough to want to plug one in particular. Always looking for new options to try.

I think the key question isn't which political agenda they have, but whether they report facts or opinions. In that regard, WaPo is pretty good but you can still do better: https://www.adfontesmedia.com/static-mbc/

The reasoning of which was widely derided when Kellyanne Conway offered alternative facts to explain a situation. People don't want to hear reasoning, they want to be angry.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#203

Earlier quoted context omitted.

And furthermore, public sentiment (and therefore elections) are decided by what the main sources of media determine is the most important news. Example: Cops have shot a thousand people a year for several years in a row (maybe a decade). About 300 of those each year have been black, which is a disproportionate amount by some measures. However, it is nowhere near the biggest problem in our country even for black peopl…

I agree with some of your post but I also think that reducing it to body count is sidestepping just how differently police treat black communities. Cops have done horrible things to every race, they are especially aggressive with black people.

Do they though? Or is it that those communities are more likely to harbor individuals that commit crimes that warrant police presence?

Notice that I’m talking about the behavior of individuals in those communities and not the communities themselves.

Take the Daunte Wright incident. No he shouldn’t have been shot but he did exhibit behavior that reasonably merited police attention (unlicensed weapons, outstanding warrant for failure to appear, Facebook photos of himself brandishing weapons and large wads of cash typical of a gang member). Furthermore, how much have friends and family provided social pressure for him not to do such things? Either a community polices itself or it lets things reach the point where things rise to the level that attract a police presence.

https://ucr.fbi.gov/crime-in-the-u.s/2018/crime-in-the-u.s.-...

Not saying the police can’t do better. They certainly can, but they are largely in these communities trying to protect a community that is largely made up of law abiding black people from a small number of criminals victimizing that community.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#204

Earlier quoted context omitted.

why?

Its incompatible with IP v4, has a stupid addressing scheme, it requires new router hardware and software for isps to buy and nobody is using it because of all the aforementioned issues.

You forgot, they're nowhere as easy to remember as v4. If you're used to remembering phone numbers; important v4 IP's aren't that hard to mentally internalize.

Screw DNS. Screw the recommendation to stay away from IP's. If it's important enough to be on the network, it's important enough to have a static IP.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#205
post #183

Earlier quoted context omitted.

why?

Because ipv6 is hard and NAT works well enough.

IPv6 on an internal network is trivial. It is supported by both Windows and MacOS (and Linux) out of the box.

If your ISP doesn't provide it, get one that does. They should allocate you a /56 by default per connection, if not something larger like a /48 if you have multiple locations.

Subnet the /48 for each connection, subnet each /56 into /64 subnets. reserve one of the /56's for site-to-site if needed.

Done.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#206

Earlier quoted context omitted.

why?

Its incompatible with IP v4, has a stupid addressing scheme, it requires new router hardware and software for isps to buy and nobody is using it because of all the aforementioned issues.

You're being downvoted, but, last 3 ISP's I used didn't support ipv6. First one didn't support ipv6 at all, second supported it, but was incompatible with my router. And I didn't care about it after that. Hardware incompatibility is a huge roadblock for ipv6.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#207

Earlier quoted context omitted.

or maybe ask the question regarding why we're not all running ipv6.

why?

Because even equipment that claim IPv6 often doesn’t. We have seen both software and hardware which “supported” IPv6 for 5 - 10 year, but we’re the first to use it in production and the manufacturer haven’t tested it since the initial implementation.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#208
post #103

Earlier quoted context omitted.

In our case, we were setting up VPN tunnels to a partner, who for some reason required that the addresses on our side should (appear to be) public IP addresses. So we couldn't use 10/8 or 192.168/16 in (that part of) our network. They didn't actually need the addresses to be routable from the public internet (that was the whole point of the VPN). I think the requirement was really a way of making sure they were uniqu…

There's also 172.16/12 :) But yeah I agree. If you're running a VPN for a large company it's kinda hard to avoid such conflicts. In my work we use 10.0.0.0/8 but of course some people use the same at home even though 192.168/16 is way more common. In general I find 172.16/12 the least common in the field.

I like the 172.12/16 to company network, especially small companies with limited support resources. Getting employees on VPN is much simpler as virtually no home routers use that range.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#209
post #161

Earlier quoted context omitted.

I suspect there are a decent number of network engineers who think it's funny to use DoD IPs for their internal network, especially given what their logging system will probably tell them by default. If you drive around with a WiFi stumbler running, you'll run into networks with names like "UTAH DATA CENTER" and "SIPRnet", etc for the same reason.

The main reason (I've done this at a bank previously) is when you need to ensure you don't overlap with other internal IP (RFC1918 was represented everywhere and routeable internally) and when you're trying to dodge 99% of your engineer's default Docker configs to reduce support request load. In that case there's never any chance it'll be needed by people using the public internet there, and never any chance it'll be…

Default Docker configs are atrocious. Most devs/devops don't even know that when it creates a network, it takes a /16 ip range out of 172.[17-31].0.0/16 or 192.168.[0-240].20/20 by default. It is just a matter of time before a restart makes it collide with an existing network range. It does skip networks defined on local interfaces at least, but this only means that devs don't learn about this landmine on their own machines, nuking production instead.

The default should reserve a single ip range and simply fail (with a nice message) if more are needed.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#210

Earlier quoted context omitted.

why?

Its incompatible with IP v4, has a stupid addressing scheme, it requires new router hardware and software for isps to buy and nobody is using it because of all the aforementioned issues.

What could an increase in the IP address space do to be compatible? I can think of a couple things to be partially compatible but IPv6 already does those.

And by "stupid addressing scheme" do you mean it's too big, or what? You can ignore all that stuff with mac addresses and make all your addresses go like prefix:subnet::1 prefix:subnet::2 prefix:subnet::3 if you want to.

Post reply on HN