Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1/3 of all access to Google is now over IPv6

google.com

Post reply on HN
Print view View original

211–220 of 237 posts

Re: More than 1/3 of all access to Google is now over IPv6

#211

Post by Bnshsysjab »

jedberg wrote: post #207
Bnshsysjab wrote: post #201

Earlier quoted context omitted.

AWS allows you to switch mail servers to a specific address range which, as far as I know, are treated nicer than the regular address space. Please provide citations if you’re going to speak so factually.

> Please provide citations if you’re going to speak so factually. That's fair. I don't really have handy citations. I just know this stuff from working in email deliverability for a long time. I guess you can choose to believe me or not.

I have a DigitalOcean mailserver that isn’t blocked by google, or o365 ;)

Re: More than 1/3 of all access to Google is now over IPv6

#212

Post by jiggawatts »

wmf wrote: post #169
jiggawatts wrote: post #93

Earlier quoted context omitted.

They've internalised their constraints. RFC1918 was forced upon the cloud providers only because there weren't enough IPv4 addresses to go around. If Amazon had started in 1980, they would have simply allocated a /8 for each region and be done with it. No NAT, no gateways, no address translation of any sort. Everything routing to everything else natively.

EC2 originally allocated a public and private address to each VM, so clearly they do have enough addresses to go around.

They had addresses to go around, but not any more.

AWS has 24 regions. If each one had a single /8 block -- which would be the bare-minimum at their scale these days -- they would eat up 10% of all available IPv4 addresses!

Keep in mind that they would still have to "carve up" that /8 for each customer, which is still an overly tight fit. Either everyone gets a bunch of small random pools of addresses (eww), or they have to restrict each region to a small number of customers (bad for business), or provide each customer with tiny subnets (too restrictive for the big fish customers).

With IPv6 this just vanishes. They could have multiple address ranges for each Region, AZ, CDN POP, or whatever. They could have ranges for each service, making firewall rules trivial. They could give each customer a huge prefix that they could still carve up into many subnets.

I seriously don't get the arguments against IPv6.

Why are people so happy with their constraints?

Re: More than 1/3 of all access to Google is now over IPv6

#213

Post by ksec »

throw0101a wrote: post #117
walton_simons wrote: post #48

My ISP supports IPv6, and while I can understand why a large organisation would want to use it (especially given the increasing cost and scarcity of IPv4 blocks), I'm still yet to be persuaded of its benefits for home users. I admit that I only have a very cursory understanding of how it works, and perhaps I'm just stuck in my ways, but the scale and complexity seems so extreme compared to IPv4, with no compensating…

> I'm still yet to be persuaded of its benefits for home users. According to Apple, IPv6 is 1.4 times faster than IPv4 (latency wise AFAICT): * https://www.zdnet.com/article/apple-tells-app-devs-to-use-ip... This is supposedly "due to reduced NAT usage and improved routing."

I wonder are these mostly on Client side or is this ISP side of things?

It is great marketing to list 40%. But we need to know 40% of what. If it was 1ms, than 0.4ms faster isn't much of a performance.

Re: More than 1/3 of all access to Google is now over IPv6

#214

Post by p_l »

ipython wrote: post #105
jiggawatts wrote: post #72

Earlier quoted context omitted.

Imagine someone saying, in 2001 that they're adding IPv4 support. Laughable, right? IPv6 was available in Windows 2000. Just saying.

I believe that was only because it was mandated by the federal government as part of procurement process. It’s the same reason there was a half baked posix subsystem in Windows NT. I don’t have citations at the moment to prove my memory.

MS is major pusher of IPv6 in corporate world. Remember that when Windows 2000 was released, major v6 traffic was 6BONE overlay.

Over the next few releases, they worked hard on v6 support, and in fact some issues people had with Vista were caused by NT6 being IPv6-first OS, across all of the MS solutions. MŚ had to go backwards a bit in 6.1, introducing things like v6-over-HTTP tunnels because they found that assuming native v6+ipsec working was too much, even with Teredo.

Re: More than 1/3 of all access to Google is now over IPv6

#215

Post by p_l »

jeppesen-io wrote: post #178
dijit wrote: post #40

And yet, when I beg my google cloud rep for IPv6 addresses on instances (or on anything that isn’t the load balancer) I get told that it is not on the immediate roadmap. The cloud providers have pushed back ipv6 adoption so hard imo. At least native ipv6 access. I know they’ve thrown in some token support and you /can/ make something work; but compared to VPS providers which consistently deliver machines with IPv6 ad…

> I beg my google cloud rep for IPv6 addresses on instances Why? What problem does this solve?

Overlapping address spaces suck, and sometimes you need direct connections with multiple such spaces.

Re: More than 1/3 of all access to Google is now over IPv6

#216

Post by jiggawatts »

api wrote: post #187
jiggawatts wrote: post #93

Earlier quoted context omitted.

They've internalised their constraints. RFC1918 was forced upon the cloud providers only because there weren't enough IPv4 addresses to go around. If Amazon had started in 1980, they would have simply allocated a /8 for each region and be done with it. No NAT, no gateways, no address translation of any sort. Everything routing to everything else natively.

I also wonder if they're pushing this for lock-in reasons. If they make everyone architect in this way then people need more load balancers, NAT gateways, firewalls, and other complexity, and they charge for all that.

I have noticed that the cloud vendors seem to drag their feet on trivial free features that would undermine the need to use some expensive offering that auto scales to match your credit rating.

For example, Azure Network Security Groups (NSGs) have some glaring omissions that were ignored for years, but have just recently been oh-so-conveniently resolved by Azure Firewall. The old NSGs were free, the firewall costs money, and they also charge per gigabyte of data transferred through it!

Of course, they're recommending that all customers should immediately "uplift" their network architectures to plumb everything through a central firewall.

For security.

You know, income security. For Microsoft.

I should go buy some AMZN and MSFT...

Re: More than 1/3 of all access to Google is now over IPv6

#217

Post by jiggawatts »

ed25519FUUU wrote: post #194
myself248 wrote: post #179

Just turn off ipv4 for one minute every day. Next month, increase it to 2 minutes. A minor inconvenience, but a major motivator.

Punish people that don't care and have no control over whether or not their ISP supports IPv6? IPv6 affects everyday internet users exactly 0%. It's rational for them not to care about it.

It's more like the carbon tax. The companies with lazy network admins are "externalising" the cost of their outdated networking on the larger Internet ecosystem.

Re: More than 1/3 of all access to Google is now over IPv6

#218

Post by ksec »

I often wonder if we improve the usability of IPv6, like a subset of Ipv6, would it help adoption?

Things like using only numbers and not issuing address with letters. We would still get larger than 64bit of address space, but we dont have to work with the gibberish address.

Re: More than 1/3 of all access to Google is now over IPv6

#219

Post by Dagger2 »

gvjddbnvdrbv wrote: post #209
Decade wrote: post #204

Earlier quoted context omitted.

Yes, you should throw out a lot of what you know about networking. Port scanning _should_ be difficult in IPv6. Instead, you should be using DNS and/or multicasting. Having multiple ways to configure IP addresses _isn’t_ a problem. Modern devices have lots of RAM. They can handle having lots of IP addresses. Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address…

> Even better, these days you can allocate a unique local address to the printer (RFC 4193, fd00::/8) and eliminate Internet access entirely. I.e. essentially what we already had with IPv4. > Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address to the printer, it won’t be easy to get to it. Security provided by 'the attackers get bored'....

Security is provided by a firewall. But a lot of IoT botnet stuff comes from people opening inbound connections to their cameras/NASs/etc so they can access them from elsewhere. These are hosts where the network security has been deliberately disabled. The large address space of v6 at least reduces the odds of someone finding the device -- an insecure, unexploited device is better than an insecure exploited one.

You could sort of consider the 64 bit host ID to be a cookie, stored in DNS, that has to be provided by the client to connect to the server. Viewed like this, the IP itself would be considered a layer of security, since it forces the client to know the correct DNS name (or spend a lot of time guessing) to connect.

Re: More than 1/3 of all access to Google is now over IPv6

#220

Post by Decade »

gvjddbnvdrbv wrote: post #209
Decade wrote: post #204

Earlier quoted context omitted.

Yes, you should throw out a lot of what you know about networking. Port scanning _should_ be difficult in IPv6. Instead, you should be using DNS and/or multicasting. Having multiple ways to configure IP addresses _isn’t_ a problem. Modern devices have lots of RAM. They can handle having lots of IP addresses. Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address…

> Even better, these days you can allocate a unique local address to the printer (RFC 4193, fd00::/8) and eliminate Internet access entirely. I.e. essentially what we already had with IPv4. > Because of how difficult it is to port scan IPv6, as long as you don’t manually allocate a low-entropy address to the printer, it won’t be easy to get to it. Security provided by 'the attackers get bored'....

Not essentially what we have with IPv4.

IPv4 is from the old days of 1 device, 1 IP address.

RFC 4193 addresses are in addition to the globally routable IP addresses. Your laptop could have both classes of addresses. Your printer could have only one class of address.

Between the ULA and the global addresses, with DHCPv6 and NDP and IPv6 privacy extensions, my laptop currently has 13 IP addresses on its main network adapter. That’s leaving my router and my laptop on default settings, nothing special, no appreciable memory impact.

Post reply on HN