Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

231–240 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#231

Post by jiggawatts »

wolrah wrote: post #42
soebbing wrote: post #8

I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The best idea I can come up with (at least right now) is: put all less trustworthy (read: Closed source) devices into a special legacy IPv4 network and only use IPv6 on my workstation and little Raspis?

> I am quite happy that all those shady IoT devices cannot be reached from the internet directly when I am using IPv4 and NAT - what would be the best way forward to keep it that way in a IPv6-only future? The same exact way you do it right now. Think of NAT as an implicit default-deny firewall rule, that's all it's doing. Basically any firewall worth using will do exactly the same thing in IPv6, deny unsolicited inb…

Not to mention that 99.99% of IoT devices connect to the mothership using an outbound connection, which is permitted by default on both IPv6 and IPv4+NAT.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#232

Post by hot_gril »

dheera wrote: post #185
superkuh wrote: post #182

>There seems to be a lack of drive (judging by forum posts) to enable IPv6 on internet services by admins, either because they don’t care to, or it’s more work to manage a public IPv4 and public IPv6 presence If you run a mailserver adding ipv6 support is far more risk to your domain's mailserver reputation than it is worth. And if you're just a human person and not a megacorp that new ipv6 address, even if it it doe…

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

I've been saying this too. Don't tell me that going from 8.8.8.8 to :whatever::the::heck:::: is an upgrade.

First step of dual-stack networks should've been, every device's IPv6 address is the same as the IPv4 address, just padded technically, and represented textually the same. If I put in 8.8.8.8 and the systems want to speak IPv6 instead, go ahead. A little hacky but addresses (no pun intended) both technical and marketing problems. You could even use a v4 DHCP server and DNS but speak IPv6, instead of trying to sell people on a whole stack change at once.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#233

Post by throw0101c »

adriancr wrote: post #165
throw0101c wrote: post #162

Earlier quoted context omitted.

> Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs? On macOS it's 24h, but it doesn't have to be: $ sysctl -a | grep temppltime net.inet6.ip6.temppltime: 86400

I mean, it's the same point, single address to single node, just more often, so need to identify more often. Minutes or less I guess would defeat tracking, but then what's the point?, it's almost equivalent to NAT it still breaks reverse connectivity? and does it actually work? It also feels like a workaround for an oversight.

> I mean, it's the same point, single address to single node, just more often, so need to identify more often.

But how would they know it is to the same node?

I have my DSL router-modem reboot every night, and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec.

Similarly with the reboot I get a new /64 prefix delegation (actually /56), so I would hazard to guess if IPv6 starts getting tracked, I'd get the same crazy results.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#234

Post by drbawb »

petertodd wrote: post #96
AnonymousPlanet wrote: post #56

Earlier quoted context omitted.

Maybe people don't want to disclose the number and purposes of interior machines?

IPv6 has so many addresses that the default is for /64 subnets to be the minimum network size, allowing devices to choose their addresses randomly within that range. If they do that, 2^64 is big enough that it's not practical to enumerate all devices on a given network. Attempting to do so would be a bandwidth DoS attack: attempting to ping 2^64 devices requires 2^64 * 64 bytes = 1024EiB, roughly equal to total globa…

EUI64 means that random space is effectively reduced to just 48-bits of real entropy, It's security through obscurity at best, i.e: not security. You shouldn't be relying on size of address space to protect you from anything. An IDS/IPS that alerts on abnormal ICMP behavior will be useful whether an attack is 1GiB of traffic in size or 1024EiB of traffic in size. (Also you don't even need automated scanning to find some juicy targets: I've seen a lot of routers on the edge of a prefix configured at ::1/64 and ::2/64 for instance.)

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#235

Post by hot_gril »

zamadatix wrote: post #224
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

: separates groups of 4 while optionally :: abbreviates a bunch of 0's and leading 0's in groups are optional. The address can be longer, sure, but it's really near identical to dotted decimal beyond the lengths. I wouldn't mind a simpler DNS server IP though seeing as it's one of the few locations you need to treat as an address regularly. Sprint/T-Mobile has 2600::, which is not only short but seemingly a phreaking…

> separates groups of 4 while optionally :: abbreviates a bunch of 0's and leading 0's in groups are optional. The address can be longer, sure, but it's really near identical to dotted decimal beyond the lengths.

Consecutive colons aren't readable or easy to remember.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#236

Post by wankle »

adriancr wrote: post #178
jiggawatts wrote: post #175

Earlier quoted context omitted.

Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are…

> Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. That's a broad assumption, and I can assure you they will due to lower costs (no need to pay data broker if you already know target, no need for extra traffic, load, etc). Also due to better targetting you get better prices per ads served. > just not a valid reason to abandon the benefits of IPv6 What are t…

[flagged]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#237

Post by hot_gril »

voytec wrote: post #189
dheera wrote: post #185

Earlier quoted context omitted.

Yeah I have zero motivation to deal with IPv6. I also have all my IPv4 addresses memorized, and IPv6 addresses are too long to remember with all the hex-double-colon nonsense. If they could have turned 1.2.3.4 into 1.2.3.4.5.6 I'd probably use it, but instead they opted for some scary stuff that looks like d0ff::eefa::0010::faff:::://::92::0 which I'd rather not look at. Product management fail. Anyhow, IPv4 still wo…

[flagged]

I hope you're on the new version of everything then, not just in your area of expertise. You're expecting people to want something that's worse for them if anything, and calling them lazy isn't going to help. What would've helped is making IPv6 more user-friendly.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#239

Post by [deleted] »

Arnavion wrote: post #217
IshKebab wrote: post #68

Earlier quoted context omitted.

In theory, sure. In practice firewalls can be misconfigured. NAT doesn't have that problem.

The amount of firewall config I have to write to let an incoming connection cross from WAN to LAN is the same regardless of whether it goes to a NAT'd IPv4 address or to an IPv6 address.

[deleted]

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#240

Post by throw0101c »

thesuitonym wrote: post #125
jcalvinowens wrote: post #107

Earlier quoted context omitted.

There is no downside to everything to be globally routable. It's completely orthogonal to firewalling. What is the risk you're picturing here? I'm really curious. Features like RFC4941/8981 mean nobody can infer anything about your network from the source addresses they see making requests out if it. If you want to use link-local V6 addresses and NAT to a global one, you can do that. But IMHO that's sacrificing one o…

I'm not saying there's any downside, I'm just saying it's not the magic bullet "this is why you should use ipv6" that everyone seems to think it is. It's a complete non-issue that nobody really cares about.

> It's a complete non-issue that nobody really cares about.

The availability of IPv4 addresses is something that more people will care about, and getting IPv6 going may help folks. From another comment in this sub-thread:

> I've actually run into this [CG NAT] helping a friend host a game server on their residential internet in a more rural part of Texas. They had to call their ISP and request a static IP address at an extra cost of something like $5/mo.

* https://news.ycombinator.com/item?id=35046929

Post reply on HN