Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Customers Cannot Escape IPv4

tty.neveragain.de

Post reply on HN
Print view View original

261–270 of 316 posts

Re: AWS Customers Cannot Escape IPv4

#261

Post by to11mtm »

spookthesunset wrote: post #245
StuffMaster wrote: post #84

Earlier quoted context omitted.

All I see are combo units these days.

All the modems I see support bridge mode. When enabled the Comcast device doesn’t do any of the routing at all. Your own device gets to do that instead.

Yeah, even at my father's place (I've had different providers than Comcast for personal reasons, but FWIW same story) I've never had a problem just plugging in a router of my choice and using that instead. Makes it a lot easier to handle quirky setups between modem swaps anyway.

Re: AWS Customers Cannot Escape IPv4

#262

Post by dilyevsky »

dopylitty wrote: post #81

As an AWS customer I want to escape IP entirely. It's a waste of time managing these complex networking systems with their archaic protocols (IP, BGP, DNS, etc) Just let me strongly associate identities with my workloads and apply policy indicating which workloads should be able to send data with which other workloads. How data gets from one workload to another should not even be my concern, just make it happen.

I think you’re thinking of mulesoft or maybe retool

Re: AWS Customers Cannot Escape IPv4

#263

Post by Spivak »

noAnswer wrote: post #107
dopylitty wrote: post #79

Earlier quoted context omitted.

I've been listening to a very good IPv6 related podcast with knowledgeable hosts (IPv6 Buzz) and all it's done is convince me that IPv6 is a poorly thought out mistake. Every other episode seems to be about a different new RFC that's replacing another RFC because the original ended up having a bunch of holes and edge cases. That's somewhat understandable for a new protocol but the protocol have been around for almost…

This somehow reminds me of some anti EV (Electric Vehicle) people. They accept ICEVs (Internal Combustion Engine Vehicle) as given and normal (ICEVs just exist, the fuel falls from the sky) but dig really deep into an anti EV mindset. They follow anti EV blogs and podcasts. They will tell you how bad EVs are for the environment, how mutch water and cobalt and what not is used for the production without acknowledging…

Yes, but in this case ipv4 source selection is simple.

* if the app specifies a source use that.

* do a route lookup, if the route has a src use that

* if you get no hint, use the first address.

Re: AWS Customers Cannot Escape IPv4

#264

Post by master_crab »

mabbo wrote: post #104

Many years ago when I was a junior dev at Amazon, there was a massive project internally to split up every internal system into regional versions with limited gateways allowing calls between regions. The reason? We had run out of internal IPv4 addresses. The Principal PM in charge of the "regionalization" effort was asked in a Q&A "why didn't we just switch to IPv6?". Her answer was something along the lines of "The…

My one issue with this is if it’s such a large lift, why burn the effort to just kick the can down the road? IPv6 has to happen at some point (and for AWS that point is sooner than most).

The better reason is the regionalization was probably a way to decrease blast radius in case of a service failure.

Also, AWS definitely did not regionalize all their services in 2016. IAM and certainly not DNS/Rte53 (part of the reason why they had their massive failure in US East 1 2-3 years ago)

Re: AWS Customers Cannot Escape IPv4

#265

Post by Thiez »

icedchai wrote: post #186
talent_deprived wrote: post #181

Earlier quoted context omitted.

The IPv4 at my router yes. That's where tracking ends. IPv6 privacy is an illusion, try the test I described, remove IPv6 from your router at home, wait a few hours or few days, the family will complain search results are odd or messed up and that's only the beginning of it. I don't know how companies are doing it but they are able to track your IPv6 changed daily or not.

They probably just track the IPv6 /64. With prefix delegation, the /64 would rarely change, unless your provider delegated a new block. This is similar to your IPv4 router changing its address w/DHCP: it happens, but is relatively rare.

Also just cookies and browser fingerprinting.

Re: AWS Customers Cannot Escape IPv4

#266

Post by supertrope »

jen20 wrote: post #65
ttegloma wrote: post #55

Earlier quoted context omitted.

Sure there is. AWS has a vested interest in the value of IPv4 going down as much as possible. Owning IPv4 addresses is a requirement of AWS’s core business. Unless people stop using IPv4, then AWS cannot sell those addresses. There is no incentive for the addresses to increase in value. Further, if people continue to use IPv4, then AWS has to continue to acquire even more IPv4, and AWS wants the price of those to go…

> Unless people stop using IPv4, then AWS cannot sell those addresses. There is no incentive for the addresses to increase in value. But if people stop using IPv4, the asset (billions of dollars by some accounts) becomes worthless... AWS are passing on the cost for public IPv4 addresses now, so there's even less incentive.

AWS' business model is not speculating on IPv4 addresses. But the fact that smaller providers can't get IPv4 allocations coincidentally works in big cloud providers' favor (and incumbent ISPs). The slower you deploy IPv6 the longer you defer that cost and the longer you enjoy your advantage in address space capacity.

Re: AWS Customers Cannot Escape IPv4

#267

Post by supertrope »

dpc_01234 wrote: post #207

In my experience the biggest issue for being IPv6 only in AWS is that github still can't IPv6! Tons of software expects to be able to reach out to github for something. One can use some public NAT64 services, but that's not very reliable for anything serious. https://nat64.xyz/ . AWS chargers arm and leg for NAT gateways traffic, and I don't think it's possible to configure them so that they only intercept traffic to…

It's too bad GitHub was not able to follow its parent company Microsoft's lead in deploying IPv6.

Re: AWS Customers Cannot Escape IPv4

#268

Post by emodendroket »

fulafel wrote: post #4

It seems obviously against AWS incentives to offer working v6 - all their influencing tools ("well architected" criteria, certificates) strongly herd you towards building mazes of ambigously addressed 10.x RFC1918 networks, and not internet style architectures with end-to-end addressing. In the world of their recommendations, even the concept of a "public ip address" is a red flag, and AWS even recommends (for an add…

I'm not seeing how security is harmed by making things inaccessible to the public Internet if you don't intend for services you do not control to ever access them directly.

Re: AWS Customers Cannot Escape IPv4

#269

Post by apparentorder »

NovemberWhiskey wrote: post #194

> almost no AWS API can be used from a VPC without public IPv4 addresses Virtually every single application at the company I work at deploys into VPCs without public IPv4 addresses - this seems like a ridiculous claim.

As mentioned in the footnote, this can be done by using PrivateLink; it costs a few bucks too, but it is the way to go if your VPC does not (or must not, for Compliance™ reasons) have internet connectivity.

If your target VPC has neither PrivateLink nor public IPv4 connectivity somewhere, I'm not sure how that would work; I'd love to learn how that was built.

Re: AWS Customers Cannot Escape IPv4

#270

Post by Tijdreiziger »

jeroenhd wrote: post #98
betaby wrote: post #90

Earlier quoted context omitted.

> ISPs can CGNAT for cheap Not really that cheap. While CPAEX is CAPEX, OPEX is still a thing and operating CGNAT requires efforts. Also some (most?) CGNAT implementations are buggy and is not a good user experience, even for users who don't understand the concept of IP at all.

> Also some (most?) CGNAT implementations are buggy and is not a good user experience, even for users who don't understand the concept of IP at all. They're a pain, especially when you're visiting a website with CAPTCHAs, but the money they save on buying IP space seems to be worth the bad experience from an ISP point of view. Even here in the Netherlands, with its relatively high wages, a fiber ISP decided to use CG…

Assuming you’re referring to Delta/Caiway… I think they’re expanding quite quickly, considering both started out as smaller local ISPs; so it’s probably between CGNAT and having to acquire IP space for them.

The fact that they’re owned by an investment fund also makes them probably very focused on profitability.

As a point of comparison, the other players aggressively rolling out fiber (KPN, ODF/Odido) have been nationwide ISPs since the 90s, and they aren’t doing CGNAT AFAIK (so they probably aren’t hurting for IP space).

Post reply on HN