Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why IPv6 is so complicated

github.com

Post reply on HN
Print view View original

261–270 of 519 posts

Re: Why IPv6 is so complicated

#261

Post by mittensc »

Dagger2 wrote: post #260
mittensc wrote: post #259

Earlier quoted context omitted.

> Yup, repeatedly Cool, me too :) Anyway, the other side of the argument: It is the default and default is secure. Users don't have to reason about it, they can assume it works, how doesn't matter and they may lack training/willingness to figure out. You can't say the same for IPv6 where default is allow (have things changed?, havent checked in a long time)

Of course you can say the same for v6. Blocking connections that go from WAN to LAN by default has the same effect on both protocol families. If you assume that having the appropriate firewall rule to do that is the default then inbound connections will also be blocked on v6 by default. NAT contributes nothing to your security in this scenario, and instead makes it harder (not easier) to understand and reason about w…

> If you assume that having the appropriate firewall rule to do that is the default

That's the thing, it's not the default, default is public ipv6 for everyone and its the users duty to configure firewall...

I could definitely set this up easily, someone like my parents or friends would ask me 'what's IPv6?'

Re: Why IPv6 is so complicated

#262

Post by Dagger2 »

mittensc wrote: post #261
Dagger2 wrote: post #260

Earlier quoted context omitted.

Of course you can say the same for v6. Blocking connections that go from WAN to LAN by default has the same effect on both protocol families. If you assume that having the appropriate firewall rule to do that is the default then inbound connections will also be blocked on v6 by default. NAT contributes nothing to your security in this scenario, and instead makes it harder (not easier) to understand and reason about w…

> If you assume that having the appropriate firewall rule to do that is the default That's the thing, it's not the default, default is public ipv6 for everyone and its the users duty to configure firewall... I could definitely set this up easily, someone like my parents or friends would ask me 'what's IPv6?'

Ah, okay. In that case v4 doesn't have a firewall by default either.

That's precisely why routers come configured with a firewall that blocks inbound connections from the WAN -- because the protocol itself doesn't have a firewall by default, and neither does NAT.

Re: Why IPv6 is so complicated

#263

Post by Dagger2 »

b112 wrote: post #245
Dagger2 wrote: post #227

Earlier quoted context omitted.

None of that has anything to do with what you said in the post I replied to. "Add an extra octet to v4 addresses" has hard technical barriers to deal with if you want it to work, regardless of what the world looks like or what you're designing for. > We now know that the "internet of things" and "having your fridge online", as well as "5G in everything so people can't firewall it off" is just insane and malign None o…

None of that has anything to do with what you said in the post I replied to. Of course not, why would it? I quoted what I was replying to, and all of my comments made perfect sense in that context. In that context, I was discussing the winning ipv6's original design considerations, and yes "IPs for everything" was one of them, hence me talking about it.

I intended the quoted part to mean something like "they did consider adding extra octets to v4 addresses and setting those octets to zero to mean v4".

It's not like they weren't able to come up with that idea. It's just that if you follow that train of thought through to its conclusion, you'll either decide it can't work or you'll make enough changes to end up with something that works basically the same way v6 does.

But yes, having enough IPs for everything was obviously a design goal. It would be excessively silly to go through all the work to increase the address size and not increase it by enough to handle whatever people ended up wanting to do with it.

Re: Why IPv6 is so complicated

#264

Post by apple4ever »

teddyh wrote: post #232
ExoticPearTree wrote: post #37

My first IPv6 implementation was in 2010-2011 (memory a but fuzzy). Carriers supporting BGP over IPv6 were few, websites over IPv6 were also scarce. Fast forward 15 years snd the situation has improved quite dramatically. IPv6 has some quirks that make it harder to digest. - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space - privacy extensions:…

> IPv6 has some quirks that make it harder to digest. Almost every point in your list is wrong. > - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space IPv4 has link-local addresses, too. Those are the 169.254.X.X addresses that you see on Windows machines. IPv6 adds nothing new. > - privacy extensions: it is very hard to explain to people why the…

>> IPv6 has some quirks that make it harder to digest. > Almost every point in your list is wrong.

You missed the point and almost every counterpoint in your list is wrong.

>> - link local gateway address, makes it hard to understand why the subnet does not have a gateway from the ssme address space >IPv4 has link-local addresses, too. Those are the 169.254.X.X addresses that you see on Windows machines. IPv6 adds nothing new.

That's not what the OP said. Note it says gateways. IPv4 when DHCP'd will show 192.168.1.1 for example when it has a 192.168.1.55 address. IPv6 will show fe23::166:8f2c:9a21:96de when it has a 2001:921:61c:aef:78f:7190:1ca2 address, despite the gateway actually being 2001:921:61c:aef::1. So its highly confusing for no good reason.

>> - privacy extensions: it is very hard to explain to people why they have 3-4 IPv6 addresses assigned to their computer > Well then, don’t use them. Configure the machines with one address each, just like before. If you want the (arguable) advantages of the privacy extensions, they are available, but not mandatory.

While you can configure not use them, by default DHCP'd devices WILL have a bunch. Again confusing for no good reason.

>> - no real tentative mapping to what people were used to. Every IPv6 presentation I did had to start with “forget everything you know about IPv4” > That’s the complete opposite of my experience. Almost everything in IPv6 works exactly the same as with IPv4.

It's the complete opposite experience for most people, including network engineers.

Re: Why IPv6 is so complicated

#265

Post by apple4ever »

teddyh wrote: post #243
patmorgan23 wrote: post #238

Earlier quoted context omitted.

You're being obtuse. Every point in the original comment is correct, you just disagree they're issues. The original comment also doesn't state they are issues just that they are differences. • link local addresses .Auto configuration addresses are in V4 but they are used entirely differently. Interfaces do not have link local addresses if they have a DHCP or statically configured address, in V6 it is extremely common…

> The original comment also doesn't state they are issues just that they are differences. My point is that, in most cases, these aren’t differences , since IPv4 does the same thing as IPv6. Therefore, the claim that IPv6 “ has some quirks that make it harder to digest [than IPv4]” is incorrect. > Interfaces do not have link local addresses if they have a DHCP or statically configured address I could be wrong, but I s…

> What? I have never seen this.

What? Never? Is extremely common. I just checked both my Mac and Windows desktops and they both show a link local gateway.

It makes me question whether you've used IPv6 all that much.

Re: Why IPv6 is so complicated

#266

Post by apple4ever »

foxrider wrote: post #9
themafia wrote: post #5

> The main reason for IPv6, and its only real reason for existence, was bigger addresses. Which also allowed for better route aggregation in the core BGP tables. Better node mobility support. Better multicast support. Genuine link local addresses. IPv4 had a lot of unfortunate edge cases. I think IPv6's greatest strength and also responsible for it's slow rollout was it's insistence on solving several of these proble…

And that's what you should do, since you're forcing the protocol update you should take the opportunity that might not come later

In hindsight though, and really also in foresight, it didn't work out that way.

Re: Why IPv6 is so complicated

#267

Post by vaylian »

The headline is not confirmed in the text:

> First of all, IPv6 really is a conservative design - it doesn't change the basic IP model of connectionless packet switching with topological addresses.

Re: Why IPv6 is so complicated

#268

Post by api »

It’s not. It’s IPv4 with more bits and some changes to Ethernet level lookup.

The SLAAC vs DHCPv6 mess is not really a problem with the core V6 spec.

Re: Why IPv6 is so complicated

#269

Post by evilmonkey19 »

Personally, i feel it is complicated because ISPs are highly afraid of trying it. I understand that such novel technology would be risky to use. But after 20+ years there are still many countries, like Spain, which are barely using it. After that much time has passed, it is already well battle-tested. At this point, you don't want to make the move either because you are too afraid of anything or you have commercial reasons.

I believe Telefonica has reasons to not use IPv6... Although in the long run is turning to be a bad decision. Look at digi :p

Re: Why IPv6 is so complicated

#270

Post by api »

evilmonkey19 wrote: post #269

Personally, i feel it is complicated because ISPs are highly afraid of trying it. I understand that such novel technology would be risky to use. But after 20+ years there are still many countries, like Spain, which are barely using it. After that much time has passed, it is already well battle-tested. At this point, you don't want to make the move either because you are too afraid of anything or you have commercial r…

IT and telecom tend to have an ultra conservative if it’s not broke don’t fix it attitude. It won’t get deployed until enough customers ask for it or it’s required for something important.
Post reply on HN