341–350 of 372 posts
How are we not out of IPv4 addresses already? Aren't there a billion phones out there? And probably the same number of PCs and god knows how many servers?
Earlier quoted context omitted.
This. I have Comcast Xfinity in the USA (local monopoly, I would use a different ISP if I could) and they just don't offer IPv6. The rep on the phone seemed surprised that I would even ask.
Surely you mean static IPv6, because of the 3 different cities I've been forced to use Xfinity (even on their lowest plan Internet), I have been given IPv6 leases and I for sure didn't call anyone Or, another certainly plausible explanation is that your router either doesn't support IPv6 or it is disabled
Earlier quoted context omitted.
First: Here in Australia no major ISPs provide a native IPv6 service, and if they do, they don't provide it to business. It's obscenely difficult to obtain IPv6 in Australia. None of the major telcos do it, you have to go down the list to like the 5th or 6th biggest ones before it becomes an "experimental option" for residential connections only. Second: Ever since IPv6 has been a thing, I've offered to customers the…
> Ever since IPv6 has been a thing, I've offered to customers [...] They've all actively refused to turn it on, for any purpose. As such a customer, I’m worried that my ISP would eventually bait-and-switch me from routable IPv4 + optional IPv6 to CGNAT IPv4 + IPv6 when convenient to them. Sorry, but I’m not risking going behind a 1:n NAT layer that I don’t manage.
For example Aussie Broadband had a nice writup of their CGNAT setup: https://www.aussiebroadband.com.au/wp-content/uploads/2019/0...
Earlier quoted context omitted.
That's surprising and quite concerning. Imagine all the insecure IoT devices running ancient software having a direct connection to the Internet... It would be even more concerning if they were shipping routers without any firewall functionality at all. NAT basically requires a firewall. I hope the thinking isn't if you can do away with NAT you can do away with the firewall.
The thinking of the opt-inners seems to be (roughly) that : -IPv6 is fundamentally much more secure than IPv4 (no scanning, etc.) -opt-out is bad for innovation, especially since the cheap default ISP router firewall software is likely to not even allow opt-out for any other protocols than TCP and UDP. (Heck, these days on IPv4 even anything different than HTTPS can be problematic...) -reliance on router firewalls is…
Earlier quoted context omitted.
It's only 240k a year, which is pretty standard SV wages.
God, I just _love_ how out of touch the American tech industry is from the rest of the world.
My point is, if 20k/month motivates you, Silicon Valley has hundreds of thousands of people in that category. And by many perspectives, they are underpaid. Really, I'm just saddened by how out of touch the rest of the world is on the subject.
Earlier quoted context omitted.
I want ipv6 as much as anyone, but we are not spending enough time preparing for NATs death. It's responsible for far more security than we as a collective would like to admit and there's a lot more we could be doing now to get ready.
20+ years isn't enough? More seriously; for 99% of people their ISP router handles NAT and firewall duties. Adding DENY ALL inbound and ALLOW ALL outbound isn't a great stretch for them on ipv6.
Earlier quoted context omitted.
I want ipv6 as much as anyone, but we are not spending enough time preparing for NATs death. It's responsible for far more security than we as a collective would like to admit and there's a lot more we could be doing now to get ready.
That's a common misconception. NAT isn't a security feature but rather a feature of a stateful firewall, which is. There's no reason to remove the firewalls that are in place now when ipv6 happens.
Yes, everyone should have a hardware firewall, but we both know most people just buy the cheapest thing, and by bad large, real firewall features are mostly targeted toward higher end devices.
Earlier quoted context omitted.
> IPv6 is fundamentally much more secure than IPv4 (no scanning, etc.) The same was true for ipv4 until about a decade ago. > opt-out is bad for innovation, especially since the cheap default ISP router firewall software is likely to not even allow opt-out for any other protocols than TCP and UDP. (Heck, these days on IPv4 even anything different than HTTPS can be problematic...) I can't wait for conficker6 to innova…
> Your 50/50 example is hugely biased, first it's on a Telco discussion forum so that clearly selects for technical users, then it's on ipv6 which is going to further select for technical people. As you can see I'm aware of that, they are also aware of that, and the discussion is not so much about themselves (since they know how to configure a firewall or even to install their own router), but about what your "averag…
Earlier quoted context omitted.
The thinking of the opt-inners seems to be (roughly) that : -IPv6 is fundamentally much more secure than IPv4 (no scanning, etc.) -opt-out is bad for innovation, especially since the cheap default ISP router firewall software is likely to not even allow opt-out for any other protocols than TCP and UDP. (Heck, these days on IPv4 even anything different than HTTPS can be problematic...) -reliance on router firewalls is…
You probably want to read this: https://www.internetsociety.org/wp-content/uploads/2019/02/D...
Especially interesting is this RFC : https://www.rfc-editor.org/rfc/rfc6092.html "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service"
It shows that there are lots of different filterings involved, so it looks like that these millions of residential users connected to the IPv6 Internet without router firewalls might still have some router filtering going on ?
Also, it confirms that "The IPv6 stateful filtering behavior described in this document is intended to be similar in function to the filtering behavior of commonly used IPv4/NAT gateways, which have been widely sold as a security tool for residential and small-office/home-office networks.
As noted in the Security Considerations section of [RFC2993], the true impact of these tools may be a reduction in security. It may be generally assumed that the impacts discussed in that document related to filtering (and not translation) are to be expected with the simple IPv6 security mechanisms described here.
In particular, it is worth noting that stateful filters create the illusion of a security barrier, but without the managed intent of a firewall. Appropriate security mechanisms implemented in the end nodes, in conjunction with the [RFC4864] local network protection methods, function without reliance on network layer hacks and transport filters that may change over time. Also, defined security barriers assume that threats originate in the exterior, which may lead to practices that result in applications being fully exposed to interior attack and which therefore make breaches much easier."
So now I'm kind of confused as for the different meanings of 'filtering' and 'firewall' that might be used... The RFC seems to use 'firewall' in the sense of 'customizable firewall', while ISPs still often don't provide other options on their IPv6 'firewall' than 'ON/OFF'...