Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS IPv4 Estate Now Worth $4.5B

toonk.io

Post reply on HN
Print view View original

341–350 of 480 posts

Re: AWS IPv4 Estate Now Worth $4.5B

#341

Post by Sesse__ »

yrro wrote: post #313
Sesse__ wrote: post #249

Earlier quoted context omitted.

> Instead had the approach been ipv6 only from the start, with no dual-stack, having the OS transparently deal with sockets to ipv4 devices by converting to the ipv6 mapped address (:ffff:xxxxxxx), and thus eliminating the need for dual stack from the start, things would have moved far far faster. This is, indeed, how dual-stack works; you open a PF_INET6 socket and use sockaddr_in6 addresses for everything, includin…

Don't forget you may need to opt in to get mapping to work. It's not available by default on all platforms. If you're unlucky you'll also have to sacrifice a goat to appease the JVM gods. JVM behaviours vary hugely across implementation, version and underlying platform. Not to mention the short sighted decision made by many sysadmins to disable IPv6 completely...

Sure, that's one line and then you're done. And only if you care about very old (WinXP) or deliberately obnoxious (OpenBSD) platforms.

Re: AWS IPv4 Estate Now Worth $4.5B

#342

Post by butlerm »

welterde wrote: post #122
hn_throwaway_99 wrote: post #105

Earlier quoted context omitted.

> IPv6 is as backward compatible as is possible within this constraint. Yikes, couldn't disagree with that more. There are a ton of things that ipv6 designers could have done to make the transition much easier. This is a (now quite old) blog post that is my "go to" that explains a lot of the problems with ipv6: https://cr.yp.to/djbdns/ipv6mess.html FWIW I couldn't find the link to that post until finding it on one of…

That document has been going around for ages and is based on the same fundamental misunderstanding that one somehow can extend IPv4 in a way somehow, but remain compatible with IPv4-only clients. This is just not possible. Most of the other criticism is not relevant anymore, since we now have a lot of transition technologies that allow IPv6 clients to interoperate with IPv4 servers (this way around is possible since…

That document is not a proposal, it is a problem statement. It goes without saying that IPv4 only clients - every single one of them - would need to be upgraded in some fashion to support a larger address space. The issue is how to do that while remaining incentive compatible.

The only way to remain incentive compatible is to remain administratively compatible, and that is where IPv6 as presently constituted fails dramatically by requiring two independent network configurations to be maintained for the better part of a century, without giving anyone an incremental incentive to maintain the second one, leading to a hold out problem.

The public switched phone network has gone through major upgrades and yet at no point did someone say we are going to throw out all your existing phone numbers and require you to get new ones, or require you to have two independent and incompatible phone numbers that you put on your business cards, have two phones on your desk, or a phone with a mode selection button depending on whether you wanted to call a new style phone number or an old style phone number.

And that - from an administrative point of view - is the fundamental problem with the deployment of IPv6 as we know it. Dual stack now and for decades to come. Dual stack anything is not incentive compatible and should never have been done. The proper solution is single stack everything with capabilities that are dormant until they are deployed on a global level as part of the normal upgrade process in an administratively compatible fashion so that no large scale administrative intervention is required now or at any time in the future.

Re: AWS IPv4 Estate Now Worth $4.5B

#343

Post by greyface- »

j16sdiz wrote: post #146
atyvr wrote: post #24

Earlier quoted context omitted.

You'll need to become a member of one of the regional Internet route registries, like RIPE or ARIN. Then you can buy, say a /24, and transfer it into your RIPE/ARIN account. Now you have your own IPv4 range. And you can start for example start to use it for your own servers. To do so you need to "announce" this new /24 to the internet, using a protocol known as BGP. You can do that yourself, using a router, assuming…

Before you can "announce" a prefix, you need an ISP willing to peer with you. BGP is a very insecure protocol. Most of its "security" are enforced by money and contract.

> BGP is a very insecure protocol.

Take a look at the state of RPKI. ROA validation is common these days, and ASPA validation will be common soon. You still need to manually validate that your peer truly represents the AS that they claim to, but if that's been done, ROA+ASPA validation prevents unauthorized announcements.

Absent RPKI, people have been filtering based on IRR for ages, which will not necessarily prevent unauthorized announcements, but will require an attacker to leave a paper trail when making one.

Re: AWS IPv4 Estate Now Worth $4.5B

#344

Post by greyface- »

cyberax wrote: post #151
_JamesA_ wrote: post #127

Earlier quoted context omitted.

Is there a way to get a /24 block that I own and has been unused since the mid 90's routed without signing a new contract and paying the new ARIN fees?

You can not "own" a /24 block. And if your membership lapses, then your blocks are returned to the general pool. It's possible that your block is a part of a legacy allocation, they are governed differently.

> block that I own and has been unused since the mid 90's

This timeline suggests that it's still a legacy allocation. The new governance structure does not apply unless you sign an RSA or LRSA agreement with ARIN.

Re: AWS IPv4 Estate Now Worth $4.5B

#345

Post by greyface- »

kxrm wrote: post #180
_JamesA_ wrote: post #127

Earlier quoted context omitted.

Is there a way to get a /24 block that I own and has been unused since the mid 90's routed without signing a new contract and paying the new ARIN fees?

You'd be under the LSRA fee schedule. https://www.arin.net/resources/fees/fee_schedule/#legacy-reg... So you won't be subject to the new fee structure. If you want to route then you will need an ASN and an ISP willing to announce them. So long as you are up on your LSRA dues I don't see how you won't be able to utilize them.

You don't need to sign an LRSA to use the prefix; there are some legacy holdouts still using their original prefixes without any agreement or fees with ARIN. Signing an LRSA will give you access to ARIN IRR/RPKI/rDNS/etc services, which can be quite useful, though.

Re: AWS IPv4 Estate Now Worth $4.5B

#346

Post by coldpie »

JakobH wrote: post #96
TZubiri wrote: post #92

Earlier quoted context omitted.

Not a fan of ipv6 evangelizing, much less at this point. Just give it up.

What is your solution?

> What is your solution?

Understand very little about the problem space and complain about the best-compromise solution that the people who do know what they're talking about came up with. It's a very comfortable position to be in, I recommend it to everyone.

Re: AWS IPv4 Estate Now Worth $4.5B

#347

Post by greyface- »

22c wrote: post #164
anonymous344 wrote: post #154

can I buy one ipv4 for myself somehow. not lease or rent, buy ?

Last I checked, the smallest blocks for sale are class C. I also don't think there are many places willing to announce your ultra specific route because it's not great for routing tables.

> class C

You can also acquire and use a /24 out of a class A or B block, thanks to this newfangled thing called CIDR. ;)

Re: AWS IPv4 Estate Now Worth $4.5B

#348

Post by dale_glass »

forty wrote: post #316
dale_glass wrote: post #182

Earlier quoted context omitted.

No, NAT needs to be shot into the sun. It's absolutely not needed under IPv6.

Why? It seems useful to hide details of your private network from everyone

You can do that with the privacy extensions. Plus on IPv6 you should get enough address space that it makes no sense to run a scan against anyone.

On IPv4 or NAT there's just 65535 ports to check. On a /48 with privacy extensions there's 2^80 addresses to go through, which from an external point of view don't remain constant. You can't even ping all of that.

Re: AWS IPv4 Estate Now Worth $4.5B

#349

Post by throw0101c »

azernik wrote: post #282
cornholio wrote: post #255

Earlier quoted context omitted.

There was a third option: make the existing IPv4 space a hierarchically routed island of the new IPv4.1 space, with backwards compatible packet format, then upgrade just the endpoints in the first phase. So every owner of a ipv4 would get, say, an entire 32 bit space that routes over existing IPv4 infrastructure . So, if the endpoints are upgraded, you have guaranteed end-to-end deliverability without silly hacks suc…

This is exactly how NAT64 works, and still doesn't solve the problem of IPv4 clients trying to connect to servers with only IPv6 addresses. The backwards incompatibility is irreducible, inherent to the special place of Layer 3 in the networking stack.

> This is exactly how NAT64 works, and still doesn't solve the problem of IPv4 clients trying to connect to servers with only IPv6 addresses.

You also have to deploy new DNS code to handle a new record type to handle longer "IPv4+" addresses.

You also have to deploy new OS and library code with new socket, etc, APIs because all in_addr_t definitions and data structures are 32-bit-only.

Re: AWS IPv4 Estate Now Worth $4.5B

#350

Post by ilyt »

cornholio wrote: post #255
jiggawatts wrote: post #167

Earlier quoted context omitted.

These arguments always boil down to these two: "Please just try to fit more than 4 billion numbers into 4 bytes" -- this is mathematically impossible. "Just extend the address size" -- this is an entirely new protocol by the definition of IPv4, which uses fixed-size addresses. The reason for the slow IPv6 adoption is that there was no financial or business pressure. While IPv4 is ubiquitous, nobody individually feels…

There was a third option: make the existing IPv4 space a hierarchically routed island of the new IPv4.1 space, with backwards compatible packet format, then upgrade just the endpoints in the first phase. So every owner of a ipv4 would get, say, an entire 32 bit space that routes over existing IPv4 infrastructure . So, if the endpoints are upgraded, you have guaranteed end-to-end deliverability without silly hacks suc…

> There was a third option: make the existing IPv4 space a hierarchically routed island of the new IPv4.1 space, with backwards compatible packet format, then upgrade just the endpoints in the first phase.

That is called DS-Lite and we have it

Still doesn't solve a problem of old clients not being able to access new servers

Post reply on HN