Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Hits 50% IPv6

blog.apnic.net

Post reply on HN
Print view View original

361–370 of 496 posts

Re: Google Hits 50% IPv6

#361

Post by throw0101a »

NitpickLawyer wrote: post #272
TheDong wrote: post #119

Earlier quoted context omitted.

Where's the privacy issue? That the server can figure out that two computers in the same house are different since your laptop and phone no longer share the same ipv4 address but instead have two ipv6 address? Your phone and laptop can just have multiple ipv6 addresses and rotate through them regularly... as apple does by default https://support.apple.com/en-ca/guide/security/seccb625dcd9/... Security? NAT is not a f…

> NAT is not a firewall, I've only read that on HN, I've never heard this anywhere else. Since it's been a good 20+ years since my CCNA (and haven't needed to renew it since), could you please offer a real-world example where NAT is not a firewall w/ practical examples relating to 99.9% of cases of home use? I just can't get why people say this a lot here. NAT works and passes the grandma test. If grandma buys a crap…

> I've only read that on HN, I've never heard this anywhere else.

Well-regarded networking architect, author, and instructor:

* https://blog.ipspace.net/2011/12/is-nat-security-feature/

> NAT works and passes the grandma test.

So does my Asus with a default deny IPv6 rule on incoming connections.

You're more likely to click on a link that installs malware that attacks your network from the inside, and that attack works regardless of IPv4 or IPv6.

Treating a firewall as some impenetrable moat has not been network security practice for a decade(+), and waving around RFC 1918 address space like systems with a 10.8 or 192.168/16 can't get infected is lazy thinking. It leads to complacency: I'm behind NAT, I'm safe.

Re: Google Hits 50% IPv6

#362

Post by throw0101a »

doubled112 wrote: post #322
frantathefranta wrote: post #266

Earlier quoted context omitted.

Could you publicly shame the distro that had that issue? Pretty sure it should be the default (on NixOS at least it is).

Fedora doesn’t enable privacy extensions by default, if I recall correctly.

Debian does.

Re: Google Hits 50% IPv6

#363

Post by baby_souffle »

mahboi wrote: post #308
baby_souffle wrote: post #250

Earlier quoted context omitted.

> NAT / CGNAT has been doing the heavy lifting extending the life of the Internet; ipv6 has done jack shit. If v6 was useful and actually averted v4 exhausted we'd all be accessing v6 sites/addresses at this point. This is factually difficult to support. (Sent from my iPad which doesn’t have an ipv4 address… to hacker news which has an ipv6 address)

You've put yourself in a position where you can't access a lot of websites, including things like GitHub. That might be fine for you personally but isn't what most people do.

> but isn't what most people do.

Most people run dual stack and as $favoriteHost gets AAAA, their traffic moves over.

My broader point was that your use of overstatement and a false dichotomy isn't _helping_ us get to a world where IPv6 is dominant.

Re: Google Hits 50% IPv6

#364

Post by tonymet »

it’s safe to say that we will never see total adoption, not within 2 generations. We will taper around 65% at best.

Think about the migration plan, and nearly every positive force to move to ipv6 has been exhausted. Routing hardware, consumer hardware, server hardware & software all have the capability. Mobile deployments were a big driver of ipv6, and that didn’t reach the level of adoption expected. Now hosting providers are charging for ipv4 addresses, and it’s not having a measurable impact.

Most migrations start to hit the hockey stick well before this stage, and the taper occurs around 95%+ when outlier hardware or legacy devices are the last remnants. We are not seeing a pattern like that here.

Re: Google Hits 50% IPv6

#365

Post by mapkkk »

gertrunde wrote: post #191
JdeBP wrote: post #130

Just to add to the 'but the ISPs do not' anecdotes, it has been six months since someone last commented so it is probably time to mention this again on Hacker News: * https://havevirginmediaenabledipv6yet.co.uk/ A major ISP in the U.K., that said in a public statement on World IPv6 Day in 2011 that > As well as our core and access networks being capable of supporting IPv6, we're rigorously testing our entire network…

I once asked them if we could enable IPv6 on a 1Gb DIA circuit, and the response I got back was that "we can convert the circuit to IPv6, but you'll need to give up your IPv4." I don't think I bothered asking them again!! (Edit "them" = Virgin Media)

in my case, they did this without input from me.

I only found out because I could no longer access a swath of things I used to be able to.

not virgin media, but in the EU

Re: Google Hits 50% IPv6

#366

Post by JdeBP »

mlyle wrote: post #349
JdeBP wrote: post #130

Just to add to the 'but the ISPs do not' anecdotes, it has been six months since someone last commented so it is probably time to mention this again on Hacker News: * https://havevirginmediaenabledipv6yet.co.uk/ A major ISP in the U.K., that said in a public statement on World IPv6 Day in 2011 that > As well as our core and access networks being capable of supporting IPv6, we're rigorously testing our entire network…

We're finally getting there in the US, though. Top ASNs are >75% IPv6 capable. It's Optimum Communications and Frontier (my provider) that are really holding the numbers down at ~15% each. The latter is improving very slowly, but not a lot of evidence of change in the former.

Indeed. The U.S.A. is currently well above the U.K. in the APNIC statistics hyperlinked-to by the headlined article.

* https://stats.labs.apnic.net/ipv6

Re: Google Hits 50% IPv6

#367

Post by yesturi »

IgorPartola wrote: post #329
JdeBP wrote: post #130

Just to add to the 'but the ISPs do not' anecdotes, it has been six months since someone last commented so it is probably time to mention this again on Hacker News: * https://havevirginmediaenabledipv6yet.co.uk/ A major ISP in the U.K., that said in a public statement on World IPv6 Day in 2011 that > As well as our core and access networks being capable of supporting IPv6, we're rigorously testing our entire network…

The way to pressure ISPs to support IPv6 is stupid but effective: 1. Sites that help shoppers choose can add a big visual red flag to any ISP that doesn’t support IPv6. Consumers don’t know what IPv6 is by and large but they do understand seeing a big red flag. 2. Same thing for websites. Add a banner that says “hey your ISP doesn’t support proper internet connectivity which this site utilizes. Contact them to let th…

I think this is a classic chicken and egg problem and the only way to solve this issue is government regulation. Anyone aware of the mandatory IPv6 in Europe? I heard that the Chech Republic is doing something about it. I Poland, only Orange and probably TMobile supports it, the smaller ones - almost none.

Re: Google Hits 50% IPv6

#368

Post by BadBadJellyBean »

mahboi wrote: post #306
BadBadJellyBean wrote: post #40

Earlier quoted context omitted.

I assume for aggressive blocking the only prefix size will change. What is a /32 for IPv4 might become a /64 or smaller for IPv6.

Shouldn't blocking v6 also be based on /32 if you want the attacker's cost to be the same?

Well in the IPv4 world /32 would be a single IP or what a residential connection usually gets. With IPv6 you have 128 bits for the whole IP and usually a residential connection get get between a /64 to /48 prefix. Going above a /64 might hit other unrelated customers. Going to a /128 prefix would only block a single IP but since we started doing privacy extensions your computer will have multiple IPv6 addresses with a short lifetime which means that the user will be able to connect again soon after you block them. There are 18,446,744,073,709,551,616 IPs in a single /64 prefix so it would be useless to block every single one of them.

A more reasonable approach might be to block a /64 first, monitor if you get more blocks within the /56 block that contains the /64 and maybe block that.

Re: Google Hits 50% IPv6

#369

Post by whatever1 »

budoso wrote: post #323
whatever1 wrote: post #284

I would love to stop paying AWS for public ipv4 addresses. But simply it is impossible to go full ipv6, as many of isps of the clients do not support it. Currently there is no pressure to the isps to move to ipv6. In fact the incentives are OPPOSITE! They love charging for static IPs.

To be fair if Google stopped supporting it that’d be a pretty good incentive for the ISPs to get in line.

That is a great idea actually. It would be awesome to be implemented like 2-3 years ago. Now I don't think it will work at global scale, since the world looks for any excuse to move away from American influence.

Re: Google Hits 50% IPv6

#370

Post by boredatoms »

axus wrote: post #161

When I set up a "pure" (not really) IPv6 server, was surprised that Github does not support it. Without the voluntary operations listed at https://nat64.xyz/ , they'd be unreachable from IPv6.

Github’s lack of v6 is completely unforgivable
Post reply on HN