Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I spent a week without IPv4 to understand IPv6 transition mechanisms

apalrd.net

Post reply on HN
Print view View original

371–380 of 511 posts

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#371

Post by Dalewyn »

xnyanta wrote: post #366
Dalewyn wrote: post #356

Earlier quoted context omitted.

"Yes you would know exactly, because every hex-colon monstrosity has a predictable hex-colon monstrosity derived from its hex-colon monstrosity." If the problem wasn't obvious, the problem is that IPv6 addresses (and also MAC addresses) are not human readable. IPv4 addresses, on the other hand, are. IPv6 adoption might be farther along if the addresses were human readable instead of eye-rolling machinations of a smal…

Adding A-F to the 0-9 existing digits in ip addresses makes them non-human readable? Give me a break. We've had something human-readable since the dawn of the internet: it's called DNS and works with both IP families.

Tell me Google DNS's IPv6 addresses without looking them up. I won't wait.

Sometimes we need to deal with raw IP addresses instead of abstraction layers, and IPv6 fails hilariously because it clearly goes beyond the realm of direct human consumption.

You saying a non-human readable thing is human readable if it's passed through an abstraction layer to make something human readable only reinforces the argument IPv6 is not human readable.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#372

Post by BlueTemplar »

unethical_ban wrote: post #105
michaelt wrote: post #62

Earlier quoted context omitted.

Presumably what thesuitonym means is: Imagine if I'm a medium-sized ISP, or a medium-sized software company, or a medium-sized website. There's a bunch of hassle involved in deploying IPv6. Who knows what it'll do to my users' privacy? Or whether everyone's firewall rules will keep working right? Or whether it'll have some random impact on e-mail deliverability? Or something else? The main benefit of IPv6 is providin…

If home router manufacturers would get their shit together, IPv6 would not be hard to deploy. I get it, it's chicken and egg, but nothing about IPv6 is inherently more difficult than IPv4 other than the length of the address. The reason IPv6 on a home network is still difficult is because the routers everyone buys at Best Buy still blow at supporting IPv6. Ubiquiti blows at supporting IPv6. It is laziness and/or inco…

What I don't understand is why governments seemingly ignore this problem ??

Look at what they did with broadcast digital TV : it was announced that it would be illegal in a couple of years to sell hardware not compatible with the new standard, then a couple of years later on illegal to sell hardware compatible with the old standard...

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#373

Post by gegtik »

tinus_hn wrote: post #308
tenebrisalietum wrote: post #167

Earlier quoted context omitted.

UPnP? Also STUN makes your private addresses reachable without you making any mistake at all. Your comment is a good example of the NAT cargo cult mentality that is damaging to the Internet.

Similarly, your comment is a good example of the anti NAT cargo cult mentality that people think is smart but really isn’t. The reality is that NAT has greatly improved the security of the internet, because before NAT people were exposing everything, including services like Windows file sharing, to the internet. NAT enabled those people to use multiple devices in their home and in return prevented them from unwitting…

3 cheers for useful defaults

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#374

Post by HyperSane »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

Verizon wants $500 to enable IPv6 on an LTE SIM.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#375

Post by chillfox »

throw0101c wrote: post #160
thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

> Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Globally routable ≠ globally connectible. Your (stateful) firewall will still by default block any incoming connection attempts if they are not replies to an initial outgoing connection. It's just that it will no longer be necessary to go through the rigamarole of STUN, TURN, ICE, etc, th…

Minecraft is a bad example here as it supports advertising the port in DNS.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#376

Post by zamnos »

throw0101c wrote: post #323
gxt wrote: post #313

Earlier quoted context omitted.

This isn't about an attack scenario from this vector, it's about preventing reconnaissance that might yield helpful results to an adversary that can exploit it via any other vector.

> […] that can exploit it via any other vector. And what are those vector(s)? Besides compromising a machine that is already inside per the above (which can then do scanning / lateral moves), or perhaps physically getting inside the premises (in which case a scanner can be physically installed to examine the network), what attack are you protecting against ? Can you give me a link about an attack that knowing the top…

Just because you've popped a box on the inside doesn't mean you automatically know everything about the network. It doesn't give you a mirrored port on the network switch. It doesn't mean ICMP is enabled, it doesn't automatically tell you what ports are open or what they serve. And any decent security team is going to see your nmap blast in the IDS and kick that box in jail.

Seems intellectually dishonest not to acknowledge that making things easier, just y'know, makes things easier. Keeping attackers, who want to do you harm, in the dark as much as possible seems important to me.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#377

Post by magicalhippo »

zoredache wrote: post #358
magicalhippo wrote: post #179

Earlier quoted context omitted.

But not other services like NTP, so DHCPv6 is still needed.

Create a DNS name ntp.yourdomain.example.org that points at your internal ntp servers. Configure your ntp clients to use the name, and maybe add a pool.ntp.org entry or two into your configs.

> Configure your ntp clients to use the name

So how do you do this hands-off, ie without manually changing things on the clients, without DHCPv6?

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#378

Post by arka2147483647 »

Whenever i read these ipv6 discussions, i cant help to think there is a huge disconnect between users and designers of ipv6:

- Designers think globally routable internet is a huge achievement

- Users just want to hide their devices from the hellscape that is modern internet, with all its threats

These are fundamentally different approaches

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#379

Post by fulafel »

arka2147483647 wrote: post #378

Whenever i read these ipv6 discussions, i cant help to think there is a huge disconnect between users and designers of ipv6: - Designers think globally routable internet is a huge achievement - Users just want to hide their devices from the hellscape that is modern internet, with all its threats These are fundamentally different approaches

I'm a user and I think they are compatible requirements and support each other well.

The alternative, having ambiguous addresses, makes systems hard to reason about and monitor, and add compplexity - eg when inevitably "internal" networks end up connected to each other in various kinds of reorganisations resulting in misconfigurations because nobody can tell anymore what the ambigous rule about a 10.xx address meant. Complexity and anbiguity are main enemies of security because you can only secure what you can understand well.

NATs are also hard to reason about in that there's no real spec about what kind of incoming traffic they allow and when. The NAT function is designed to facilitate communication in face of connectivity hurdle presented by the addressing, not limit communication.

Re: I spent a week without IPv4 to understand IPv6 transition mechanisms

#380

Post by qalmakka »

thesuitonym wrote: post #28

Everyone always goes with the "You don't need NAT, everything is globally routable!" argument, as if that's something that anybody wants. Everything on my network is going to go through my firewall anyway. I don't want anything on my network to be globally routable. Of course, this is not a good reason to not use IPv6, don't get me wrong. It's a problem that's easy to overcome, I just think it's not a good way to get…

NAT is not only bad because you don't have publicly routable addresses, but because it's a hack and a pretty "clever" one at that, aka, incredibly nasty.

If we had networking protocols that took into account the complexities of private addresses it could probably work - but we don't have such a luxury. The entire TCP/IP stack assumes peer to peer connections, and NAT is literally a spanner in the works for all that.

Post reply on HN