Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 Is A Disaster (but we can fix it)

matduggan.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: IPv6 Is A Disaster (but we can fix it)

#61

Post by hot_gril »

JohnFen wrote: post #58
hot_gril wrote: post #50

Earlier quoted context omitted.

That's true, but even the less memorable v4 addresses are easier to deal with and nicer on the eyes. And on a LAN with a NAT, you typically get memorable addresses like 192.168.1.2. Maybe the bigger issue was trying to get rid of NAT. People don't want every local network device to have a public IP and have to trust that the router's v6 firewall will do its job.

> People don't want every local network device to have a public IP I absolutely don't want this. But as I understand it, I can avoid this by assigning my machines the IPv6 nonroutable addresses fe80::/64. They're the equivalent of 192.168.* and 10.*

Same as the firewall, it's fine if it's done right. But does every machine get link-local v6 addresses by default? My Mac is set to "automatic," which I assume asks the router. Even if I use link-local, does every router (even crappy ones) respect the no-forward rule? This is along with several other aspects of my network changing to use v6.

Meanwhile, if someone sends a v4 packet with TCP port 22 to my router, it can't tell where to forward it even if it wanted to. It takes effort to do that, namely a port forwarding config.

Re: IPv6 Is A Disaster (but we can fix it)

#62

Post by JohnFen »

bauruine wrote: post #55
JohnFen wrote: post #54

Earlier quoted context omitted.

> Why is it so painful for you? Mostly because of the number of machines that I have to fix up and the fact that updating each of them involves a fair bit of time. My estimation is I'm looking at at least a week's worth of work, during which my network isn't fully functioning. It's also complicated by the number of devices I have that aren't possible to make work with IPv6 at all, which means I have to maintain some…

Going IPv6 only is a pain for sure but why not do dual stack and upgrade one by one and get comfortable with it first?

I could, sure, although if I'm going to do that, I may as well just put an IPv6 translation layer at my router level and keep everything internally at IPv4. Which I'm seriously considering doing as the path of least resistance, particularly since there are no special IPv6 features that I really want or need.

But the last time I mentioned half-measures here on HN, I got dumped on pretty harshly.

Re: IPv6 Is A Disaster (but we can fix it)

#63

Post by WorldMaker »

JohnFen wrote: post #45
WorldMaker wrote: post #42

Earlier quoted context omitted.

Compatibility breaks are always headaches. There's not "just broke a 'single' thing" when it comes to compatibility breaks. That is why strict semver suggests a major bump no matter how "small" a compatibility break appears to the developer. There is no such thing as a "simple" compatibility break to downstream users. In general, despite the complex vocabulary about most of it, in many ways IPv6 is simpler than IPv4.…

> in many ways IPv6 is simpler than IPv4. It's not really about whether or not IPv6 is simpler than IPv4, though. It's about how painful moving from IPv4 to IPv6 is. And it's very painful. If the only thing that changed between the two was that the IP address space is bigger, it would reduce the pain of changing. I'm certainly not going to claim that my experience is representative of anyone except for me, but the re…

> I think adopting it would have happened within a reasonable timeframe if it weren't as ambitious.

There's zero proof that an "extended IPv4" would have been adopted on a "more reasonable" timeframe, no matter how you define "reasonable" (faster, I guess is what you are arguing for?).

Exactly where and how do you expect "just add more address bits to IPv4" is an easier transition than IPv6?

The IPv4 header is a fixed size. You can't add more address bits without breaking existing routers. Period. End of technical story. You could embed the additional address bits in the next layer up (TCP/UDP) but you greatly increase the complexity of routing equipment by making it have to understand those layers, to what benefit? In the dual-stack real world we do that all the time with VPNs and STUN tunnels and other gateways and tunnels. We have those exact same tools, already, and those haven't made the transition any more "reasonable", have they?

But it's worse that while routers don't understand the extra bits, the parts of the addresses that get used (the prefixes small enough to fit in IPv4 headers) have to become massive NAT gateways and become massive gatekeepers of huge parts of the IP address space. We know from deep experience that IPv4 address allocation wasn't "equitable" (ARIN got way more space than RIPE and both got more space than AFRINIC and so on; companies like Microsoft and GE got /8 allocations just for asking in the right years).

Does it make that much sense to establish existing IPv4 holders as the forever "landlords" of the internet? That seems to me to only add more incentives to make the transition more unreasonable than IPv6: why support router initiatives that understand the additional address space when the IPv4 address holders can get "extra rent" if they don't, presumably charging all their "downstream" traffic for their gateway usage? We're in a time where IPv4 addresses have noticeable rental costs, I can't imagine what that would be like in a world where large parts of address space have to be on VPNs controlled by IPv4 owners. That doesn't sound to me like a good present or future for the IP protocol, no matter what.

Re: IPv6 Is A Disaster (but we can fix it)

#64

Post by JohnFen »

hot_gril wrote: post #61
JohnFen wrote: post #58

Earlier quoted context omitted.

> People don't want every local network device to have a public IP I absolutely don't want this. But as I understand it, I can avoid this by assigning my machines the IPv6 nonroutable addresses fe80::/64. They're the equivalent of 192.168.* and 10.*

Same as the firewall, it's fine if it's done right. But does every machine get link-local v6 addresses by default? My Mac is set to "automatic," which I assume asks the router. Even if I use link-local, does every router (even crappy ones) respect the no-forward rule? This is along with several other aspects of my network changing to use v6. Meanwhile, if someone sends a v4 packet with TCP port 22 to my router, it ca…

> But does every machine get link-local v6 addresses by default?

If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking.

> does every router (even crappy ones) respect the no-forward rule?

There may be broken ones, but it doesn't matter so much because your ISP won't route such addresses regardless.

Re: IPv6 Is A Disaster (but we can fix it)

#65

Post by bauruine »

JohnFen wrote: post #62
bauruine wrote: post #55

Earlier quoted context omitted.

Going IPv6 only is a pain for sure but why not do dual stack and upgrade one by one and get comfortable with it first?

I could, sure, although if I'm going to do that, I may as well just put an IPv6 translation layer at my router level and keep everything internally at IPv4. Which I'm seriously considering doing as the path of least resistance, particularly since there are no special IPv6 features that I really want or need. But the last time I mentioned half-measures here on HN, I got dumped on pretty harshly.

I don't think that exists and I can't imagine how a IPv6 translation layer with internally IPv4 addresses should work. What exactly do you want to do?

Re: IPv6 Is A Disaster (but we can fix it)

#66

Post by JohnFen »

unethical_ban wrote: post #57
hot_gril wrote: post #40

Since the main problem was address space, they should've just expanded it. Let everyone keep their old v4 addresses (with 0-padding), focus on the protocol upgrade, and give new users longer addresses for cheaper. You wouldn't even need DNS changes initially. Instead, v6 became a whole new thing with additional goals like removing NAT (which I'm not even convinced is a good idea), so of course there'd be way more fri…

Yes. Also, any change to the protocol was going to be a massive shift regarding network hardware. It wasn't ever possible to slap a few more bytes onto the address. If you're going to make a monumentap shift, why not do it right?

> If you're going to make a monumentap shift, why not do it right?

yes, that was the argument from the very beginning, and it's not without merit. I disagree with it, because it's making a monumental shift into one that is even more monumental and increases resistance to making the change at all.

But who knows? Both sides of this argument are just speculating.

Re: IPv6 Is A Disaster (but we can fix it)

#67

Post by hot_gril »

unethical_ban wrote: post #57
hot_gril wrote: post #40

Since the main problem was address space, they should've just expanded it. Let everyone keep their old v4 addresses (with 0-padding), focus on the protocol upgrade, and give new users longer addresses for cheaper. You wouldn't even need DNS changes initially. Instead, v6 became a whole new thing with additional goals like removing NAT (which I'm not even convinced is a good idea), so of course there'd be way more fri…

Yes. Also, any change to the protocol was going to be a massive shift regarding network hardware. It wasn't ever possible to slap a few more bytes onto the address. If you're going to make a monumentap shift, why not do it right?

It would still be a much smaller shift if they focused on only expanding the address, and I guess removing packet fragmenting while they're already changing the fields. Why not do it right, cause at least it gets done that way.

There have been other huge migrations pulled off in networking. HTTP->HTTPS is the first that comes to mind. Extra layer of security, no other changes. Browsers slowly made users more and more wary of unsecured sites, and it became easier for site admins to obtain SSL certs. Once plain HTTP was finally made uncommon, versions of SSL/TLS still got upgraded slowly. They also avoided making it too flexible and turning into a fragmented mess like email or XMPP, i.e. browsers strongly avoid self-signed certs and started banning old versions.

Re: IPv6 Is A Disaster (but we can fix it)

#68

Post by hot_gril »

JohnFen wrote: post #64
hot_gril wrote: post #61

Earlier quoted context omitted.

Same as the firewall, it's fine if it's done right. But does every machine get link-local v6 addresses by default? My Mac is set to "automatic," which I assume asks the router. Even if I use link-local, does every router (even crappy ones) respect the no-forward rule? This is along with several other aspects of my network changing to use v6. Meanwhile, if someone sends a v4 packet with TCP port 22 to my router, it ca…

> But does every machine get link-local v6 addresses by default? If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking. > does every router (even crappy ones) respect the no-forward rule? There may be broken ones, but it doesn't m…

> If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking.

You probably can, but as it's often said, most security breaches are caused by misconfiguration.

>There may be broken ones, but it doesn't matter so much because your ISP won't route such addresses regardless.

Yeah fair enough, I can trust my ISP to do that at least.

Re: IPv6 Is A Disaster (but we can fix it)

#69

Post by JohnFen »

hot_gril wrote: post #68
JohnFen wrote: post #64

Earlier quoted context omitted.

> But does every machine get link-local v6 addresses by default? If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking. > does every router (even crappy ones) respect the no-forward rule? There may be broken ones, but it doesn't m…

> If you use DHCP, then I think you can configure that. What I have in mind is to assign static IPs to all of my fixed machines anyway, and use DHCP to assign IPs to transient machines. Not sure if that's reasonable, but it's my current thinking. You probably can, but as it's often said, most security breaches are caused by misconfiguration. >There may be broken ones, but it doesn't matter so much because your ISP wo…

> You probably can, but as it's often said, most security breaches are caused by misconfiguration.

Yes, but that's no different with IPv4. What it really means is that we have to learn the intricacies of IPv6 in order to use it confidently. Right now, I am nowhere near comfortable that I have sufficient understanding. That can be fixed through enough study, but is also part of the friction in adopting IPv6.

Re: IPv6 Is A Disaster (but we can fix it)

#70

Post by p1mrx »

hot_gril wrote: post #50
p1mrx wrote: post #47

Earlier quoted context omitted.

> Cloudflare public DNS is 1.1.1.1. If I switch to ipv6, I get to use 2606:4700:4700::1111. You telling me that's an upgrade? The concept of vanity IPv4 addresses was invented in 2009, when Google acquired 8.8.8.0/24 from Level3. This is an emergent feature of a small, densely packed address space. IPv6 had existed for a decade (EDIT: not two decades) by that point, so you can't really blame the designers. Sprint con…

That's true, but even the less memorable v4 addresses are easier to deal with and nicer on the eyes. And on a LAN with a NAT, you typically get memorable addresses like 192.168.1.2. Maybe the bigger issue was trying to get rid of NAT. People don't want every local network device to have a public IP and have to trust that the router's v6 firewall will do its job.

You can number a LAN with fd00::/64 and use IPv6 NAT to reach the internet, so the addresses are even shorter than 192.168.1.x. It's just not commonly done that way.
Post reply on HN