Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

81–90 of 198 posts

Re: New patches allow building Linux IPv6-only

#81

Post by zamadatix »

budman1 wrote: post #50
iamnothere wrote: post #42

This may be a “joke”, but it’s disturbing to see people clamoring to deny others their freedom in a FOSS context. Want to use IPv6? Fine. But don’t try to remove v4 support from people who have built stable networks around it. You won’t be able to force the world to switch to IPv6 with tricks like this, any more than you can force old industrial machines to stop using ancient 486es as controllers. There is a lot of o…

*removed comment. I didn't know this was an April fools joke. sorry for my lack of a clue....

The patchset is an April fools joke and even then it's not going this far.

Re: New patches allow building Linux IPv6-only

#82

Post by saltcured »

craftkiller wrote: post #70
jrm4 wrote: post #54

Earlier quoted context omitted.

[flagged]

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it. https://www.rfc-editor.org/rfc/rfc8981.html

I feel like this is a silly narrowing of the problem for normal, retail users. My priority isn't masking "the number of addresses" or devices. My desire is to not have a persistent identifier to correlate all my traffic. The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID.

I'm not an IPv4 apologist though. Clearly the NAT/DHCP assignments from the ISP are essentially the same risk, with just one shallow layer of pseudo-obscurity. I'd rather have IPv6 and remind myself that my traffic is tagged with my customer ID, one way or another.

Unfortunately, I see no real hope that this will ever be mitigated. Incentives are not aligned for any ISP to actually help mask customer traffic. It seems that onion routing (i.e. Tor) is the best anyone has come up with, and I suspect that in today's world, this has become a net liability for a mundane, privacy-conscious user.

Re: New patches allow building Linux IPv6-only

#83

Post by ErroneousBosh »

Sanzig wrote: post #37
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP?

What would be the advantage in it?

Re: New patches allow building Linux IPv6-only

#84

Post by wredcoll »

everdrive wrote: post #33
bornfreddy wrote: post #19

Earlier quoted context omitted.

> Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.

I'm not confused about the NAT / firewall distinction, but it might be nice if my ISP didn't have a constant, precise idea of exactly how many connected devices I owned. Can that be _inferred_ with IPv4? Yes, but it's fuzzier.

Aren't your home addresses assigned by your local router?

Re: New patches allow building Linux IPv6-only

#85

Post by craftkiller »

bornfreddy wrote: post #18

IPv6 vs. 4 is like Python 3 vs. 2, just worse.

There are genuine improvements in IPv6 aside from the abundance of addresses. The two that immediately come to my mind are:

1. SLAAC means routers no longer need to keep a record of each client on the network. With DHCP, the router had to maintain a table of which addresses had been assigned and getting an address involved 2-way communication. With SLAAC the router just periodically broadcasts the prefix to the network and any device that wants an address can just listen to that broadcast and assign themselves an address within that prefix without having to inform the router and without the router needing to maintain a table of assigned addresses. (2-way communication is still possible since devices can solicit a broadcast but it is not necessary)

2. With IPv6, middleboxes are no longer allowed to fragment packets. The only device that can fragment a packet is the original sender. If any segment along the path has a lower MTU than the size of the packet, the original sender is notified and then they can fragment the packet.

Re: New patches allow building Linux IPv6-only

#86

Post by degamad »

iamnothere wrote: post #69
UltraSane wrote: post #67

Earlier quoted context omitted.

You can have IPv6 firewalls emulate the behavior of NAT so it blocks unsolicited inbound traffic while allowing outbound traffic. If you get a /48 form your ISP you could rotate to a new IP address every second for the rest of your life.

Right, but if you’re messing around as a naive learner it’s easy to accidentally disable that or completely open up an IP or range due to a bad rule. It’s a lot harder to accidentally enable port forwarding on a NAT.

> It’s a lot harder to accidentally enable port forwarding on a NAT.

It's probably less than three clicks on most home router web UIs.

Re: New patches allow building Linux IPv6-only

#87

Post by donmcronald »

Sanzig wrote: post #37
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP?

Big companies would abuse that beyond belief. Back around the late 90s ISPs wanted to have everyone pay per device on their local networks. NAT was part of what saved us from that.

IMO, IPv6 should have given more consideration to the notation. Sure, hex is "better in every way" except when people need to use it. If we could just send the IPv6 designers back in time, they could have made everyone use integer addresses.

    # IPv4 - you can ping this
    ping 16843009
    # IPv6 - if they hadn't broke it :-(
    ping 50129923160737025685877875977879068433
    # IPv7 - what could have been :-(
    ping 19310386531895462985913581418294584302690104794478241438464910045744047689
It's simple, unambiguous, and scales infinitely.

Re: New patches allow building Linux IPv6-only

#88

Post by craftkiller »

jrm4 wrote: post #77
craftkiller wrote: post #70

Earlier quoted context omitted.

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it. https://www.rfc-editor.org/rfc/rfc8981.html

[flagged]

Temporary addresses are enabled by default in OSX, windows, android, and iOS. That's what, like 95% of the consumer non-server market? As for Linux, that's going to be up to each distro to decide what their defaults are. It looks like they are _not_ the default on FreeBSD, which makes sense because that OS is primarily targeting servers (even though I use it on my laptop).

Re: New patches allow building Linux IPv6-only

#89

Post by gertop »

patmorgan23 wrote: post #73
Incipient wrote: post #59

The main thing I don't like is type-ability. Even now I type in 192.168.1.14 to connect to my mates computer to play satisfactory. No way in heck am I trying in an ip6!

Hmmmm maybe someone should come up with a SYSTEM to organize NAMES for ips, maybe using hierarchical DOMAINs.... Oh wait.

Your bad attempt at humor makes it quite clear that you've never dealt with network engineering or administrating to any extent.

Admitting that ipv6 has some downsides, however minor they may seem to you, won't hurt your quest to render ipv4 obsolete.

In fact being less insufferable is how you win people to your causes, not by laughing at their genuine albeit minor issues.

Re: New patches allow building Linux IPv6-only

#90

Post by cyberax »

Sanzig wrote: post #37
everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP?

Suddenly, your smart lightbulb is accessible by everyone. Not a great idea.

> With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers.

There is no guarantee with IPv6 that hole punching works. It _usually_ does like with IPv4.

Post reply on HN