Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New patches allow building Linux IPv6-only

phoronix.com

Post reply on HN
Print view View original

91–100 of 198 posts

Re: New patches allow building Linux IPv6-only

#91

Post by vel0city »

donmcronald wrote: post #87
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? Big companies would abuse that beyond belief. Back around the late 90s ISPs wanted to have everyone pay per device on their local networks. NAT was part of what saved us from that. IMO, IPv6 should have given more consideration to the notation. Sure, hex is "better in every way" except when people need to use it. If we could just send the IPv6 designers back in t…

> Back around the late 90s ISPs wanted to have everyone pay per device on their local networks. NAT was part of what saved us from that.

But with IPv6 a single device may have multiple addresses, some of which it just changes randomly. So this idea that they'll then know how many devices you have and be able to pay per device isn't really feasible in IPv6.

A single /64 being assigned to your home gives you over 18 quintillion addresses to choose from.

If the ISP really wanted to limit devices they'd rely on only allowing their routers and looking at MAC addresses, but even then one can just put whatever to route through that and boom it's a single device on the ISP's lan.

Re: New patches allow building Linux IPv6-only

#92

Post by NewJazz »

donmcronald wrote: post #87
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? Big companies would abuse that beyond belief. Back around the late 90s ISPs wanted to have everyone pay per device on their local networks. NAT was part of what saved us from that. IMO, IPv6 should have given more consideration to the notation. Sure, hex is "better in every way" except when people need to use it. If we could just send the IPv6 designers back in t…

It's simple, unambiguous, and scales infinitely

This is a joke right? How does it "scale infinitely"? It is clearly ambiguous in your ipv7 example.

Re: New patches allow building Linux IPv6-only

#94

Post by vel0city »

everdrive wrote: post #33
bornfreddy wrote: post #19

Earlier quoted context omitted.

> Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.

I'm not confused about the NAT / firewall distinction, but it might be nice if my ISP didn't have a constant, precise idea of exactly how many connected devices I owned. Can that be _inferred_ with IPv4? Yes, but it's fuzzier.

The ISP still doesn't know how many devices are connected, because a lot of those devices are using randomized and rotating IPs for their outbound connections.

Re: New patches allow building Linux IPv6-only

#95

Post by [deleted] »

cyberax wrote: post #90
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? Suddenly, your smart lightbulb is accessible by everyone. Not a great idea. > With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers. There is no guarantee with IPv6 that hole punching works. It _usually_…

[deleted]

Re: New patches allow building Linux IPv6-only

#96

Post by hrmtst93837 »

rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

[flagged]

Re: New patches allow building Linux IPv6-only

#97

Post by vel0city »

Incipient wrote: post #59

The main thing I don't like is type-ability. Even now I type in 192.168.1.14 to connect to my mates computer to play satisfactory. No way in heck am I trying in an ip6!

Why not just type in "mates-pc" and have functional mDNS and not have to memorize a bunch of numbers?

Why not just expect your OS's DNS setup to actually just work?

Re: New patches allow building Linux IPv6-only

#98

Post by bombcar »

LegionMammal978 wrote: post #39
lxgr wrote: post #26

Earlier quoted context omitted.

> nobody cares about NAT at home. Only because most people don't know how NAT is hurting them, and because corporations have spent incredible resources on hacking around the problem for when peer to peer is required (essentially only for VoIP latency optimization and gaming). NAT hurts peer to peer applications much more than cloud services, which are client-server by nature and as such indeed don't care that only ou…

Even in a NAT-less world, the common advice is to use a firewall rule that disallows incoming connections by default. (And I'd certainly be worried if typical home routers were configured otherwise.) So either way, you'd need the average person to mess with their router configuration, if they want to allow incoming P2P connections without hole-punching tricks. At best, the lack of NAT might save you an address-discov…

UPnP has covered a huge percentage of use cases that actual users care about, and those who it doesn't cover are often able to do their own customization.

Re: New patches allow building Linux IPv6-only

#99

Post by Marsymars »

cyberax wrote: post #90
Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

> Why don't you want every device to have a public IP? Suddenly, your smart lightbulb is accessible by everyone. Not a great idea. > With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers. There is no guarantee with IPv6 that hole punching works. It _usually_…

> Suddenly, your smart lightbulb is accessible by everyone. Not a great idea.

The answer here is kinda that Wi-Fi isn't an appropriate networking protocol for lightbulbs (or most other devices that aren't high-bandwidth) in the first place.

Smart devices that aren't high bandwidth (i.e. basically anything other than cameras) and that don't need to be internet accessible outside of a smart home controller should be using one of Z-Wave/Zigbee/Thread/LoRaWAN depending on requirements, but basically never Wi-Fi.

Re: New patches allow building Linux IPv6-only

#100

Post by iamnothere »

degamad wrote: post #86
iamnothere wrote: post #69

Earlier quoted context omitted.

Right, but if you’re messing around as a naive learner it’s easy to accidentally disable that or completely open up an IP or range due to a bad rule. It’s a lot harder to accidentally enable port forwarding on a NAT.

> It’s a lot harder to accidentally enable port forwarding on a NAT. It's probably less than three clicks on most home router web UIs.

Very hard to make all those clicks accidentally. But anyway I’m talking about pf/iptables rules, not web UIs.
Post reply on HN