6 ms·
Back in the days of blaster, if you were connected to a network with infected machines or had a public IP address because you were connected straight into your
by jmgao 2y ago
Back in the days of blaster, if you were connected to a network with infected machines or had a public IP address because you were connected straight into your cable modem, you would get infected in the windows installer before it finished installing. Nowadays, everything is behind NAT and there aren't any infected Windows XP machines left on your local network, so that's not a problem anymore.
- lupusreal 2y agoFor some reason whenever somebody suggests that NAT might have security benefits, there is usually some hysterical screeching about how that isn't true. Often seen in IPv6 discussions.
- rcxdude 2y agobecause it's unnecessary to get the same benefit. Being behind a firewall would have the same effect (and any ipv6 deployment will have this), it's just that NAT requires this. It's like saying eating a spoonfull of cinnamon has health benefits because it hydrates you when you have to drink a glass of water afterwards: you could just drink the water.
- throwaway1105q 2y agoI don't quite understand what you mean by "any ipv6 deployment will have this". When my ISP switched to IPv6, my internal devices were exposed to the internet and the only thing that stopped the incredible amount of bot traffic was my own on-device firewall that I explicitly turned on and configured. Luckily I don't have any smarthome stuff, not sure how I'd configure a firewall on a lightbulb. These devices didn't have a public IPv4 before that. And a bonus - the ISP didn't say anything about this possible consequence, just "we're making some changes". NAT has more benefits - I don't want anyone to know how many devices I have at home, I don't want anyone to know which one I'm using to access their website, I don't want anyone to try guess the OS and version of my devices, etc. And now I'm scared to have a simple DLNA media server because I can't just install WireGuard on the TV. I'm probably going to buy a router and make my own NAT soon (don't have access into the ISP modem). I felt better when the whole municipality had a single IP address. A lot of bullshit ads - means the targeting wasn't working. Now they're way too good.
- rcxdude 2y agoWell, that sounds like a colossal misconfiguration on the ISP's part. A firewall blocking incoming requests has been standard part of ISP routers for a long time.
- throwaway1105q 2y agoOn the other hand... What exactly is the benefit of IPv6 then? I thought the point was to make all my devices addressable on the public internet. How is it useful if the ISP firewall blocks my servers? And yes, incompetent ISPs are the norm.
- Spooky23 2y agoThe biggest benefit is exponentially higher complexity, assuring continued job growth for network engineers.
- bzzzt 2y agoThe point is not needing a NAT translation table and running out of ports on your router. My provider also delivers an IPv6 configuration with all ports closed. I can enable incoming traffic for the devices that need it.
- throwaway1105q 2y agoRunning out of ports how? Someone is hosting 65536 public services in their home network? Why not just pay for an additional public ipv4 then? I can't configure anything technical about my internet. Any change is paid, and often simply not possible.
- toast0 2y agoRunning out of ports is usually a misunderstanding, but a device doing stateful NAT will have a limit on how many states it can manage, and it's usually not fun when it goes over the limit.
- tflol 2y agoThis looks like the usual ipv6 kool aid batshit. I don't want a bunch of kids and enemy states poking at and port scanning my laptop directly, regardless of whether or not I have a firewall enabled. And, no, I don't think it's practical for everyone and their grandma to "just set up a bastion"
- rcxdude 2y agoI mean, they'd need to figure out your IP address beforehand, something that's a lot harder with ipv6. You've also got a much better chance of punching a packet through a NAT than an ipv6 firewall (and it's now expected behaviour for a lot of applications, as NAT makes it too difficult to just make connections directly).
- LegionMammal978 2y agoWouldn't IPv6 firewalls configured for typical users (i.e., denying unrecognized incoming connections) pose a similar barrier to making direct connections reliably on the application level? Not every user will be willing or able to open a hole in their firewall for every shiny new application that wants one.
- rainonmoon 2y agoThey wouldn't need to figure out anything. The "kids and enemy states" are just hosing address ranges. I don't agree with the above commenter that NAT offers any meaningful security in this regard (now they're just hosing your consumer router instead which is probably less secure than the average updates-installed Defender-enabled Windows box). But you're both making points about security through obscurity in different ways.
- tflol 2y ago> now they're just hosing your consumer router There is a dramatic difference in effort between ( owning a device ) and ( owning a router, configuring network access to the device, then owning the device ). Also psychologically: If I was a rock hard piece of shit and I knew I was at the doorstep of a personal device, I would treat it much more aggressively than a router. I suppose maybe that's just me and not the kids and enemy states.
- 63stack 2y agoIsn't NAT slipstreaming a "real" vector? https://samy.pl/slipstream/ https://samy.pl/slipstream/
- deleted 2y ago[deleted]
- jeroenhd 2y agoNAT slipstreaming only works if your router allows protocols like SIP, FTP, WebRTC, and other such protocols that NAT breaks, luckily. Unfortunately, I'm pretty sure that's all routers I've ever seen. You can protect yourself if you're willing to break web applications and applications built on web technology. Just disable all of the SIP ALGs in your router and you'll have the security of IPv6 on IPv4!
- LegionMammal978 2y agoI think the usual security objection is that if the NAT router receives a packet from the outside, with its destination set to a local address, the router will just let it through, in the absence of a firewall. But as far as I can tell, that's only relevant for an attacker who can MITM the connection between the local router and the next ISP router, since clearly the ISP wouldn't know who to forward the local address to. I'd think it isn't within the threat model of the "typical internet user" who'd be running such a poorly-configured network.
- throw0101c 2y ago> For some reason whenever somebody suggests that NAT might have security benefits, there is usually some hysterical screeching about how that isn't true. It is not the address translation mechanism that does the protecting but rather the state tracking. Until very recently I was with an ISP with IPv6, and things like my home printer had IPv6 addresses—but just because they were globally addressable did not mean that they were globally reachable.
- tempie2024 2y agoFirewalls are a thing!
- globular-toast 2y agoBecause it's really important to know the difference between NAT and a firewall if you are into networks. And IPv6 discussions generally involve such people. In this case it's nothing to do with NAT and everything to do with being behind a firewall.
- tetris11 2y agoHerd immunity, huh?
- zamadatix 2y agoMore that NAT forces your network gear to filter inbound connections from the outside internet by default. This works with one device behind one router as a billion devices behind a billion routers.
- nubinetwork 2y agoI would guesstimate about 20-30 seconds was all you needed to be connected for to pick up blaster...
- cqqxo4zV46cp 2y agoYep. Before I knew what it was, I genuinely thought that an issue occurred when my connection established. That’s how fast it was, and it was consistently that fast.
- snakeyjake 2y ago>Nowadays, everything is behind NAT and there aren't any infected Windows XP machines All end-user PCs have been behind NAT since the late 90s unless the system was a dialup straggler. Enterprise users raw-dogging the internet only have themselves to blame.
- jmgao 2y agoThis is absolutely false. This only became common when wireless networking became ubiquitous, which wasn't until probably a decade later.
- InfamousRece 2y agoWhen I got my first broadband Internet connection my contract explicitly prohibited me from using NAT. Apparently my Internet provider was concerned I would use NAT to connect multiple computers thus “stealing” bandwidth. This concern was not completely unfounded since people sometimes would set up one connection and share it with neighboring apartments. Also having one computer per household was normal back then.
- ctippett 2y agoI live in an apartment block where each flat is likely spending £30-60 per month on broadband. Even accounting for the odd power user, I reckon we could get away with sharing a 1-2 Gbps connection and benefit from the collective cost savings. Legal accountability aside, I kinda like the idea of a neighbourhood network commune.
- kccqzy 2y agoCirca 2003 when we got the first WiFi access point set up (with no password), we started noticing people with laptops appearing next to our homes. It took us a few seconds to realize they found a free WiFi and walked around to find a spot with better signal.
- zinekeller 2y agoEven discounting dial-up, this really depends on where you are in the world at the time. PPPoE and direct hookup (via the cable/ADSL modem) are still relatively common where I was at the time that Blaster was roaming around, while some countries have forced CGNAT even before CGNAT became a common word, usually for "protecting the children" like Cleanfeed (and even discounting that, event at the time you could still get IPv4 effortlessly there had been, and certainty there are still, crappy ISPs which don't really care about direct connections).
- PaulHoule 2y ago[flagged]