Dagger2

4 ms·

1.
by Dagger2 14d ago
Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will. How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken out at actually
2.
by Dagger2 14d ago
It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.
3.
by Dagger2 14d ago
No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.
4.
by Dagger2 1mo ago
It was engineered like that. It was known from the start that having a flag day wasn't possible ( https://datatracker.ietf.org/doc/html/rfc1726#section-5.5 ): We believe that it is not possible to have a
5.
by Dagger2 1mo ago
NAT is accepted for transition purposes; for example NAT64 makes it trivial to connect from v6-only clients to v4 servers, and is used by some large ISPs (e.g. T-Mobile in the US) to avoid running v4 inside their access network.
6.
by Dagger2 2mo ago
But v6 _is_ backwards compatible though? It's got dual stack, Teredo, 6to4, 6rd, 6over4, ISATAP, 6in4/4in6, NAT64/DNS64, 464xlat, DS-lite, MAP-T/E, 4rd, LW4over6... how is this not backwards compatible? You could make a
7.
by Dagger2 2mo ago
All you've done there is reinvent v6 with a combination of dual stack, NAT64 and 6to4, plus add a flag day. You haven't fixed any of the problems involved in deploying v6, and you added a step that was known 35 years ago to be imp
8.
by Dagger2 2mo ago
SLAAC-generated addresses will stay the same so long as the prefix and your MAC address stay the same, so there should be no need to do static leases. Also... service discovery. Needing static addresses is a kludge.
9.
by Dagger2 3mo ago
People running servers don't seem to be reliably capable of making sure that either pMTUd works or isn't needed on their network, so... it is indeed broken on random servers. We've mostly decided to go with TCP MSS clamping r
10.
by Dagger2 3mo ago
That's basically no burden at all. If we cut the address length down to increase throughput, we would get a one-time increase of about 0.8% -- but consider how much faster Internet connections have gotten over the past 30 years. They&#
11.
by Dagger2 3mo ago
There were always expected to be v4 hosts on the Internet effectively indefinitely. That's not a failure condition for v6. "There are a couple of v4-only hosts out there somewhere" would be kind of irrelevant if most ISPs sto
12.
by Dagger2 3mo ago
Except you are, because all the same work needs to be done. > You can use the 8-byte addresses earlier if you want You can't have both this and "The 8-byte phase only starts when v4 has been abandoned" simultaneously. Deci
13.
by Dagger2 3mo ago
$ wget -4 https://github.com/HackerNews/API Resolving github.com (github.com)... 140.82.114.4 Connecting to github.com (github.com)|140.82.114.4|:443... failed: Network is unreachable. $ git clone https:/
14.
by Dagger2 3mo ago
I think the span would be about the same, or smaller even, if you limited yourself to a granularity of 4 bits for v6. Allocations are often rounded to 4 bits in v6 because it correlates to exactly one character of the v6 address. I'd a
15.
by Dagger2 3mo ago
Do I? I don't have v4 on this machine and I can reach GitHub, so that appears to be untrue. Also GitHub would need to continue having v4 so that v4 users could reach it, so it's untrue from that perspective too. At some point or a
16.
by Dagger2 3mo ago
Let's assume that's true... so what? That doesn't tell us anything about how long migrations like this normally take.
17.
by Dagger2 3mo ago
Windows, Linux, OSX, Android and iOS all ship with v6 enabled by default out of the box, so it's already turned on without you needing to think about it. You have to deliberately go out of your way for this not to be the case. > If
18.
by Dagger2 3mo ago
People are at work during the week, and work networks have a lower average deployment of v6 then home networks do. As evidence, you can also see the impact of holidays and COVID-19 lockdowns on the size of the dips.
19.
by Dagger2 3mo ago
If we're talking tangible, real-world threats in existing ISPs, then NAT is doing nothing to protect you. In fact it's doing the exact opposite, because without NAT you wouldn't be able to connect out from your network. Eve
20.
by Dagger2 3mo ago
Google's stats claim that it's 10-20ms for many countries, for example both the US and Canada show the latency impact of v6 as being -10ms. This is per round trip too -- between the connection handshake, congestion window slow-sta
21.
by Dagger2 3mo ago
I don't have to imagine, because that's how things are right now for the billions of people using v6, and it's fine.
22.
by Dagger2 3mo ago
I'm in Europe and I use a tunnel from HE for v6. I feel like that's something I would have noticed if it was as widespread as you make it sound.
23.
by Dagger2 3mo ago
Try `ip link set mtu 1280 dev eth0` (or equivalent for your OS). pMTUd breakage exists on v6 just like it exists on v4, and requires workarounds just like it does on v4. I get the impression a lot of people are applying a workaround on v4 b
24.
by Dagger2 3mo ago
I've heard plenty of accounts from people (and these were techy people even, not just the ones who only go to Facebook and think that's the Internet) who lost v4 and didn't even realize for days, so I'm not sure how true
25.
by Dagger2 3mo ago
I have no v4 on this machine. I'd disable the v4 stack on it if that was a thing Linux could do, but as it stands it's just sitting there doing nothing. The thing you're claiming is not going to happen is something I'm a
26.
by Dagger2 3mo ago
You have to do that with range bans in v4 too, since you have no idea how big the pool of addresses a user can pull from is -- and with CGNAT in the picture you're kind of doomed to banning legitimate customers on v4 no matter what you
27.
by Dagger2 3mo ago
Data exfil is basically impossible to detect/block with IPv6? What? No. It's no easier or harder than it is in v4. I'd also question the Rube-Goldberg-ness part, given how straightforward v6 is compared to the contortions we
28.
by Dagger2 3mo ago
What ridiculous overdimensioning? L2 addresses are 64 bits, and L3 has to be bigger than L2 because L3 acts as an aggregation layer over L3. From staring at RFC 3194, I'd say the minimum size for L3 is about 80 bits. v6 is 128 bits, wh
29.
by Dagger2 3mo ago
If my firewall logs are representative, about 2%.
30.
by Dagger2 3mo ago
Why the double standard? v6 already gives you what you're asking for here: you can turn it on without thinking about it, but actually using the extra addresses from it requires reconfiguring some things (not everything, mind). Why is t

More ›