News for hackers. Stuff that matters.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by phicoh on Monday January 04, 2016 @10:23AM (#10836016)
The killer feature of IPv6 is that is has more addresses than IPv4. For anything else, for every good feature of IPv6 there are a couple of bad features.

So if you look at it, if you want to delay investments as long as possible, you wait for IPv4 addresses to run out before moving to IPv6.

And guess what, ARIN ran out only last summer. APNIC ran out almost 5 years.

So for any big company that doesn't really grow, why do IPv6, you have enough IPv4 addresses.

For any small company, in many cases you now have to buy addresses on the open market. Doable, but not nice.

And small companies wanting to become big companies? They are out of luck. Even if they can buy the addresses they need, it will be insanely fragmented.

Even Microsoft found out that for their corporate network, they don't really have enough IPv4 addresses and for some reason they also don't want to buy them in large quantaties. So they are trying to move to IPv6 internally.

Of course, this creates a very complex network effect. Big companies have no real incentive to offer IPv6, and small companies cannot switch to IPv6 only if big comanies don't support it.

Fortunately, some big companies do run out of IPv4 addresses so they do start using IPv6 to offload their carrier grade nat boxes.

For some new markets, say vehicle-to-vehicle communication, IPv4 is not an option. So that is likely to be IPv6 from day one.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by massysett on Monday January 04, 2016 @11:13AM (#10836355)
I bet that legacy desktops and Web servers will be IPv4 for as long as they exist. There will never be an impetus to convert these.

If "Internet of Things" takes off, those things will be IPv6. Then you can give an IP address to every thermostat, every light bulb, every fire sprinkler head, every shelf tag price readout (saw some LCD shelf tags at a Whole Foods near Houston), etc. Those things don't care if they can't talk to some legacy Web site.

Then, in twenty years, everything on IPv4 is some creaky obsolete thing...sort of like how we have Windows XP things around now that aren't being replaced for various good reasons.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by phicoh on Monday January 04, 2016 @11:28AM (#10836446)
If with legacy web server you mean a dedicated server somewhere in a colo that has an IPv4 address, then yes. You can keep that until parts of the internet will no longer have any connection to IPv4 anymore.

If you expect to move that server, say to move to a new colo provider, do you get an IPv4 address there? If you have to pay extra each month for IPv4 and get IPv6 for free, do you pay?

Legacy desktops, there are these things like youtube, netflix, they eat huge amounts of bandwidth. As an ISP you don't want that through your carrier grade NAT boxes. Better try to get customers to use IPv6.

These days many web pages are insanely loaded with ads, trackers, etc. Lots of connections, again really bad for CGN.

Big CGN boxes are also really bad for geolocation. IPv6 is better for that.

There is also reason to believe that gaming behind carrier grade NAT is going to be pain.

Finally, if there was one group of products supporting IPv6 early on, it was operating systems. Even XP can do IPv6. Web browsers support IPv6 for a long time now. So as soon as the network provides IPv6, just about all desktops pick it up and start using it.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by pjc50 on Monday January 04, 2016 @11:38AM (#10836522)
If you want to serve web pages to most of the world, you have to have an IPv4 address, and that will continue until IPv6 adoption is well above 50%. Yes, there are places offering discounts for no-IPv4, such as lowendspirit. I have one. I have to bounce through another shell account to get to it as neither my home ISP nor workplace supports IPv6.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by kevcampb on Monday January 04, 2016 @10:49PM (#10841000)
Above 50%? The threshold for not supporting IPv4 would be far higher than that. Think about how long it took to for companies to stop supporting IE6 when there was still only residual usage. The effect of not supporting IPv4 would be far worse as well - not just a buggy looking site, but zero functionality.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by eternauta3k on Monday January 04, 2016 @05:46PM (#10839338)
IoT devices are already using protocols other than IP to connect to hubs through low-power radio links.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by rjsw on Monday January 04, 2016 @11:27AM (#10836436)
Windows XP can have IPv6, works fine.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by vollmond on Monday January 04, 2016 @11:50AM (#10836626)
He/she's just saying that in 20 years, anything using IPv4 will be creaky and obsolete, similar to how we view WinXP now -- creaky and obsolete. Not that WinXP is stuck on IPv4.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by rjsw on Monday January 04, 2016 @01:34PM (#10837438)
I'm saying that it doesn't seem to have been too difficult to add IPv6 to fairly old desktop machines.

I think the holdouts will be webservers, which was the other thing listed in the parent post.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by jlgaddis on Tuesday January 05, 2016 @05:32AM (#10842484)
Personally, I believe mail servers will be the last to go to IPv6-only.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by pdkl95 on Monday January 04, 2016 @12:23PM (#10836865)
> The killer feature of IPv6 is that is has more addresses than IPv4.

While technically true, reason this is the killer feature of IPv6 - by far - is that it removes the need for NAT, restoring the most powerful feature of the internet: being able to publish as an equal peer without requiring the approval of a 3rd party.

Stuck on a "party line", network software was forced to find complicated workarounds[1] and de facto prevented most serious development of entire categories of network software. In practice, you still needed a 3rd party - usually some centralized service - to grant each peer their imprimatur[2].

The power of the internet is that it allowed unrestrained, ad hoc publishing. Entire protocols - such as HTTP - could be developed without first getting the approval of some governing body. We have done a very good job of pretending we still have this capability, IPv4 went the way of cable TV a long time ago.

Why is it taking so long to deploy IPv6? That's easy: a conflict of interest. Why would a big company that controls a scarce resource - IPv4 addresses and the publishing power the represent - want to dilute their power by with IPv6? These companies were based on refining Shannon's ideas bringing the cost of coping data rapidly to zero. They saw what happened when groups like the {RI,MP}AA became obsolete. Why would they want to invest significant amounts of money in their own obsolescence?

APPENDIX:

Whenever this topic is brought up, someone inevitably cries that that NAT is necessary "for security". This misconception happens when NAT/"IP Masquerading" and a statefull firewall are conflated. You can drop packets without changing any addresses (firewall only), and you can rewrite addresses without doing any packet filtering (NAT only). While these features are often used at the same time - especially in cheap home routers - they can be (and are) used independently. A firewall should still be used with IPv6.

Occasionally this "for security" concern is a concern for privacy. The NAT "party line" is seen as a source of anonymity ("you don't know which machine behind the NAT is making a request. First - how many bits of anonymity are you gaining in practice? Second - if HTTP is involved, the browser is probably leaking addresses anyway (WebRTC[3]). Finally, is your source port or TCP timestamp[4] leaking information?

[1] http://www.brynosaurus.com/pub/net/p2pnat/

[2] https://www.fourmilab.ch/documents/digital-imprimatur/

[3] https://bugzilla.mozilla.org/show_bug.cgi?id=959893

[4] 0x03-2 http://phrack.org/issues/63/3.html

edit: grammar

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by thescriptkiddie on Monday January 04, 2016 @01:04PM (#10837185)
This cannot be understated. It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, file sharing, and online games. It make the internet almost unusable.
Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by josteink on Monday January 04, 2016 @03:47PM (#10838447)
> It's amazing how many networks still have absolutely shitty NATs that breaks things like VOIP, video conferencing, remote access, file sharing, and online games. It make the internet almost unusable.

What's amazing is how many companies who buy expensive firewalls for their corporate networks to do this on purpose under the illusion that somehow having LAN computers not being able to access anything besides outbound HTTP and HTTPS on the internet makes you more secure.

Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days? Even VPNs. You're protecting nothing.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by darkr on Monday January 04, 2016 @04:25PM (#10838760)
> Haven't they noticed that everything piggybacks on top of HTTP/HTTPS these days?

Blocking outbound traffic at layer 3/4 does not require an expensive firewall. It provides protection against certain attack vectors, but as you say, most stuff nowadays uses http/https and in the case of trojans, likely reverse shells. Any firewall should be able to do this.

The expense usually comes in when doing application layer filtering and/or transparent/active proxying, which is the point at which you can block SSL VPN clients and the like. To do this over HTTPS it obviously requires MITMing TLS traffic, which I have mixed feelings about.

Re:IPv6 celebrates its 20th birthday by reaching 10% deployment by jlgaddis on Tuesday January 05, 2016 @05:36AM (#10842491)
The best solution I've seen is PCs ("LAN computers") without a default gateway. Give them static routes to access the local (within the company) resources they need, point them towards a proxy server for outbound web access, and you've went a long way towards reducing your risk.