News for hackers. Stuff that matters.
Re:IAB Statement on IPv6 by daurnimator on Tuesday November 08, 2016 @04:13AM (#12898758)
IMO the major thing holding back IPv6 on the web is amazon. A huge proportion of services are hosted on AWS, and the lack of IPv6 addressing of instances cannot be forgiven.
Re:IAB Statement on IPv6 by AndrewDucker on Tuesday November 08, 2016 @04:57AM (#12898950)
Re:IAB Statement on IPv6 by kalleboo on Tuesday November 08, 2016 @06:43AM (#12899443)
Wow, how did I miss this, CloudFront getting IPv6 support is huge!
Re:IAB Statement on IPv6 by danudey on Tuesday November 08, 2016 @03:31PM (#12903661)
They also support HTTP/2 now, which is pretty sweet.
Re:IAB Statement on IPv6 by StavrosK on Tuesday November 08, 2016 @07:59AM (#12899824)
"Getting?" I set up some CloudFront instances (or whatever they call them) a month ago and it had an IPv6 checkbox (which was unchecked by default, for some reason), but it seems to have been working fine ever since.
Re:IAB Statement on IPv6 by kalleboo on Tuesday November 08, 2016 @08:34AM (#12900054)
Yeah the announcement linked is from a month ago
Re:IAB Statement on IPv6 by jontro on Tuesday November 08, 2016 @07:57AM (#12899813)
ELBs support ipv6 as well
Re:IAB Statement on IPv6 by kalleboo on Tuesday November 08, 2016 @08:40AM (#12900099)
Only EC2-Classic ELBs do, which is only available to users who signed up for AWS before Dec 2013 (and doesn't support all the new VPC goodness)
Re:IAB Statement on IPv6 by danyork on Tuesday November 08, 2016 @08:01AM (#12899837)
The good news is that Amazon has been slowly rolling out IPv6 support across various AWS services (ex. S3, CloudFront). Once they support IPv6 on EC2, though, that will be the big breakthrough!
Re:IAB Statement on IPv6 by yuvadam on Tuesday November 08, 2016 @02:04PM (#12902993)
Not to mention Route 53, which can serve AAAA records, but still has no IPv6 nameservers.
Re:IAB Statement on IPv6 by virtuallynathan on Tuesday November 08, 2016 @03:41PM (#12903726)
It should now: https://aws.amazon.com/about-aws/whats-new/2016/10/amazon-ro...

ns-1887.awsdns-43.co.uk. 60 IN AAAA 2600:9000:5307:5f00::1

Re:IAB Statement on IPv6 by cm2187 on Tuesday November 08, 2016 @10:46AM (#12901127)
I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6. Neither has vodafone.

Also I have servers in colocation with two datacenters, and for both I had to ask to the support to get an IPv6 range. We are very far from IPv6 becoming a standard feature.

Re:IAB Statement on IPv6 by jburgess777 on Tuesday November 08, 2016 @07:10PM (#12905134)
SKY have recently rolled out IPv6 suuport to nearly all customers: https://corporate.sky.com/media-centre/news-page/2016/sky-co...

I use AAISP as my ISP and they have been providing IPv6 for a very long time: http://aa.net.uk/kb-broadband-ipv6.html

Re:IAB Statement on IPv6 by the8472 on Tuesday November 08, 2016 @01:03PM (#12902471)
That varies strongly by country[0]. My home ISP for example does DS-Lite and last week their AFTR was overloaded. So ipv4 was almost unusable while v6 worked fine. So temporarily I was already living in a post-v4 world.

[0] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

Re:IAB Statement on IPv6 by Latty on Tuesday November 08, 2016 @11:45AM (#12901705)
> I'd say ISPs to start with. In the UK, BT still hasn't rolled out IPv6.

BT have at least partially rolled out support, as I have a v6 allocation on a BT broadband service.

Re:IAB Statement on IPv6 by cm2187 on Tuesday November 08, 2016 @11:55AM (#12901808)
I have read I can get it by upgrading to the very latest version of BT Home Hub (I am using 5). I ordered it yesterday. But my current Home Hub 5 is compatible, and I still don't have IPv6.
Re:IAB Statement on IPv6 by jburgess777 on Tuesday November 08, 2016 @07:39PM (#12905248)
It looks like you would have got support on your existing device soon. A recent BT presentation says:

"[IPv6 support] Home Hubs 4 and 5 support from early 2017"

http://www.ipv6.org.uk/wp-content/uploads/2016/11/UKIPv6Coun...

Re:IAB Statement on IPv6 by cm2187 on Thursday November 10, 2016 @03:11PM (#12923833)
Actually I just received my new router and I now have IPv6!
Re:IAB Statement on IPv6 by lisivka on Tuesday November 08, 2016 @11:18AM (#12901443)
It's time to switch HN to be IPv6 only forum, so 100% of HN'ers will be on IPv6 almost instantly. ;-)
Re:IAB Statement on IPv6 by ryao on Tuesday November 08, 2016 @04:21AM (#12898797)
Amazon and github are the two major offenders.
Re:IAB Statement on IPv6 by executesorder66 on Tuesday November 08, 2016 @04:25AM (#12898816)
https://ipv6wallofshame.com/

Baidu, Twitter, Instagram and Reddit are also major players who could make a huge difference.

Re:IAB Statement on IPv6 by tomschlick on Tuesday November 08, 2016 @04:26AM (#12898828)
The worst part about reddit in that case is that they use cloudflare which could be a 1 click update to ipv6. Previously they have stated that internal systems (spam, court orders, reporting) are holding them back from the change.
Re:IAB Statement on IPv6 by Arnt on Tuesday November 08, 2016 @04:34AM (#12898861)
Still plausible, e.g. if their spam filters, court order handling and reporting expect to see IPv4 client addresses in their input and/or databases.
Re:IAB Statement on IPv6 by daurnimator on Tuesday November 08, 2016 @04:48AM (#12898918)
Cloudflare have a workaround for that too! https://support.cloudflare.com/hc/en-us/articles/202494830-P...
Re:IAB Statement on IPv6 by jnbiche on Tuesday November 08, 2016 @06:33AM (#12899389)
You know, Cloudflare gets a lot of shit around here for being a centralizing entity in a decentralized Internet (sometimes justifiably), but they've done a hell of a lot to push forward needed changes in the Internet infrastructure. Often at little benefit to themselves.
Re:IAB Statement on IPv6 by jgrahamc on Tuesday November 08, 2016 @06:54AM (#12899503)
Re:IAB Statement on IPv6 by Gruselbauer on Tuesday November 08, 2016 @04:25PM (#12904082)
That is a concise, interesting read topped off by some Gibson quotes. Thanks.
Re:IAB Statement on IPv6 by avar on Tuesday November 08, 2016 @05:21AM (#12899043)
I work for one of the companies on that wall of shame. I wonder to what extent it has the reverse of the intended effect. "Oh so not even Amazon, Twitter or GitHub gives a crap about IPv6? Why should we?".
Re:IAB Statement on IPv6 by CountSessine on Tuesday November 08, 2016 @10:16PM (#12905813)
Oh so not even Amazon, Twitter or GitHub gives a crap about IPv6? Why should we?

If this is really what they're thinking, then they have no pride in their work and will never be the best at what they do. I suspect most of the engineers working for Amazon, Twitter, and GitHub are well aware that they're lagging in ipv6, and are very intent on catching up.

Re:IAB Statement on IPv6 by lmm on Tuesday November 08, 2016 @06:31AM (#12899374)
It seems to have worked for python 3.
Re:IAB Statement on IPv6 by dom0 on Tuesday November 08, 2016 @07:13AM (#12899594)
I kinda doubt that the site had a real influence on that.
Re:IAB Statement on IPv6 by ryao on Tuesday November 08, 2016 @08:00AM (#12899830)
Those are just one site each though. GitHub and Amazon are many.

Also, I am not sure if googleadservices.com should be on that list. Leaving advertising on IPv4 to die might be for the best. ;)

Re:IAB Statement on IPv6 by korethr on Tuesday November 08, 2016 @01:10PM (#12902525)
At a cursory glance, it seems that Google or Google-owned sites make up a majority of the IPv6-enabled sites. Seems to me the numbers would be a lot lower without Google's work.
Re:IAB Statement on IPv6 by vacri on Tuesday November 08, 2016 @03:58PM (#12903875)
The list also has a ton less green when you consider that most of the sites are just the google search page with different TLDs.
Re:IAB Statement on IPv6 by ttflee on Tuesday November 08, 2016 @05:18AM (#12899027)
With poor adoption rate of IPv6 persists in China, half of those listed (taobao, tmall, baidu, hao123, qq, youku, sina, weibo, etc.) just won't change in near future.
Re:IAB Statement on IPv6 by ryao on Tuesday November 08, 2016 @07:59AM (#12899826)
I am visiting China. It seems impossible to get an IPv6 address from either China Telecom (the ASN lacks IPv6 peering) or a datacentdr within China. Sending traffic to a VM in South Korea has similarly had the issue where I cannot find any VMs with IPv6 support, although most have terrible latencies.
Re:IAB Statement on IPv6 by CountSessine on Tuesday November 08, 2016 @10:20PM (#12905828)
I don't understand; APNIC ran out of ipv4 addresses ages ago. How do they...internet?
Re:IAB Statement on IPv6 by witty_username on Wednesday November 09, 2016 @01:24AM (#12906695)
I think IPv4 addresses can be bought for cheaper than the cost to transition to IPv6.
Re:IAB Statement on IPv6 by lokedhs on Tuesday November 08, 2016 @04:35AM (#12898864)
That site correctly lists apple.com as not supporting IPv6. The funny thing is that www.apple.com does support it.
Re:IAB Statement on IPv6 by vetinari on Tuesday November 08, 2016 @04:53AM (#12898932)
Same with microsoft.com.
Re:IAB Statement on IPv6 by ohitsdom on Tuesday November 08, 2016 @07:25AM (#12899643)
How is this the case?
Re:IAB Statement on IPv6 by fps on Tuesday November 08, 2016 @08:31AM (#12900035)
Both Microsoft and Apple's www sites use Akamai's CDN, via a cname to a CNAME to something in akamaiedge.net, which support ipv6. The apex record of a domain (that is, the root record, microsoft.com or apple.com) cannot be a CNAME, it can only have an A, NS, MX or TXT record. A records make dynamic infrastructure hard, because they require API coordination between your DNS provider and your CDN. So Microsoft and apple host their own apex domain records via A records to static IPs in their own IP blocks, and have these servers issue a permanent http redirect to www.
Re:IAB Statement on IPv6 by lloeki on Tuesday November 08, 2016 @08:59AM (#12900236)
apple.com isn't but redirects to www.apple.com which is IPv6 enabled (akamai)
Re:IAB Statement on IPv6 by Arnt on Tuesday November 08, 2016 @04:28AM (#12898835)
Re:IAB Statement on IPv6 by liveoneggs on Tuesday November 08, 2016 @06:53AM (#12899492)
as fastly goes, so goes github
Re:IAB Statement on IPv6 by fulafel on Tuesday November 08, 2016 @07:34AM (#12899692)
IPv6 and a return to end-to-end addressing isn't really aligned with the AWS style of proprietary platform lock-in.
Re:IAB Statement on IPv6 by icedchai on Tuesday November 08, 2016 @11:00AM (#12901265)
This makes no sense. AWS can give you IPv4 elastic IPs, which provide end-to-end addressing on IPv4. IPv6 will be no different in this regard.

"End-to-end addressing" is typically an end user issue, where end users use NAT. In the early days of the internet, nobody used NAT.

Re:IAB Statement on IPv6 by fulafel on Tuesday November 08, 2016 @11:15AM (#12901408)
AWS encourages you to use VPCs for service-internal addressing. Yes, you can rent "elastic IPs", but in the AWS mindset they are special and to be used only for NATing Internet endpoints to your services. It's based on end-to-end addressing being special and a scarce resource. This is compatible with the traditional corporate intranet style of thinking, but it's also in the opposite of internet end-to-end addressing and they are in no hurry to change it.
Re:IAB Statement on IPv6 by dastbe on Wednesday November 09, 2016 @11:29AM (#12911532)
ipv6 has a provision for locally routable addresses, because yes publicly routable addresses should be special. They should just also be free.
Re:IAB Statement on IPv6 by fulafel on Thursday November 10, 2016 @01:38AM (#12918222)
Link-local addresses are not routable and are not meant for application use, they're just for low level things like neighbour discovery and router advertisements (analogous to IPv4 ARP/DHCP).

There's also ULA that can be used for non-internet connected networks and some other special scenarios, but it would be a bad idea (and against recommended practice) to use them to port your RFC1918 addressing to IPv6.

Re:IAB Statement on IPv6 by Arnt on Tuesday November 08, 2016 @04:23AM (#12898804)
I noticed the other day that IPv6 growth is slowing down, as Google measures it. Its access share used to double every ten or eleven months, now it doubles more slowly, and seems likely to reach 20% only in 2017 instead of this year, and if it goes on as in the recent months, 30% in 2018 instead of in 2017.

At a guess, many of most competent ISPs have done their thing and now we're seeing the more sluggish middle. Or? Comments?

Re:IAB Statement on IPv6 by Ambroos on Tuesday November 08, 2016 @05:03AM (#12898972)
In Belgium we're up to 49.5% of Google traffic over IPv6, which is pretty impressive. All major ISP's have IPv6 enabled in a dual-stack setup right now. This works because almost all of them provide an all-in-one modem/router/access point, all remotely managed, so it's easy to just flick a switch on the ISP end and magically have everything go over IPv6.

What's holding back further progress is mostly people with their own NAT routers/DHCP that's not set up for IPv6, or company networks where the transition isn't planned. That's going to change very, very slowly indeed.

Re:IAB Statement on IPv6 by lmm on Tuesday November 08, 2016 @05:05AM (#12898977)
IPv6 was always going to be an S-curve. My guess is we'll see switchover at about the same rate up to 80%-90%, and then a long tail.
Re:IAB Statement on IPv6 by eb0la on Tuesday November 08, 2016 @05:10AM (#12898992)
If I remember well at least 2-3 years ago it was complicated to measure IPv6 usage on a high-end router, and that was tied to billing.

Every vendor (Cisco/Juniper/Alcatel/Huawei) had a different way to do it and since B2B billing depended on it IPv6 adoption was not as easy as expected.

Re:IAB Statement on IPv6 by woah on Tuesday November 08, 2016 @09:39AM (#12900550)
What was complicated about it?
Re:IAB Statement on IPv6 by eb0la on Tuesday November 08, 2016 @04:29PM (#12904102)
Every vendor had a different way to measure how much octets went through an interface on IPv6 using SNMP.

And the standard MIB (management information base) for SNMP only gave you IPv4 traffic.

So, if you wanted to measure the traffic you interchange with a third party on IPv6 you had to be tied to a specific way of doing in (some had private or experimental MIBs for that, in other cases you had to move the data through a tunnel and measure traffic inside the tunnel minus overhead.).

Very easy to make mistakes specially if there is a problem with the traffic late at night and somebody forgets to put you in the loop.

Re:IAB Statement on IPv6 by lloeki on Tuesday November 08, 2016 @08:51AM (#12900183)
Here in France, there have been leading ISPs (Free ADSL), good citizens (SFR), and laggards that keep on dragging their feet (Orange, Numericable). Things got worse when Numericable bought SFR, halting progress with stupid rules in place that when you get the budget version of a contract you don't get IPv6 because reasons.

Let's not get started on "pro" versions where you just don't get IPv6 at all, ever, and on the phone you can even get them mumbling that it's not even on the table (Completel).

Re:IAB Statement on IPv6 by tonfa on Tuesday November 08, 2016 @10:23AM (#12900926)
Is Free still doing 6to4 (which was probably fine at the time) or did they start doing native ipv6?
Re:IAB Statement on IPv6 by phicoh on Tuesday November 08, 2016 @10:59AM (#12901248)
Free was doing 6rd, which is similar to 6to4 but not quite the same.
Re:IAB Statement on IPv6 by quicksilver03 on Tuesday November 08, 2016 @01:50PM (#12902867)
I'm on Free and I had to disable IPv6 because one of their routers was dropping about 60% of the IPv6 packets: GitHub, Google, Bitbucket took several minutes to load.

As soon as I switched to IPv4 everything worked fine.

I suppose that nobody at Free is really monitoring their IPv6 network in the same way they do it for IPv4.

Re:IAB Statement on IPv6 by vertex-four on Tuesday November 08, 2016 @06:02AM (#12899238)
In the UK, only one big(-ish) ISP supports IPv6, and 2 significantly smaller ones. BT claim to be pushing it out next year, but they still have a large number of older consumer-end router/modem devices which can't be updated for it, so it'll take another half a decade for those devices to fail and be replaced. Once BT have pushed it out, many of the companies that depend on them for varying things should be able to build implementations fairly quickly.
Re:IAB Statement on IPv6 by wfn on Tuesday November 08, 2016 @06:08AM (#12899270)
BTnet (BT's higher-end leased line etc. services) do support native IPv6 fwiw, but when I spoke to them (this was in Scotland) they said no customers ask for IPv6 to be enabled, and it's not enabled by default. (But if you ask them they'll do it no problem - verified to be true.:) But the situation is different with all that older consumer equipment as you say...
Re:IAB Statement on IPv6 by kalleboo on Tuesday November 08, 2016 @06:17AM (#12899303)
Here in Japan, the largest consumer fiber wholesale network (NTT) "supports" IPv6, but you need a separate, $100 router that talks PPPoEv6 since none of the common consumer routers (including the one they provision you with) seem to support it.

I also haven't been able to get PPPoEv6 working in macOS.

Re:IAB Statement on IPv6 by phicoh on Tuesday November 08, 2016 @07:36AM (#12899709)
Anything that can run OpenWRT should be able to do PPPoE with IPv6.
Re:IAB Statement on IPv6 by kalleboo on Tuesday November 08, 2016 @09:00AM (#12900238)
Just explaining why there's poor IPv6 adoption. Anyone can get IPv6 though a tunnel if they really want it...
Re:IAB Statement on IPv6 by phicoh on Tuesday November 08, 2016 @09:39AM (#12900556)
I focussed on your suggestion that it had to cost $100.

If people don't need IPv6, then why bother. My impression is that the content providers don't care about IPv6, so I assume they have plenty of IPv4 space.

Some large consumer ISP are short on IPv4 address, but in that case, they will will make sure their customers get IPv6 capable CPEs.

Anything else is a very nice hobby.

Re:IAB Statement on IPv6 by takeda on Tuesday November 08, 2016 @03:32PM (#12903671)
From this: https://www.google.com/intl/en/ipv6/statistics.html doesn't look like it is slowing down, it's not exponential though, but was it really? It's much easier to double up when number of users is low.
Re:IAB Statement on IPv6 by marcosdumay on Tuesday November 08, 2016 @01:26PM (#12902655)
Here at Brazil, I know of no consumer facing ISP that supports IPv6. But we have been busy dismantling a quasi-communist government, so things may change faster in the future (if we are successful in the dismantling).
Re:IAB Statement on IPv6 by eb0la on Tuesday November 08, 2016 @04:37PM (#12904165)
All mobile operators use it for their infrastructure because the procols make it mandatory.

Then they have a big ipv4 nat for cell phones in the BTS. Weird.

Re:IAB Statement on IPv6 by executesorder66 on Tuesday November 08, 2016 @04:20AM (#12898790)
I check the google stats[0] on ipv6 adoption every few months. Last time I checked it was barely 9% an now it's on 15% !

I would have never thought we'd get this far this fast. Looks like the switchover is actually going to happen.

[0]https://www.google.com/intl/en/ipv6/statistics.html

Re:IAB Statement on IPv6 by vishbar on Tuesday November 08, 2016 @06:13AM (#12899288)
Really interesting how it spikes on weekends! I wonder if this is because more home broadband connections are ipv6-enabled compared to businesses?
Re:IAB Statement on IPv6 by kiallmacinnes on Tuesday November 08, 2016 @07:12AM (#12899590)
Yea, ISPs are upgrading home users for them.. Businesses tend to have their own equipment, and need to DIY the change, even if IPv6 is pushed down the wire to them by the ISP.
Re:IAB Statement on IPv6 by boulos on Tuesday November 08, 2016 @11:05AM (#12901313)
Yes, but mobile phones even more so (e.g., the push to IPv6 in iOS 9: https://developer.apple.com/news/?id=05042016a)
Re:IAB Statement on IPv6 by executesorder66 on Tuesday November 08, 2016 @07:10AM (#12899574)
I guess it's hobbyists who's normal internet connection is ipv4, but on the weekend they have time to dick around with ipv6 devices and connections.
Re:IAB Statement on IPv6 by selectodude on Tuesday November 08, 2016 @08:40AM (#12900100)
Comcast and Verizon Wireless rolled out IPv6 years ago, and resolves IPv6 addresses first by default. Nobody is dicking around, it's just transparent.
Re:IAB Statement on IPv6 by liotier on Tuesday November 08, 2016 @10:02AM (#12900733)
> Nobody is dicking around

Well, I am. Now let met enjoy my statistical insignificance !

Re:IAB Statement on IPv6 by executesorder66 on Tuesday November 08, 2016 @09:32AM (#12900481)
How does that explain the massive spikes on weekends?
Re:IAB Statement on IPv6 by selectodude on Tuesday November 08, 2016 @09:56AM (#12900690)
People do more internet at home on weekends than they do on weekdays.
Re:IAB Statement on IPv6 by mSparks on Tuesday November 08, 2016 @07:51AM (#12899788)
possible i guess

do we see something similar with .onion addresses?

ive found it much more reliable and secure to give devices i want access to from anywhere a .onion address rather than a ipv6 one.

secure by design rather than plaintext insecure and only works on some internet connections occasionally by design nightmare that is ipv6.

Re:IAB Statement on IPv6 by tomschlick on Tuesday November 08, 2016 @04:24AM (#12898813)
Looks like the US is up to 30% now! I suspect mobile traffic is largely driving this as all the major carriers are moving to ipv6 only and proxy an ipv4 address when needed.
Re:IAB Statement on IPv6 by cjensen on Tuesday November 08, 2016 @03:02PM (#12903451)
We have a product that uses ipv6 for inter-server communications. We've since learned that most major corporations routinely disable ipv6 on every computer.

Not helping.

Re:IAB Statement on IPv6 by danudey on Tuesday November 08, 2016 @03:31PM (#12903658)
Heard a "funny" story about Facebook switching over to pure IPv6 and their issues dealing with largely untested IPv6 implementations. For example, switches which, when presented with an IPv6 BGP route while they don't have IPv6 configured, crash. Apparently they took down an entire data centre full of rack switches finding that out.

My second-favorite problem, after that was solved, was developers constantly using IPv4-only code. Their eventual solution was to just disable IPv4 entirely so that anyone committing IPv4-only code was committing broken code.

It's amazing how much work it takes to bring people into the future.

Re:IAB Statement on IPv6 by eb0la on Tuesday November 08, 2016 @04:34PM (#12904143)
Very "funny", but that kind of crashes happened more than you imagine.. in telcos.

Usually the problem is memory. A machine with full routing enabled needs much more memory for IPv6 than for IPv4 and when routers run out of memory they just crash, reboot, and start again...

Re:IAB Statement on IPv6 by CountSessine on Tuesday November 08, 2016 @10:28PM (#12905852)
Usually the problem is memory. A machine with full routing enabled needs much more memory for IPv6 than for IPv4

Interesting - why? I would have thought that routing tables for ipv6 would be a fraction of the size of their ipv4 equivalents. Am I wrong? Or is this just sloppy programming on the part of those switch programmers?

Re:IAB Statement on IPv6 by AndrewDucker on Tuesday November 08, 2016 @06:46AM (#12899462)
Topically, here are the minutes from the latest UK IPV6 Council meeting: http://www.ipv6.org.uk/2016/08/31/ipv6-council-meeting-octob...

Sky and BT both looking good, sadly Virgin didn't present this year.

Re:IAB Statement on IPv6 by Spooky23 on Tuesday November 08, 2016 @07:54AM (#12899806)
I've not run into a problem solved by IPv6. There's no incentive for ISPs to provide good service, so they can just follow the mobile carrier route and nat/proxy when exhaustion becomes an issue.

As other countries go IPv6, more IPv4 addresses become available for the big cloud providers.

Re:IAB Statement on IPv6 by proactivesvcs on Tuesday November 08, 2016 @08:19AM (#12899957)
I run into NAT almost every single day. It wastes time, breaks things, consumes router resources, rules out certain technologies/products/services and duplicates so much work it's just unreal.
Re:IAB Statement on IPv6 by Spooky23 on Tuesday November 08, 2016 @08:50AM (#12900178)
IPv6 != No NATing.

Example: Verizon Wireless.

Re:IAB Statement on IPv6 by cm2187 on Tuesday November 08, 2016 @12:56PM (#12902406)
You mean IPv6 != No Firewall. Firewall are going to cause pretty much the same problems as NAT.
Re:IAB Statement on IPv6 by proactivesvcs on Tuesday November 08, 2016 @09:20AM (#12900379)
Quite. But there's no need, nor excuse for NAT on IPv6.
Re:IAB Statement on IPv6 by CountSessine on Tuesday November 08, 2016 @10:30PM (#12905861)
True, but that's just kind of dumb.
Re:IAB Statement on IPv6 by fps on Tuesday November 08, 2016 @08:38AM (#12900076)
As a sysadmin, if I had limitless IPv4 addresses, I'd still use NAT on servers and clients because it's a useful security layer. There's little reason that individual devices need globally routable IP addresses.
Re:IAB Statement on IPv6 by pdkl95 on Tuesday November 08, 2016 @09:20AM (#12900383)
> it's a useful security layer

No, it's not. As a sysadmin, you should know the difference between NAT and a stateful firewall, and that NAT alone doesn't prevent packets from being routed to local addresses.

> There's little reason that individual devices need globally routable IP addresses.

NAT has been more damaging to the development of network software than any other factor. NAT breaks the development of true network software, such that entire categories of software haven't even been considered.

NAT forces extremely complicated hacks[1] and centralized management of true peer to peer connections. The benefit of the internet has been that any peer has the capability to publish. NAT breaks that benefit, turning the internet back into cable TV, where most people need an imprimatur[2] to publish.

[1] http://www.brynosaurus.com/pub/net/p2pnat/

[2] https://www.fourmilab.ch/documents/digital-imprimatur/

Re:IAB Statement on IPv6 by CountSessine on Tuesday November 08, 2016 @10:36PM (#12905877)
This needs to be repeated everywhere. There are too many system admins with dangerously bad ideas about IPv6 and NAT. NAT needs to die in a fire and if you're rolling out NAT for IPv6 you're wasting your time and your company's money for a bag of nothing.
Re:IAB Statement on IPv6 by proactivesvcs on Tuesday November 08, 2016 @09:19AM (#12900374)
But with an extra layer to configure and for a vendor to properly implement, surely that also means it's an extra security liability?
Re:IAB Statement on IPv6 by _red on Tuesday November 08, 2016 @08:29AM (#12900021)
>consumes router resources

Thats a weird claim to make against IPv4. Grab a calculator and see how much memory is required by a IPv6 /64 address space.

Re:IAB Statement on IPv6 by ncw33 on Tuesday November 08, 2016 @08:38AM (#12900081)
Not much! Just a few bytes for each packet. Running a NAT service requires a big table of all the active connections, ie. it's stateful - IPv6 with no NAT needs no per-connection state in the router so that's a big space-saving.
Re:IAB Statement on IPv6 by proactivesvcs on Tuesday November 08, 2016 @09:18AM (#12900362)
As I understand it, there have been a few nation-scale Internet outages that have been a result of IPv4 address tables reaching their resource ceiling (not relating to NAT) - another example of how IPv4 is no longer fit for purpose regarding hardware resources.
Re:IAB Statement on IPv6 by mprovost on Tuesday November 08, 2016 @01:44PM (#12902816)
Those were caused because Cisco by default (optimistically) partitioned a big chunk of the routing table memory for v6 routes. The fix was to reduce the memory usage for v6 and give that memory back for v4 routes. So really it was allocating so much space for v6 before there was any need that caused those outages.
Re:IAB Statement on IPv6 by tptacek on Tuesday November 08, 2016 @12:55PM (#12902397)
If 32 bit address tables are reaching capacity, increasing the size of the address space is unlikely to resolve the problem.
Re:IAB Statement on IPv6 by mikecb on Tuesday November 08, 2016 @01:47PM (#12902844)
Doesn't ipv6 include efficiencies for this, like hierarchical prefixes?
Re:IAB Statement on IPv6 by tptacek on Tuesday November 08, 2016 @01:56PM (#12902911)
In practical reality, doesn't that just mitigate the strain caused by an explosion in the size of the address tables?
Re:IAB Statement on IPv6 by toast0 on Tuesday November 08, 2016 @09:51PM (#12905758)
A sometimes large but solvable part of the problem in ipv4 routing table sizes is numerically adjacent routes that could be aggregated into fewer announcements but aren't; ipv6 doesn't help with that. Another part of the problem is that many networks have lots of allocations that aren't adjacent, so they can't aggregate them; ipv6 should help with that as there's room for big allocations.
Re:IAB Statement on IPv6 by mikecb on Tuesday November 08, 2016 @02:28PM (#12903200)
I guess it depends on how big the efficiency gain is, but afaik it's pretty big.
Re:IAB Statement on IPv6 by _red on Tuesday November 08, 2016 @09:08AM (#12900296)
So you don't want stateful inspection on your private LAN router? Its ok for every hacker to portscan the 100's of IoT devices in your house? You're a very trusting fellow.
Re:IAB Statement on IPv6 by lmm on Tuesday November 08, 2016 @10:43AM (#12901098)
How many IoT devices need to allow incoming connections at all? And how many connections do they need to make?

IoT devices, if I had any use for them, would go on my private LAN. My private-public router can do complex stateful tracking, because it only has to handle a few connections at a time. Meanwhile my grown-up internet devices go on the public side and get actual internet access, meaning that e.g. two people inside my house can play an online game with a person outside my house, and aren't slowed down by a complex connection-tracking router. Also means my guests don't get access to my IoT devices.

Re:IAB Statement on IPv6 by buzer on Tuesday November 08, 2016 @11:10AM (#12901357)
> How many IoT devices need to allow incoming connections at all? And how many connections do they need to make?

If they need outgoing connections, they likely also need incoming when we are speaking about stateless filtering. Without incoming connections only UDP would be allowed and it would be usually impossible to determine if the packet should be send again (it would only be possible if there was out of band method to detect it).

Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

Re:IAB Statement on IPv6 by lmm on Tuesday November 08, 2016 @11:16AM (#12901423)
> Ok, I will admit that it's possible to check the TCP headers and just drop incoming SYN packets without ACK, but then you need to start trusting that the IoT device can handle invalid TCP packets.

I have more faith in that than I have faith in a router that does complex state-tracking logic to not contain RCE vulnerabilities itself.

Re:IAB Statement on IPv6 by woah on Tuesday November 08, 2016 @10:03AM (#12900742)
Are you recommending NAT as some sort security-by-accident measure?
Re:IAB Statement on IPv6 by mitchty on Tuesday November 08, 2016 @08:38AM (#12900082)
The claim isn't about memory needed to flesh out an entire address range, but resources allocated to things like nat in ipv4.

Why am I trying to fill out in memory an entire /64? More importantly what purpose will doing that for a home network that will at best have 100 nodes even with ipv6? The memory needed to route and track 100 ipv6 nodes vs 100 ipv4 is a rounding error. Even if I enabled privacy extensions the amount of addresses is miniscule.

Nat sucks, end of story, and yes ipv6 requires more memory. It is a bigger address range after all. We also gain a lot of what we lost with ipv4 years ago.

Re:IAB Statement on IPv6 by proactivesvcs on Tuesday November 08, 2016 @09:17AM (#12900356)
I don't need to grab a calculator to figure out what I have already witnessed.

I've come across several routers that stop working (partially or completely) or spontaneously reboot when there are too many active NAT sessions. At a few customers I've had to set session limits to prevent some devices from being unable to talk to the WAN.

Re:IAB Statement on IPv6 by ryao on Tuesday November 08, 2016 @08:04AM (#12899852)
I get better peering though the HE tunnel broker than I get on IPv4. :)
Re:IAB Statement on IPv6 by liotier on Tuesday November 08, 2016 @10:07AM (#12900773)
Especially to exotic destinations and to services which my ISP feels like choking a little (such as Youtube)...
Re:IAB Statement on IPv6 by cm2187 on Tuesday November 08, 2016 @11:37AM (#12901623)
IPSec is one. You would burn two IPv4 to enable IPSec between two machines you control. That's a no brainer with IPv6. It is cumbersome and expensive with IPv4.

And given that most datacentres (outside of cloud services) are IPv6 enabled, this makes sense to secure server to server communications.

Re:IAB Statement on IPv6 by fs111 on Tuesday November 08, 2016 @08:47AM (#12900156)
and yet news.ycombinator.com is still not IPv6 enabled...
Re:IAB Statement on IPv6 by NKCSS on Tuesday November 08, 2016 @07:11AM (#12899583)
Better late than never I guess, but come on... IPv6 is nearly 20 years old in 2 years...
Re:IAB Statement on IPv6 by djhworld on Tuesday November 08, 2016 @04:19PM (#12904029)
I'm wondering what will happen when ISPs start doling out IPv6 addresses, will every customer get a unique, static IPv6 address?

Right now my ISP (BT) gives you an IPv4 address, but it's dynamic. They charge extra for a static IP

Re:IAB Statement on IPv6 by jburgess777 on Tuesday November 08, 2016 @07:34PM (#12905230)
I don't have an answer to your question but the latest news from BT is:

"All BT broadband lines support IPv6 with a compatible router, except IPstream connections"

http://www.ipv6.org.uk/wp-content/uploads/2016/11/UKIPv6Coun...

Re:IAB Statement on IPv6 by Keverw on Tuesday November 08, 2016 @03:34PM (#12903682)
I hope we don't have IPv6 only protocols and sites anytime soon. My cable company still is not supporting IPv6... It seems like something a major American ISP would of done by now.
Re:IAB Statement on IPv6 by tjohns on Tuesday November 08, 2016 @03:45PM (#12903767)
On the contrary, having IPv6 only sites and protocols would greatly help adoption.

One of the problems is that a lot of companies think that IPv4 is good enough, since there's no discernable difference to end users right now. Every IPv6 site is also accessible over IPv4, and the community is already heavily invested in engineering around the shortcomings otherwise created by NAT on IPv4.

Coupled with the additional cost and security considerations that have to go into an IPv6 deployment, we've got a good recipe for encouraging both ISPs and corporate providers to stay on IPv4 for as long as possible. (If we're unlucky, we might even see ISPs roll out carrier grade NAT instead of upgrading.)

Re:IAB Statement on IPv6 by virtuallynathan on Tuesday November 08, 2016 @03:39PM (#12903708)
Which one?
Re:IAB Statement on IPv6 by Keverw on Tuesday November 08, 2016 @05:01PM (#12904339)
I used http://test-ipv6.com/ to run the test.

Your Internet Service Provider (ISP) appears to be SCRR-10796 - Time Warner Cable Internet LLC, US

I'm in Ohio.

Re:IAB Statement on IPv6 by wtallis on Tuesday November 08, 2016 @05:26PM (#12904514)
Time Warner Cable provides IPv6: https://www.timewarnercable.com/en/support/faqs/faqs-interne...

Your issue is site-specific; most likely your modem is outdated, but your router may also be configured to not try to acquire a block of IPv6 addresses.

Re:IAB Statement on IPv6 by Keverw on Tuesday November 08, 2016 @09:23PM (#12905637)
Interesting. No communication from them. I figured this is the sorta thing they'd mass contact people about to update.

I remember asking the installer about 3 years ago about it. He said I'd have it as soon as they turn it on at the central office...

I'm not really too worried about it yet as it's not a problem really yet. I hate talking to support people.

I went to the IPv6 page and it's not showing a V6 IP Address http://screencast.com/t/Xuq4VOfnS but the Dynamic page for IPv4 displays it in those text boxes(editing is disabled on them even though they look like inputs. A bit confusing UX if just looking at the image)

So it appears my firmware has it... strange. This is on the modem itself, not the router as it's a all in one.

Just found this: http://forums.timewarnercable.com/t5/IPv6/Not-getting-IPv6-A... from two months ago "I got someone from Tier 3 on the phone and he told me it was not available yet in my area." so hmm, sounds like some areas might be last to get it then.

Re:IAB Statement on IPv6 by pc2g4d on Tuesday November 08, 2016 @05:14PM (#12904438)
This is telling organizations developing standards to basically pretend IPv4 doesn't exist and is no longer in use. At least that's how I read it. Seems a bit premature.
Re:IAB Statement on IPv6 by shmerl on Tuesday November 08, 2016 @11:56AM (#12901817)
When will Verizon FiOS enable IPv6?