Unfortunately I can't find a link - I think they closed the issue tracker. Perhaps dang can comment? I'm typing from memory so it might be remembering incorrectly.
https://support.cloudflare.com/hc/en-us/articles/202494830-P...
Browser/device finger printing is probably the best option at the moment, but you'll get plenty of false positives amongst privacy aware users who block fingerprinting.
If the user has a static IP address, in IPv4 you ban a /32 (i.e., one address, his own). In IPv6 you'd have to ban the entire range allocated to the user, usually a /64. (edited)
If the user has a dynamic IP address, well, you're on your own. :D
HN has a system like that, but it fails because some people can still see the 'hidden' / dead posts, and for some reason they then go and point out "your comment shows up as [dead]", which defeats the purpose.
Just ban people without letting them know.
Like in theory of course I want to support IPv6, but in practice I've got a huge TODO list, and if there are present work-arounds that are doing good enough for now, I'd like to prioritise it correctly.
1) ISPs are increasingly deploying Carrier Grade NAT, which puts several people behind a single IP. This completely breaks end-to-end as you can't port forward but if you're running a website, the worst issue is if you ban an IP address, you could be cutting off several legitimate users to get rid of 1 person. It's like banning a whole country because of a few people which Wikipedia has done in the past by mistake: https://en.wikipedia.org/wiki/User_talk:82.148.97.69 see https://techcrunch.com/2007/01/01/wikipedia-bans-qatar/ This problem will only get worse as time goes on. The Internet is starting to feel broken when an entire country shares a single IP address.
2) In some cases, ISPs might address the shortage slightly differently, by serving up an IPv6 address that proxies back to your website over IPv4. To you it looks like Carrier Grade NAT, but you can actually do this yourself if you have an IPv6 enabled server (Linode, DigitalOcean work) and use nginx to reverse proxy. That way you can at-least set an X-Forwarded-For header that will give you better analytics and more precise blocking. Either you do it or the ISP will do it for you but give absolutely no data.
Carrier grade NAT breaks a lot of things in subtle ways. E.g. our ISP does DS-Lite to encapsulate IPv4 in IPv6. For months, our internet connection would sometimes seem dead for a couple of minutes. The router was fine and had uplink.
At some point I figured out that it often happened after a device woke from sleep and that IPv6 continued to work fine. It turns out that Bittorrent Sync was culprit. When a device woke up, BTSync syncs any changes and opens a boatload of connections through different ports. Apparently, the ISP's carrier grade NAT has some QoS where it starts dropping connections if too many ports are opened at the same time.
We shut down BTSync on all devices and never encountered the problem again [1].
At the time Bittorrent Inc. and later Resilio did not really seem interested to add IPv6 support.
[1] Of course, another theory is that they intentionally throttle Bittorrent traffic, but that doesn't explain why no IPv4 connections could be made while IPv6 worked fine.
All types of IP Masquerading[1] break the network in both subtle and overt ways. Without proper addresses, we've been s stuck for a couple decades having to work around "party lines" instead of developing real network software. Now that ISPs are starting to do this, some of the workarounds are no longer possible and the damage done to the network is becoming more obvious.
I hope we can successfully transition to IPv6 in the very near future, or the internet will finish transitioning from a powerful peer-to-peer network back into cable tv where we no longer have the ability to publish without an imprimatur[2].
[1] n:1 NAT using RFC 1918 private addresses
Well, in some environments, it's possible to bind() to an IP address that's not actually present on a local interface, but it's unlikely that your browser would support that.