News for hackers. Stuff that matters.

A comment on The world in which IPv6 was a good design (2017). Parent comment

Re:The world in which IPv6 was a good design (2017) by mikewarot on Tuesday December 29, 2020 @11:00AM (#25571034)
[Edit] The problem with public addressed end nodes is the Operating Systems we use aren't secure. Linux and Windows are unfit for purpose in a world of persistent connectivity. Suitable alternatives do exist, but aren't well known.

Once I get Genode or GNU Hurd running, I'll gladly hook it straight to the the full IP4/IP6 public addressed internet. Until that day, nope.

[ Parent | on HN ]
Re:The world in which IPv6 was a good design (2017) by stouset on Tuesday December 29, 2020 @01:02PM (#25572662)
You’re confusing a firewall and a NAT. Having a publicly routable IP address does not in any way imply allowing external connectivity to that address.

The firewall rule that allows packets from ESTABLISHED and RELATED connections back to a host behind a NAT is the exact same rule that allows packets to get through a default-drop firewall.

[ Parent | on HN ]
Re:The world in which IPv6 was a good design (2017) by mikewarot on Tuesday December 29, 2020 @09:19PM (#25577621)
If your computer is secure, you don't need a firewall.
[ Parent | on HN ]
Re:The world in which IPv6 was a good design (2017) by Dagger2 on Tuesday December 29, 2020 @11:33PM (#25578572)
And if you don't think Linux and Windows are secure, then you do. Either way, you shouldn't be putting them behind NAT.

You should put them behind NAT if you want to connect your network to the internet but you don't have enough IP space to do it. It has nothing to do with how secure you think your OSs are.

[ Parent | on HN ]
Re:The world in which IPv6 was a good design (2017) by mikewarot on Wednesday December 30, 2020 @11:46AM (#25583205)
You misunderstand the depths of my pessimism.

I don't believe any firewall out there is fit for purpose, because the OS on which it is based is likely to be insecure. On top of that OS would then be the firewall software itself.

I would truly love to be proved wrong, but mathematically proven systems are few and far between.

[ Parent | on HN ]