Re:The unintended consequences of blocking IP addresses
by zamadatix on Saturday December 31, 2022 @12:05AM
(#34193765)
Any shared hosting is fair game for wanting it really. Managing separate IPs for separate entities makes sense when the entities are managing themselves but as soon as that becomes a shared task suddenly 100,000,000 IPs worth of websites can be done in 100 (per the article) and that's just damn convenient to not have to deal with individually. Not to mention it's more flexible - you can route/load balance/failover in arbitrary application logic instead of network reachability logic. An example of this is anycasting gets you to the nearest data center (i.e. IP is reachability) and then the load balancer logic can dynamically spin up/down backend servers with different addresses actually handling the traffic for those millions of sites throughout the day (i.e. name is identity) based on load or other factors. This is taking the strengths of each layer and pairing them. Trying to do that type of thing at scale with just unique individual IP addresses at the reachability layer and you'll end up with not only a giant network infrastructure mess but routing tables so big putting a carrier grade internet router at the top of each rack still wouldn't scale to the IP churn and table size. In all it's just plain more work and more costly to do dedicated addresses, even if the addresses themselves are free.
The RAM thing (and the IPv6 doesn't map 1:1 with DNS thing) aren't about whether or not there are enough addresses it's about explaining why we use large address space to enable something more than having the most addresses possible. That is to say to show the intent in adding more addresses wasn't to turn IP into something that's supposed to be good at providing unique identity it was to do other things. E.g. arguably IPv6 is really a 64 bit protocol, the upper 64 bits are really there for convenience of the end subnet always being the same size (/64) and easily encoding existing client info into the address. Even the largest network gear isn't designed to handle much more than ~16 bits of unique IPv6 client endpoints in all subnets combined yet a single subnet has 64 bits of client address space. A similar thing happens on the internet itself, when we advertise networks it's never smaller than a /48 because we need to be conscious of how the internet route table scales and fitting it into hardware over time. Again that's not to say there isn't some way to encode 10 billion services into IPv6 and have it work it's just further proof the IP layer was never the one meant to provide this type of functionality so we shouldn't try to shoehorn it in and should instead let it focus on being the reachability layer.
And that really boils down the reasons for why shared hosting - it's convenient, it scales better, and it's the better way to do things. One could chose to do things inconvenient, in a poorly scaling fashion, and with more limitations in how you do things and gain the ability to block by IP instead of by name but it just seems a horrible trade off.
And to clarify I'm not one of those anti-IPv6 nuts - I actually run a lot of IPv6 only infrastructure directly on the net through AS400503. Even though I have a /40 all to myself, enough for 65536 /64 subnets, I still do shared web hosting with the v6 addresses because it's less work to do so.
The RAM thing (and the IPv6 doesn't map 1:1 with DNS thing) aren't about whether or not there are enough addresses it's about explaining why we use large address space to enable something more than having the most addresses possible. That is to say to show the intent in adding more addresses wasn't to turn IP into something that's supposed to be good at providing unique identity it was to do other things. E.g. arguably IPv6 is really a 64 bit protocol, the upper 64 bits are really there for convenience of the end subnet always being the same size (/64) and easily encoding existing client info into the address. Even the largest network gear isn't designed to handle much more than ~16 bits of unique IPv6 client endpoints in all subnets combined yet a single subnet has 64 bits of client address space. A similar thing happens on the internet itself, when we advertise networks it's never smaller than a /48 because we need to be conscious of how the internet route table scales and fitting it into hardware over time. Again that's not to say there isn't some way to encode 10 billion services into IPv6 and have it work it's just further proof the IP layer was never the one meant to provide this type of functionality so we shouldn't try to shoehorn it in and should instead let it focus on being the reachability layer.
And that really boils down the reasons for why shared hosting - it's convenient, it scales better, and it's the better way to do things. One could chose to do things inconvenient, in a poorly scaling fashion, and with more limitations in how you do things and gain the ability to block by IP instead of by name but it just seems a horrible trade off.
And to clarify I'm not one of those anti-IPv6 nuts - I actually run a lot of IPv6 only infrastructure directly on the net through AS400503. Even though I have a /40 all to myself, enough for 65536 /64 subnets, I still do shared web hosting with the v6 addresses because it's less work to do so.