top 96 comments

sorted by: hot top controversial new old
[–] 57 points 1 year ago (9 children)

My favorite thing to use IPv6 for is to use the privacy extension to get around IP blocks on YouTube when using alternative front ends. Blocked by Google on my laptop? No problem, let me just get another one of my 4,722,366,482,869,645,213,696 IP addresses.

I have a separate subnet which is IPv6 only and rotates through IP addresses every hour or so just for Indivious, Freetube and PipePipe.

  • source
  • hideshow 9 child comments
  • [–] [S] 16 points 1 year ago (3 children)

    Could you link the privacy extension in question I haven't heard of it

  • source
  • parent
  • hideshow 3 child comments
  • [–] 28 points 1 year ago* (1 child)

    it's not a browser extension, its a SLAAC thing https://www.internetsociety.org/resources/deploy360/2014/privacy-extensions-for-ipv6-slaac.

    TL;DR is that SLAAC used to use part of your device MAC to form it's IP, which would be trackable/fingerprintable. Now devices just pick the last 48-bits at complete random on the assumption that no other device is going to have that specific address out of the 4 quintilion available addresses.

    edit the RFC https://datatracker.ietf.org/doc/html/rfc4941

  • source
  • parent
  • hideshow 1 child comment
  • [–] 20 points 1 year ago (3 children)

    This is exactly why ipv6 was never widely adopted. There's too much power in a limited IP pool.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 1 year ago (2 children)

    Define "widely".

    According to Google 46.09% of their traffic is IPv6 and most servers support it. It's mostly large ISPs dragging their feet.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 216 points 1 year ago (22 children)

    I know it's a joke, but the idea that NAT has any business existing makes me angry. It's a hack that causes real headaches for network admins and protocol design. The effects are mostly hidden from end users because those two groups have twisted things in knots to make sure end users don't notice too much. The Internet is more centralized and controlled because of it.

    No, it is not a security feature. That's a laughable claim that shows you shouldn't be allowed near a firewall.

    Fortunately, Google reports that IPv6 adoption is close to cracking 50%.

  • source
  • hideshow 22 child comments
  • [–] 5 points 1 year ago (2 children)

    Ipv6 took awhile for me to understand. One of the biggest hurdles was how is it secure without NAT.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 1 year ago (7 children)

    You are right, but I wish ipv6 was less shitty of a replacement.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 45 points 1 year ago (1 child)

    I worked with one of the inventors of IPv6 for a bit of time, and I think knowing Carl really gave me an insight into who IPv6 was invented for, and that's the big, big, big networks — peering groups that connect large swaths of the Internet with other nations' municipal or public infrastructure.

    These groups are pushing petabytes of data every hour, and as a result, I think it makes their strategists think VERY big picture. From what I've seen, IPv6 addresses very real logistical problems you only see with IPv4 when you're already dealing with it on a galactic scale. So, I personally have no doubt that IPv6 is necessary and that the theory is sound.

    However, this fuckin' half-in/half-out state has become the engine of a manifold of security issues, primarily bc nobody but nerds or industry specialists knows that much about it yet. That has led to rushed, busy, or just plain lazy devs and engineers to either keep IPv6 sockets listening, unguarded, or to just block them outright and redirect traffic to IPv4 anyway.

    Imo there's not much to be done besides go forward with IPv6. It's there, it's tested, it's basically ready for primetime in terms of NIC chip support... I just wish it weren't so obtuse to learn. :/

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 1 year ago

    However, this fuckin’ half-in/half-out state has become the engine of a manifold of security issues, primarily bc nobody but nerds or industry specialists knows that much about it yet. That has led to rushed, busy, or just plain lazy devs and engineers to either keep IPv6 sockets listening, unguarded, or to just block them outright and redirect traffic to IPv4 anyway.

    Its kind of interesting to me how conservative the IT industry is with stuff like this.

    The industry loves to say "move fast and break things" or "innovate and disrupt", but that generally only applies to things that can be shat out in a two week long Python project (or shat out in 2 weeks after publicly funded universities spent years figuring out the algorithm for you). For anything foundational, like CPU architecture, operating systems, or the basic assumptions about how UI should work, they're terrified of change.

  • source
  • parent
  • [–] 26 points 1 year ago (1 child)

    There is something there, but mostly I think existing net admins try to map their existing IPv4 knowledge onto IPv6. That doesn't work very well. It needs to be treated as its own thing.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 1 year ago

    I couldn't figure it until I turned my brain off and just read the documentation. I was thinking in IPv4 logic, because everyone had told me it was just "bigger IPv4" - it's not. It's so much more, and better.

  • source
  • parent
  • [+] -29 points 1 year ago (2 children)

    Nah. You're just too stupid to understand the internet is designed to be used with DNS. The people who design these protocols and operate the networks that form the internet have no issues with DNS and don't care that you don't understand.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -3 points 1 year ago (7 children)

    We use NAT all the time in industrial settings. Makes it so you can have select devices communicate with the plant level network, while keeping everything else common so that downtime is reduced when equipment inevitably fails.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 27 points 1 year ago (6 children)

    That's nothing that can't be done with a good set of firewalls on IPv6.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 11 points 1 year ago (1 child)

    The one thing you can't do with IPv6 is yell the address across the room to the technician plugged into the switch trying to ping the node.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago*

    no instead you yell the IP address and they spend 30min trying to debug why they can’t ping it or even get ICMP packets through and then you realise you yelled the private IP address and they were on the wrong side of the NAT

  • source
  • parent
  • [–] 4 points 1 year ago (1 child)

    This is equipment that uses all statically addressed devices. And ignoring the fact that IPv6 is simply unsupported on most of them, there are duplicate machines that share programs. Regardless of IP version you need NAT anyway if you want to be able to reach each of the duplicates from the plant network.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago* (1 child)

    Good luck trying to find industrial stuff that supports IPv6, hell most of it is still serial.

    I have legit heard that serial is security mechanism because it cannot communicate long distance like ethernet.

    Of course you can do IPv6 magic that hides IPv6 from the end device, but nobody understands how that magic works.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago

    Of course you can do IPv6 magic that hides IPv6 from the end device, but nobody understands how that magic works.

    it’s not magic… it’s a firewall, and it works pretty much exactly the same as a NAT: a whitelist of IP and port combinations

  • source
  • parent
  • [–] 44 points 1 year ago (8 children)

    The reason IPv6 was originally added to the DOCSIS specs, over 20 years ago, is because Comcast literally exhausted all RFC1918 addresses on their modem management networks.

    My favourite feature of IPv6 is networks, and hosts therein, can have multiple prefixes and addresses as a core function. I use it to expose local functions on only ULA addresses, but provide locked down public access when and where needed. Access separation is handled at the IP stack, with IPv4 it’s expected to be handled by a firewall or equivalent.

  • source
  • hideshow 8 child comments
  • [–] 29 points 1 year ago (3 children)

    My favorite feature of IPv6 is that there are so many addresses available. Every single IPv4 address right now could have its own entire IPv4 range of addresses in IPv6. It's mind-boggling huge.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 18 points 1 year ago* (last edited 1 year ago) (2 children)

    you could assign every square meter of the planet an ip and use it for location, and still have addresses left over

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 1 year ago* (last edited 1 year ago)

    Oh it’s way more than that!

    After looking up some numbers, I note we could give every single square MILLIMETER on the planet its own entire IPv4 address space.

    …And then every one of those IPv4 addresses could have its own entire copy of the IPv4 address space!

    …And that would just be a drop in the bucket compared with IPv6! One good comparison I’ve seen is that you could assign an address to every atom on the surface of the earth (but not inside it) and have enough left over for 100+ more earths.

    Rough math for the square millimeters:

    The surface area of the earth is roughly 510 trillion square millimeters. Let’s round that up to a quadrillion or 10^15^.

    The number of IPv6 addresses is 2^128^ or 3.4x10^38^. To be conservative again, let’s just round that down to 10^38^.

    10^38^ / 10^15^ = 10^23^ IPv6 addresses per square mm of earth.

    IPv4 address space is 2^32^ or around 4 billion. let’s round up to 10 billion or 10^10^.

    So then 10^23^ / 10^10^ = 10^13^ IPv6 addresses per IPv4 address per square mm of earth.

    10^13^ / 10^10^ =

    1,000 IPv6 addresses

    per IPv4 address

    per IPv4 address

    per square mm of earth.

    And that was with the conservative estimates along the way. I think it would actually be tens of thousands.

  • source
  • parent
  • [–] 3 points 1 year ago (2 children)

    They kept talking it was because address exaustion, and IANA sold all the remaining blocks they had...

    I tested it at the time. Ran nmap ping scan across a block all night with zero results. IANA sold the internet

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    many “unused” IP addresses are unused because they’re kinda like having spare parts: if you’re planning on extending your network in the futures, your IP block kinda should reflect your end state (ie the parts you need over time to replace or “build” new hosts)

    or for blue/green deployments where it’s likely that at least half the IP range will be used in terms of process, but unused most of the time in terms of reachability

    and then there’s weird things with splitting up IP blocks into subnets with a division of 3 (the minimum needed for dealing with net splits etc) - eg across availability zones… there are always “waste” IPs because you can’t divide multiples of 8 cleanly into 3

  • source
  • parent
  • hideshow 1 child comment
  • [–] 42 points 1 year ago (6 children)

    I use IPv6 every day and everywhere I can. It solves so many issues in large corporate and ISP network setups. And yes 10. Wasn’t big enough, and NATing is a PitA.

    Honestly we just keep pushing it off when it’s not that bad. Workaround after workaround just because people are lazy.

  • source
  • hideshow 6 child comments
  • [–] 9 points 1 year ago (4 children)

    How much slack did you have in your 10.* network? Or was it literally 16.7 million devices?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago

    Having the breathing room is great.

    You have two teams that independently set up private networks but now someone has to talk to them both?

    In IPv4, they likely stepped on the same private subnets. In ipv6, they pretty much certainly did not step in the same ULA prefixes. My VPN setup is a mess of a maze to deal with the fact that most things I connect to are all independently allocated 10. subnets, with the IPv6 focused customer being easiest.

    Also, if you want to embed information in your addressing, like vlan I'd or room information.

    Besides, you can have addresses like fd37:5f1a:b4c1::feed:face, and that's fun isn't it?

  • source
  • parent
  • [–] 16 points 1 year ago* (last edited 1 year ago) (1 child)

    IPv6 isn't just a larger IPv4. There are features inherent to it, like link-local actually functioning and being predictable, unlike APIPA in v4 which was grafted on as an afterthought and breaks more than it works.

    It also functions router-less. You can grab 30 10-port switches and just stick them together and start plugging computers in. It will work without configuration or an authority.

    I am all v6 internally, but that's not because I have a splatillion devices, but rather it's just better and easier to manage.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    Well sometimes the lla is not predictable, some stacks take privacy addresses to lla, which is silly but they do it. Of course you can multicast ping and check your neighbor table to get the lla chosen in such cases.

  • source
  • parent
  • [–] 40 points 1 year ago (5 children)

    Surely we can do better. Why not IPv10? That's 4 higher than 6!

  • source
  • hideshow 5 child comments
  • [–] 21 points 1 year ago (3 children)

    not sure if you're aware thats a real thing https://www.ipv10.net/

  • source
  • parent
  • hideshow 3 child comments
  • [–] 57 points 1 year ago* (last edited 1 year ago) (1 child)

    Skill issue

    IPv6 is easy to do.

    2000::/3 is the internet range

    fc00::/7 is the private network range (for non routing v6)

    fe80::/64 is link local (like apipa but it never changes)

    ::1/128 is loopback

    /64 is the smallest network allocation, and you still have 64 bits left for devices.

    You don't need NAT when you can just do firewalling - default drop new connections on inbound wan and allow established, related on outbound wan like any IPv4 firewall does.

    Use DHCPv6 and Prefix Delegation (DHCPv6-PD) to get your subnets and addresses (ask for a /60 on the wan to get 16 subnets).

    Hook up to your printer using ipv6 link local address - that address never changes on its own, and now you don't have to play the static ip game to connect to it after changing your router or net config.

    The real holdup is ISPs getting ultra cheap routers that use stupid network allocation systems (AT&T) that are incompat with the elegant simplicity of prefix delegation and dhcp.

  • source
  • hideshow 1 child comment
  • [–] 27 points 1 year ago (4 children)

    I'm surprised by the comments here. I use 90% IPv6. For me v4 is only present for retro compatibility. The transition was hard however.

  • source
  • hideshow 4 child comments
  • [–] 20 points 1 year ago (3 children)

    Was?

    It's still in progress..

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago

    I'm fully transitioned. The first step was getting an Internet provider that featured it. I had to change providers for that. Then I had to find equipment that worked. Some of the things that have an early implementation of IPv6 don't actually work. It's like they never actually tested it. Then I had to integrate IPv6 in the way everything worked. I'm a big user of unique local adresses, which I feel isn't a really well known feature.

  • source
  • parent
  • [+] 25 points 1 year ago (2 children)
  • [–] 51 points 1 year ago (16 children)

    In my personal life I will probably "never" intentionally use ipv6.

    But it is a DAMNED good sniff test to figure out if an IT/NT team is too dumb to live BEFORE they break your entire infrastructure. If they insist that the single most important thing is to turn it off on every machine? They better have a real good reason other than "it's hard"

  • source
  • hideshow 16 child comments
  • [–] 12 points 1 year ago (3 children)

    Realistically no organization has so many endpoints that they need IPv6 on their internal networks. There's no reason to deal with more complicated addressing schemes except on the public Internet. Only the border devices should be using IPv6.

    Hopefully if an organization has remote endpoints which are connecting to the internal network over the Internet, they are doing that through a VPN and can still just be assigned IPv4 addresses on dedicated VLANs when they connect.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 1 year ago (1 child)

    If you don't have ipv6 internally, you probably can't access ipv6 externally. 6to4 gateways are a thing. 4to6? Not so much.

    And this is why ipv6 will ultimately take another 20 years for full coverage. If it was more backwards compatible from the starting address-wise then this would all have been smoother. Should have stuck with point separators. Should have assumed zero padding for v4 style addresses rather than a prefix

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 1 year ago

    If you don’t have ipv6 internally, you probably can’t access ipv6 externally. 6to4 gateways are a thing. 4to6? Not so much.

    I'm pretty sure stateful gateways do exist, but it's a massive ball of complexity that would be entirely avoided if people just used native v6.

  • source
  • parent
  • [–] 17 points 1 year ago (11 children)

    It’s vulnerable af. And I mean really, it’s as bad as Netscalers or Fortigate shit. Like https://www.bleepingcomputer.com/news/security/hackers-abuse-ipv6-networking-feature-to-hijack-software-updates/ or https://www.bleepingcomputer.com/news/security/hackers-abuse-ipv6-networking-feature-to-hijack-software-updates/

    Problem is, yes it’s hard to implement but it’s even a lot harder to get it properly secured. Especially because few people are using it, and not securing it is worse than disabling it.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 22 points 1 year ago (5 children)

    And I would consider a detailed argument on why it is more secure to disable it to be a good reason.

    Personally? I consider an IT team who don't know how to secure an ipv6 enabled network to not be competent. But that is a different conversation.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (2 children)

    It has less eyes on it due to it being less popular. It also introduces an extra vector of attack.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    It does not have less eyes on and it's 50% of Google traffic.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Think they mean local networks.

    If an IT department carefully curates IPv4 but ignores IPv6, then a rogue actor can set up a parallel IPv6 network largely without being noticed.

    IPv6 can be managed, just that it is a blindside for a lot of these departments.

  • source
  • parent
  • [–] 7 points 1 year ago

    My detailed explanation at my old job is that the dev team was full of idiots who hardcoded ipv4 addresses into their fucking code. Seriously. When we migrated from data center to cloud they had to go patch everything. The CTO wouldn't do shit about it and the director was just there riding things out until retirement.

  • source
  • parent
  • [–] 21 points 1 year ago (1 child)
  • [–] 21 points 1 year ago (4 children)

    CGNATs suck ass though, I had to buy a vps just to access my own network outside my home.

  • source
  • hideshow 4 child comments
  • [–] 6 points 1 year ago (2 children)

    I've recently changed isp and am now hitting CGNAT problems. I have been running Nextcloudpi for years and now I can't access it from outside. I've trying to understand if I can fix the problem using IPv6 but from what you've said I'm now wondering if a vps is the solution?

  • source
  • parent
  • hideshow 2 child comments
  • I deal with cgnat on my 2 isps at home. Install tailscale on your vps and your router at home and then on your router you can share subnet devices over your tailscale network. Install a reverse proxy on your vps.

    If set up correctly you can route a human readable web address (jellyfin.example.com) to your vps static ip address and then to, for example, a docker container with local address 192.168.100.1:8096, via reverse proxy.

  • source
  • parent
  • [–] 18 points 1 year ago (1 child)

    fun fact, the RFC introducing NAT calls it a "short-term solution"

    https://www.rfc-editor.org/rfc/rfc1631

  • source
  • hideshow 1 child comment
  • [–] 17 points 1 year ago

    I love the flat earther energy in this

  • source
  • [–] 33 points 1 year ago (3 children)

    Meh, the idea of having every address be globally routable makes a lot of sense. NAT is a great bandaid but it's still a bandaid. It still limits how peer to peer and multicast applications function, especially on larger networks.

  • source
  • hideshow 3 child comments
  • [–] 15 points 1 year ago* (last edited 1 year ago) (2 children)

    NAT444 is shit. I can't even host a web server without routing it through a VPN, and my ISP can't work out how to provide an IPv6 addresses yet. Give it to me and I will work out how to use it.

    Slight update - Just looked and apparently they had a goal of rolling out IPv6 addresses to all customers by earlier this year. I'll check my router config tomorrow and who knows. Maybe I will be able to get one now? Would be pretty sweet.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 year ago (1 child)

    I am sorry to interrupt, my ISP gave me an ipv6 address, but I just can't access anything through it even when I specify it in the firewall, maybe they are blocking this functionality because they sell static ips.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments
    view more: next ›