Rendered at 01:38:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
JdeBP 15 hours ago [-]
Just to add to the 'but the ISPs do not' anecdotes, it has been six months since someone last commented so it is probably time to mention this again on Hacker News:
A major ISP in the U.K., that said in a public statement on World IPv6 Day in 2011 that
> As well as our core and access networks being capable of supporting IPv6, we're rigorously testing our entire network to ensure that all customers have a smooth and simple transition when the time comes to flick the switch and turn IPv6 on. We're really pleased with how our tests are advancing and are happy to say that by the end of 2012, we'll be able to fully support customers looking to switch to IPv6.
has not managed to actually flick that switch in 15 years.
The way to pressure ISPs to support IPv6 is stupid but effective:
1. Sites that help shoppers choose can add a big visual red flag to any ISP that doesn’t support IPv6. Consumers don’t know what IPv6 is by and large but they do understand seeing a big red flag.
2. Same thing for websites. Add a banner that says “hey your ISP doesn’t support proper internet connectivity which this site utilizes. Contact them to let them know that you are having internet issues.” Again, consumers do not know what’s IPv6 is, but they do know what annoying banners are.
xp84 8 hours ago [-]
From a US perspective, for your #1, the idea of people “shopping” for broadband, is astonishing. Most people here have available to them one single DOCSIS provider and that’s it. A few lucky ones have a FTTP option too, but that definitely not available to more than 25% of addresses.
(It’s true that you can use cellular for your home internet, but I consider that extremely compromised.)
crote 4 hours ago [-]
You have to decouple the physical infrastructure from the service provider - how else are you supposed to have competition in a market with a natural monopoly? It's just about the only thing the EU did right during the mandated privatization of infrastructure.
8 hours ago [-]
r3trohack3r 7 hours ago [-]
Starlink shattered this monopoly in my area.
WarOnPrivacy 4 hours ago [-]
> Starlink shattered this monopoly in my area.
The parent was noting that most of the US lives in a region, that is under a monopoly of wireline ISP (DOCSIS, FTTH). Starlink can't shatter a wireline monopoly because it is OTA.
CursedSilicon 4 hours ago [-]
A single extra provider does not mean a monopoly is "broken". Especially if they aren't even competing in the same niches
kvdveer 8 hours ago [-]
What would be the incentive for site owners to reduce the appeal of their site? The user has connected to the site, so there's obviously no immediate problem.
londons_explore 8 hours ago [-]
Back when Https deployment wasn't widespread, Chrome added a deliberate delay to http sites so Https sites appeared faster. That was the incentive for deployment for many, because until then Https was generally slower (extra round trips to set up the tls connection).
yesturi 7 hours ago [-]
I think this is a classic chicken and egg problem and the only way to solve this issue is government regulation. Anyone aware of the mandatory IPv6 in Europe? I heard that the Chech Republic is doing something about it. I Poland, only Orange and probably TMobile supports it, the smaller ones - almost none.
GenerWork 7 hours ago [-]
This will work on nerds (aka the HN crowd) but the average person will read that and wonder why they should care when the page loaded. Also, if you keep displaying the banner people will grow accustomed to it and ultimately ignore it.
kortilla 8 hours ago [-]
Regular person, “This site requires some weird technology, I’ll shop somewhere else.”
This is one of those “if everyone just” solutions that doesn’t work because shopping websites would never do that. Amazon has tons of evidence that even the slightest bits of friction result in noticeable drops in sales.
londons_explore 8 hours ago [-]
And yet Amazon's site seems to be half baked and buggy every time I visit.
gertrunde 13 hours ago [-]
I once asked them if we could enable IPv6 on a 1Gb DIA circuit, and the response I got back was that "we can convert the circuit to IPv6, but you'll need to give up your IPv4."
I don't think I bothered asking them again!!
(Edit "them" = Virgin Media)
inigyou 12 hours ago [-]
Sure they didn't just mean they'd change your static IPv4 address to a different one?
gertrunde 9 hours ago [-]
Quite possibly.
But the way that they dealt with the whole thing smelt very "we don't know what we're talking about", enough to put us off.
And shifting all the IP space about would have had costs with very little return, so little business appetite to go through it.
mapkkk 7 hours ago [-]
in my case, they did this without input from me.
I only found out because I could no longer access a swath of things I used to be able to.
not virgin media, but in the EU
bebe83939 12 hours ago [-]
[dead]
jonathantf2 14 hours ago [-]
Purely from a business perspective, for VM there is no point. They have more than enough v4 to keep them going, customers (outside of a tiny technical minority who probably wouldn't chose VM anyway) do not see any benefit.
That plus other ISPs v6 implementations breaking things randomly, I understand why they don't bother.
lambdaone 11 hours ago [-]
The slow adoption of IPv6 by many older companies is at least in part a paradoxical result of the success of IPv6 elsewhere, particularly in new builds where there is practically no overhead in deploying IPv6 in a green-field environment - see for example the mobile telecoms market in developing countries, where new builds are IPv6-first.
This has taken pressure off the IPv4 legacy address pool, reducing the urgency for older providers.
End-users are typically completely unaware of whether their traffic is being carried over IPv6 or IPv4, and so simply do not care one way or the other. (This particular post is more than likely being made over IPv6, since news.ycombinator.com has an IPv6 address and my OS, browser, router and ISP all support IPv6 straight out of the box, as is now true for the majority of users in my country.)
Hizonner 13 hours ago [-]
Right. Which is why this is not a choice businesses should be allowed to make.
post-it 13 hours ago [-]
Of all the things to regulate why bother with this one? It's not like IPv6 is better for the environment or useful to the consumer.
dijit 13 hours ago [-]
depends on how you look at it. Right now it's very much a tragedy of the commons.
IPv6 not being supported in many places means the internet is more centralised, less likely to use proper p2p tech- because it's a lot harder to make it work rather than throwing up a TURN box and relaying everything.
"The latency? Who cares? IPv6 sometimes breaks right now" - because nobody is testing it, so why should people be the first to support it? There's no easy upside.
The only real upside for businesses is not having to pay for increasingly expensive IPv4 allocations. But they don't really care, its not nearly expensive enough yet. Customers will get GCNAT, businesses will continue as normal.
All that will happen is that the internet gets slower and less equal.
Which is exactly the same thing that's happening with inefficient memory hungry software: people either have to buy a more expensive laptop or they have a shitty experience.. Nobody is advocating for them, they just feel things getting shittier year on year and many are just choosing to avoid technology instead.
gruez 12 hours ago [-]
>IPv6 not being supported in many places means the internet is more centralised, less likely to use proper p2p tech-
Realistically nobody outside some devoted HN readers are going to self host their own content. At best you'd see something like netflix trying to offload their video hosting costs onto their customers.
inigyou 12 hours ago [-]
Well yeah, because they can't. Maybe if they could, they would do it more. You probably wouldn't want to host a permanent website from home, although some people do, but you could share a file. It would be popular with game servers, too.
gruez 11 hours ago [-]
>You probably wouldn't want to host a permanent website from home, although some people do, but you could share a file.
bittorent has been around for decades and nobody used it. They emailed files to themselves instead, or used dropbox. This all happened before the ipv4 shortage and people getting moved to CGNAT.
miyuru 10 hours ago [-]
internet is used by billions of people, not just you.
gruez 9 hours ago [-]
You sure you don't have this reversed? The average person uses the internet to watch tiktok videos and join zoom meetings, all of which is centralized. The people self hosting their NAS or minecraft server is a tiny minority.
dijit 8 hours ago [-]
> join zoom meetings
no reason this has to be centralised.
in fact, Jitsi uses p2p with WebRTC until a third person joins the call: then migrates the call to be relayed.
A really nice latency win.
inigyou 5 hours ago [-]
maybe because centralised is the only way you can do it
lazide 10 hours ago [-]
Nobody used BitTorrent? LoL
ISPs had/have whole groups trying to stomp it out.
And it was a nightmare due to NAT even then.
It just got worse with CGNAT.
kortilla 8 hours ago [-]
I think the commenter you’re replying to is pointing out that nobody used BitTorrent for legitimate cases. And that take is sadly correct. Despite having huge upsides, everyone just hosts on centralized CDNs, file syncing services (gdrive, Dropbox, etc).
Even Linux distros push you so direct downloads now rather than pointing to trackers.
BitTorrent only has healthy usage for content that’s untenable to host legitimately.
lazide 8 hours ago [-]
That is because BitTorrent has been targeted so much.
Also, hey now - I have a lot of (actual) Linux disk images, and it works well for that!
ivlad 1 hours ago [-]
> Realistically nobody outside some devoted HN readers are going to self host their own content.
P2P is not “self hosting”.
It’s video/audio conferencing working with less latency. It’s the ability to send a file directly and not via some file sharing site. It’s multiplayer gaming simplified. It’s faster software updates via BitTorrent.
dijit 12 hours ago [-]
The sheer amount of times Airdrop has been the "best" way to share files takes away from your point a bit.
It's almost always faster than anything else available, and ipv6 would make that method of sending files closer to the default for most people.
Having VOIP in games or 1v1 lobbies is, in the strictest sense, "hosting" something in the same way.
FD: I work in video games so I speak from this bias.
crote 4 hours ago [-]
IPv6 doesn't solve the Airdrop problem. It'll only work at reasonably-fast speeds in the rare case that both people are connected to the same wifi network - but there's already tools like LocalSend[0] for that. Having a file go via cellular provider A, halfway across the country, through some IX, halfway across the country back, and via cellular provider B tends to make things a bit slow.
Similarly, using P2P for game VOIP is a Really Bad Idea as it basically doxxes the player. Even 1v1 lobbies aren't always with people you trust enough to invite them into your house, so you shouldn't be handing them your IP address! In 99% of cases it is better to proxy it via a server instead.
Obviously I can't see the future, and I live in my own bubble....
Isn't self hosting, and small, private/semi-private communities the only way forwards for much of the internet? AI has made content extremely valuable, which in turn has started to destroy the openness of the web. Things are getting more and more siloed, with entry fees.
There's a world where self hosting comes back in a big way. AI ironically makes it much easier.
crote 4 hours ago [-]
Self hosting doesn't mean home hosting.
Someone DDoSing the $10 VPS hosting my personal website is no big deal. I don't care about it strongly enough that it must stay online, so they'll eventually get bored and move on.
Someone DDoSing my home internet connection? That's going to be a serious inconvenience - especially with WFH. No internet for a week isn't an option.
throw0101a 12 hours ago [-]
> Realistically nobody outside some devoted HN readers are going to self host their own content.
How about Xbox/PS multiplayer/P2P gaming? Hosting a Minecraft server?
When Skype first came out it was P2P, but had to come up with the "supernode" concept (basically STUN/TURN/ICE) because of NAT: now all of our communication methods basically have to phone into the mothership.
Do we want the Internet to be more centralized (possibly given more power to the tech bros) or more decentralized?
crote 4 hours ago [-]
Would you give your personal phone number to random strangers on the internet, or even publish it on a website? Probably not, due to the possibility of harassment, right? IP addresses aren't any different, which immediately kills a huge portion of the game server self-hosting.
A hosted and managed Minecraft server is available for less than the cost of a cup of coffee per month. At that price point it makes very little sense to deal with the hassle of having to run your own home server. Even if you want to geek out and manage it yourself, a VPS is a very attractive option.
And for the handful of people that remain and really want to homelab a Minecraft server for their friends but are stuck behind CGNAT, there's always software like Hamach - which solved the gaming NAT problem back in 2004.
So no, self hosting isn't a problem which needs IPv6 to solve it.
throw0101a 3 hours ago [-]
> Would you give your personal phone number to random strangers on the internet, or even publish it on a website? Probably not, due to the possibility of harassment, right? IP addresses aren't any different, which immediately kills a huge portion of the game server self-hosting.
You talk of a singular number in this analogy, but that is completely non-sensical in the IPv6 context: even brain dead ISPs assign /64s to residential connections, so you could give random strangers a random IPv6 address that's valid for a few hours and then you remove it from service.
Want to provide a service? Generate a new address, assign it to the server, publish it to whomever you wish. When you're done remove the ip addr alias. Give each rando their own IPv6 address for the service that's only live for a finite amount of time.
In fact you could generate a new IPv6 address each second in your assigned /64 and you wouldn't run out for 584,942,417,355 years.
lwhi 13 hours ago [-]
Maybe the solution is to make IPv4 prohibitively expensive.
lazide 10 hours ago [-]
Or even just expensive.
kortilla 8 hours ago [-]
The p2p tech argument doesn’t work anymore. Most routers ship a stateful IPv6 firewall enabled by default now because IPv6 was resulting in people’s vulnerable shit getting popped.
So p2p stuff still doesn’t work without explicit configuration that rules out 99% of your users. It’s super annoying.
kalleboo 18 minutes ago [-]
Hole punching works fine for p2p. It even works fine on IPv4 NAT, but there are a bunch of edge cases (often involving CGNAT) where it breaks down so you can't rely on it, which are solved by IPv6.
Yeah, it's impossible to do anything about a stateful firewall to get p2p connections.
It's a shame because if we could only get over stateful firewalling we'd be one step closer to the impossible task of using voice chat in console video games.
Right now they don't have that of course and the only hurdle is "NAT Types" which, as we all know, is a much easier problem to solve for the average person...
(this was sarcasm, if it wasn't clear).
throw0101a 12 hours ago [-]
> Of all the things to regulate why bother with this one? It's not like IPv6 is better for the environment or useful to the consumer.
If I'm with a small-time ISP that has to use CG-NAT because they don't have the cash to buy/lease enough IPv4 addresses to give one to each CPE WAN interface, then using things like Xbox/PS multiplayer/P2P gaming is no longer possible. Want to host a Minecraft server? Too bad.
Are those two use-cases "useful to the consumer"?
icedchai 11 hours ago [-]
You are right, but ISPs will tell you that you're not allowed to host servers anyway. Most have it in the AUP.
throw0101a 3 hours ago [-]
1. Is trying to use Xbox/PS2 multi-player functionality "hosting"?
2. Perhaps our expectations of what you should be allowed to do is too low?
jjmarr 10 hours ago [-]
I did port forwarding in 2010 for a Minecraft server. Basically every router supports it.
It wasn't meaningfully more difficult than setting up the server.
IsTom 10 hours ago [-]
You can't do that with CGNAT.
crote 3 hours ago [-]
You can, it just requires the ISP to play nice.
CGNAT doesn't have to draw a random ip:port combo out of a hat for every new connection. Nothing is stopping an ISP from implementing it by taking one ip and assigning ports 1-10.000 to customer A, 10.001 - 20.000 to customer B, and so on. Similarly, nothing is stopping an ISP from adding long-lived mappings to an otherwise-random pool which outlive the initial connection.
Some ISPs offer CGNAT traversal by letting you request a fixed ip:port combo via their self-service website. It's pretty much the same as regular NAT traversal, except that you can't freely pick the outside port. And because the number of people who actually care about it is so small: some ISPs even let you request to be exempted from CGNAT altogether! They'll already have a pool of legacy non-CGNAT customers and a pool of new CGNATted ones, so assigning a handful of nerds to the legacy pool to prevent them from complaining isn't a big deal.
kalleboo 12 minutes ago [-]
Can we at least stop claiming that IPv6 is "more complicated" than IPv4 when we're making it a requirement for IPv4 ISPs is to create CGNAT management portals.
lazide 10 hours ago [-]
Most isps, you can’t do that anymore as you no longer have a publically reachable IPv4 address. It moved the ‘just configure your router’ part to their equipment, as they now use CGNAT.
It’s gotten much worse.
inigyou 13 hours ago [-]
It reduces the monopolization power of big cloud providers. This is especially relevant to countries that aren't the US, because it reduces reliance on the US.
It also just reduces resource waste (of labor time). Countries like China that have insufficient IPv4 addresses and political power have mandated it. One IP per home is manageable, for now, but CGNAT is really bad.
Hizonner 13 hours ago [-]
Actually not as much point now.
The reason to regulate in maybe 2000 or so was that staying with IPv4 led to NAT. NAT led to it being impossible for users to receive incoming connections. Inability to receive incoming connections led to (a) horrendous protocol complexity, (b) probably some applications never even being invented, and, (c) everybody using ultra-centralized services. Ultra-centralized services led to advertising-driven distortions of service utility, concentration of political and economic power, and choke points. Choke points led to surveillance state bullshit that's just fully ripening today.
And, yes, this was (in broad outline) foreseeable in 2000. I wasn't the only one.
inigyou 12 hours ago [-]
The best time to plant a tree is 20 years ago...
lotsofpulp 9 hours ago [-]
We are locked into apple and google backup services because of CGNAT. If ipv6, and symmetric fiber internet, was ubiquitous when smartphones came out, there could have been a competing option that backs up your own data to an appliance in your own home.
Their core network has IPv6, but not their customers, 17% market share in telecom in the Netherlands.
Are there more?
wolvoleo 11 hours ago [-]
They also got hacked recently and all their customer details were published.
PS: From the millions of customers' details leaked it sounds like their market share is a hell of a lot higher than 17%!
wolvoleo 5 hours ago [-]
Yeah I looked it up, they're talking about 6.2 million customers' details.
That's 30% of the NL population.
crote 3 hours ago [-]
That's because Odido violates the GDPR by retaining data of ex-customers. The hack also included data from people who stopped using their services several years ago.
mlyle 8 hours ago [-]
We're finally getting there in the US, though. Top ASNs are >75% IPv6 capable.
It's Optimum Communications and Frontier (my provider) that are really holding the numbers down at ~15% each. The latter is improving very slowly, but not a lot of evidence of change in the former.
JdeBP 7 hours ago [-]
Indeed. The U.S.A. is currently well above the U.K. in the APNIC statistics hyperlinked-to by the headlined article.
After several decades, IPv6 has proven itself as a supplement to IPv4.
10 hours ago [-]
FireBeyond 9 hours ago [-]
I finally managed to get Xfinity giving me a /60, and then figuring out a SLAAC setup that works across my layer 3 home network (mostly me realizing that SLAAC was the way to go versus trying to figure out DHCPv6 and Ubiquiti Edge stuff).
globular-toast 14 hours ago [-]
15 years is plenty of time to switch away from them. IPv6 is just one reason. It's a shit ISP. I ditched them as soon as I could and cited IPv6 as a reason, in case it made a difference (I also questioned my new ISP before I joined).
Virgin Media exist for two reasons: first they were given a monopoly by their Tory chums (Thatcher) and, second, all ISPs are allowed to make you sign absurdly long, anti-competitive contracts (18 months is common). If ISPs were treated the same as utility suppliers we'd probably be in a better place.
When I set up a "pure" (not really) IPv6 server, was surprised that Github does not support it. Without the voluntary operations listed at https://nat64.xyz/ , they'd be unreachable from IPv6.
boredatoms 6 hours ago [-]
Github’s lack of v6 is completely unforgivable
dapperdrake 14 hours ago [-]
And the Internet routes around a problem, yet again.
Good example of the 2020s on why there is practically truly only one Internet instead of many.
ThePhysicist 16 hours ago [-]
Noooo, my /22 IPv4 subnet allocation is my personal 401k, I need this money to retire.
stymaar 15 hours ago [-]
You joke, but its exactly how society thinks about housing…
chung8123 10 hours ago [-]
It is difficult to retire with house equity. Housing is just one element of what you need to have in retirement and after a certain point, and especially in retirement, once the house is what you plan to stay in forever it is better if it is worth less (all other social factors aside) so that you don't pay as much in taxes on it.
nine_k 8 hours ago [-]
The point is usually to sell a big house in a desirable location, buy a modest house in a less posh an tax-lighter location, and invest the difference to have a steady stream of income.
seba_dos1 7 hours ago [-]
You usually only need one house to have in retirement, just like you likely won't need a whole /22 in retirement.
heresie-dabord 11 hours ago [-]
Be a good neighbour, the AI data centres need to live somewhere.
mimsee 16 hours ago [-]
Time to cash in?
hdgvhicv 15 hours ago [-]
Prices have been coming down for years in nominal terms, let alone real terms. Cg nat does everything that’s needed, there are no significant ip6 only services, there are plenty of ip4 only services, so you have to support ip4 anyway, so why bother with ip6
My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. I disagree, but I do agree that having 4 and 6 is a higher risk than 4 alone or 6 alone, and 6 alone sadly still doesn’t work reliably.
All the “promise” of ip6, direct connections etc, were lost when stateful firewalls became required and memory became cheaper than $20 a megabyte. Some bespoke old protocols don’t like ports changing, which can be a problem, but it’s a very small number and easier to work around with modern protocols than support a dual stack environment securely for the majority of places that struggle securing a single stack.
throw0101a 15 hours ago [-]
> My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk.
If your corporate laptops are running Windows, then you're going against the officially supported configuration of the vendor (Microsoft):
> Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions.
> We don't recommend that you disable IPv6 or IPv6 components or unbind IPv6 from interfaces. If you do, some Windows components might not function.
Except for making it convenient for end-user to, say, play P2P video games, or host Mindcraft servers, etc.
> […] and 6 alone sadly still doesn’t work reliably.
It's so unreliable that half of all Internet traffic uses it. It's so unreliable that Microsoft has been going IPv6-only in their corporate networks (a decade ago):
Everything that's needed besides letting computers talk to each other, that is.
With ipv4 you have a two tier internet. Computers talk to servers, servers talk to servers, computers can't talk to computers so every video call must be routed through a server.
ghusto 15 hours ago [-]
I hear this as a cited as a benefit of IPv6 a lot. Honest question: Isn't this at least a privacy issue, at most a security issue? SLAAC seems like what we already have with extra, breakable steps, which doesn't effectively address the privacy issue anyway.
TheDong 15 hours ago [-]
Where's the privacy issue?
That the server can figure out that two computers in the same house are different since your laptop and phone no longer share the same ipv4 address but instead have two ipv6 address?
Security? NAT is not a firewall, you need a firewall, and switching to IPv6 does not remove your firewall.
Before IPv6: The server gets "1.2.3.4:56789" for your device. After IPv6: the server gets "1:2:3:4::56" or whatever for your device. In either case, if the server makes a connection to 1.2.3.4:56789 or 1:2:3:4::56, your router sees the packet and firewalls the connection. Cool.
Want to give me a concrete example of where IPv6 is hurting my privacy or security, because I've been using it for over a decade with zero mishaps, zero privacy issues, zero security issues (to my knowledge at least)
NitpickLawyer 11 hours ago [-]
> NAT is not a firewall,
I've only read that on HN, I've never heard this anywhere else. Since it's been a good 20+ years since my CCNA (and haven't needed to renew it since), could you please offer a real-world example where NAT is not a firewall w/ practical examples relating to 99.9% of cases of home use? I just can't get why people say this a lot here.
NAT works and passes the grandma test. If grandma buys a crappy vulnerable 40$ printer and plugs it in, even if it accepts unauthenticated stuff on every local port, you will not be able to connect to it behind NAT. So what's the difference? The only way I could think this can apply is if the ISP is compromised or criminally mismanaged, in which case you probably already have bigger problems.
throw0101a 7 hours ago [-]
> I've only read that on HN, I've never heard this anywhere else.
Well-regarded networking architect, author, and instructor:
So does my Asus with a default deny IPv6 rule on incoming connections.
You're more likely to click on a link that installs malware that attacks your network from the inside, and that attack works regardless of IPv4 or IPv6.
Treating a firewall as some impenetrable moat has not been network security practice for a decade(+), and waving around RFC 1918 address space like systems with a 10.8 or 192.168/16 can't get infected is lazy thinking. It leads to complacency: I'm behind NAT, I'm safe.
kstrauser 9 hours ago [-]
Grandma’s ISP can send RFC 1918 traffic to her router and likely be able to directly connect to every internal host. You should have learned in your CCNA training that NAT makes it harder to send inbound traffic to a system, but doesn’t by itself provide the filtering that a firewall does.
NitpickLawyer 9 hours ago [-]
Right, I get that. I can see the ISP angle. But my question was specifically for outside attacks. Tangible, real-world threats in existing ISPs, reachable from the outside.
mlyle 8 hours ago [-]
NAT was not designed as a security boundary. Sure, it may block some kinds of incoming traffic accidentally and as a side-effect disrupt some attacks.
But why would you rather have an always-broken network that might block attackers instead of a deliberate "deny incoming" rule that does exactly what you want -- and that you can punch holes in if desired?
Instead we have apps circumventing this accidental barrier with STUN, uPNP, etc with little/no oversight and we also regularly encounter brokenness.
fegu 4 hours ago [-]
I agree. NAT, while occasionally limiting, was a godsend. Just imagine how the world would look if everyone out there was at the mercy of a well configured router with firewall.
inigyou 15 hours ago [-]
They used to recommend using the MAC address. This was ok 30 years ago when a computer sat in an office on a desk but it makes it very easy to fingerprint a moving computer as it moves across different networks.
Using a random address (Privacy Extensions) solves this problem though, but do we expect everyone to know what that is and check it's enabled? Mine wasn't enabled by default (on Linux) and I only noticed when a bittorrent site warned me.
throw0101a 14 hours ago [-]
As mentioned by GP, Apple enables privacy extensions on all their OSes:
Could you publicly shame the distro that had that issue? Pretty sure it should be the default (on NixOS at least it is).
doubled112 9 hours ago [-]
Fedora doesn’t enable privacy extensions by default, if I recall correctly.
throw0101a 7 hours ago [-]
Debian does.
TeMPOraL 15 hours ago [-]
Everything useful is a security issue. Security is a trade-off, not a positive stat you maximize. Every security tightening removes some utility from a system; the hope is that this disproportionally disrupts the "bad actors" over "good ones".
(All of that hinges on the key question that people seldom ask: what is being protected, and from who. The "two-tier" Internet is, in a way, pointing out a case where regular users are seen as threat actors.)
ikari_pl 15 hours ago [-]
And wasn't that THE POINT of the internet and it's decentralised design?
inigyou 15 hours ago [-]
Yes. Letting anyone talk to anyone was the point of the internet. It's been co-opted by these massive centralising forces and you know what? They're right. With IPv4 everything has to be centralised, we don't even have the faintest chance to avoid it. With IPv6 at least we have a chance to take it back.
Some people will mention stateful firewalls. They're pretty easy to holepunch through because you just need each side to send a packet to the other, then each firewall sees it as an outgoing connection and allows it. It's nothing like IPv4 NAT.
somat 13 hours ago [-]
The comparison between a statefull firewall and NAT is often because they feel like they are doing the same thing from a mechanical point of view.
For example here is how to achieve the same result in PF, note the single additional operator needed to specify nat.
block in on $EXT_IF
#NAT
pass in on $INT_IF to any rdr-to $EXT_IF
#statefullfirewall
pass in on $INT_IF to any
jampekka 15 hours ago [-]
> My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. I disagree, but I do agree that having 4 and 6 is a higher risk than 4 alone or 6 alone, and 6 alone sadly still doesn’t work reliably.
I had a very concreteish security risk with IPv6 and openvpn. At least in Debian config openvpn tunneled only IPv4 by default. I only noticed this by being surprised I got results tailored to my origin country instead of the VPN out node country.
It's eternal (dual stack) paper cuts like this why just turning IPv6 off makes life a lot easier.
scandox 16 hours ago [-]
About 2023 I think
jampekka 16 hours ago [-]
You'll be really screwed in around the year 2100!
spockz 16 hours ago [-]
Meanwhile T-Mobile/Odido in the Netherlands is still not supporting IPv6 despite promising to have been working on it for years.
Ubiquity gateways also seem to not support it sadly. It would be awesome if they supported something like Hurricane Electric’s tunneling.
> It would be awesome if they supported something like Hurricane Electric’s tunneling.
HE tunnel IP space is now sufficiently penalized as non-residential/office that I’ve had to turn it off anyway. YouTube, for example, largely seems to block users in HE space unless they are logged in, and I frequently ran into neverending captchas.
kay_o 16 hours ago [-]
It is entertaining that the situation becomes opposite in T-Mobile on States does not support IPv4 and only assigns IPv6 with 464xlat for "Fake-NAT" to IPv4.
throw0101a 12 hours ago [-]
> Meanwhile T-Mobile/Odido in the Netherlands is still not supporting IPv6 despite promising to have been working on it for years.
Every ISP has to pay Hurricane Electric for their tunnels, that's why it's free to you. If enough people start using HE tunnels, ISPs will get native IPv6.
But you can't use HE tunnels because every website you visit will block you. You also can't use them from CGNAT or if your home router doesn't have a DMZ.
gruez 12 hours ago [-]
>Every ISP has to pay Hurricane Electric for their tunnels, that's why it's free to you.
Is there a law mandating this?
inigyou 12 hours ago [-]
Yes, it's called contract law. If you don't pay HE, you don't get a connection to them.
I forgot one detail: your ISP could pay a different tier-1 ISP, as they all interconnect. Nonetheless, your ISP pays top rates for that traffic - tier-1 routes are usually last-resort routes.
Obviously if the ISP is buying transit from HE, they'd have to pay for it, but it'd be surprising if HE was strongarming their customers by adding a clause that's like "oh also, if any of your customers use our ipv6 tunnel, we'll charge you $x/user/month" or whatever.
mschulkind 9 hours ago [-]
It really depends on the peering contract. Most are not for transit, but rather just destinations, and generally the side that sends more pays, so that means more traffic to HE if tunnels are in use.
stingraycharles 15 hours ago [-]
And wouldn’t it add a considerable latency?
inigyou 15 hours ago [-]
Possibly. They let you pick your nearest server, and HE is a tier-1 ISP which a lot of your packets may traverse already.
toast0 13 hours ago [-]
It won't add much if you pick an appropriate tunnel server.
All my packets go through Seattle, using a Seattle tunnel server adds negligble latency.
But as someone else said, being connected with an he.net tunnel gets you marked as undesirable traffic these days, so that's annoying.
stingraycharles 13 hours ago [-]
Yeah ok if you already live near one of their locations, then it makes sense. But in my case it would have to go through an entirely different country, which would be fairly inconvenient.
sleepydog 13 hours ago [-]
HE has a lot of points of presence in North America and Europe: https://pop.he.net/ , so latency should be negligible there. Elsewhere, yes you might see higher latency.
mtucker502 16 hours ago [-]
They support it. I have it enabled with Spectrum. No file modification necessary; all configurable from the UI.
kuschku 16 hours ago [-]
Huh? Ubiquity has dropped support? I can't believe that, even the older EdgeRouter series supported it.
mkj 16 hours ago [-]
Old Nanostations as a client need to do proxy arp or something, which doesn't handle ipv6. That said it's probably 15 year old hardware. I ended up using a wireguard tunnel across it instead.
I would love to stop paying AWS for public ipv4 addresses.
But simply it is impossible to go full ipv6, as many of isps of the clients do not support it.
Currently there is no pressure to the isps to move to ipv6. In fact the incentives are OPPOSITE! They love charging for static IPs.
budoso 9 hours ago [-]
To be fair if Google stopped supporting it that’d be a pretty good incentive for the ISPs to get in line.
whatever1 6 hours ago [-]
That is a great idea actually. It would be awesome to be implemented like 2-3 years ago. Now I don't think it will work at global scale, since the world looks for any excuse to move away from American influence.
throw0101a 15 hours ago [-]
Specifically on weekends, which seems to indicate that it's the corporate/business network side of things that is not bothering with implementing it.
xacky 14 hours ago [-]
The real milestone is when it's over 50% all the time.
Scroll_Swe 15 hours ago [-]
You frame "not bothering" as if its a checkbox with "enable IPv6" to check and all done...
Put all work into reorg, for what? Some numbers to change? Why when IPv4 works?
calgoo 14 hours ago [-]
The corporate world tend to be easy to do, just put a gateway to IPv6 on their zScaler (or similar) exit points and done. However, that is not really needed as they are "only" consuming a few IPs around the world (for that purpose). No one in the corporate world wants to go back to the days of Public IPs on all devices. Internally the enterprises have no reason to switch as it just complicates their setups.
katbyte 12 hours ago [-]
I wouldn’t want a public ip for all the devices and computers on my home network either. Seems like a huge security risk.
throw0101a 12 hours ago [-]
> I wouldn’t want a public ip for all the devices and computers on my home network either. Seems like a huge security risk.
The real security risk is thinking that just because you have an internal RFC 1918 address space your security has improved.
It's been a decade+ since a firewall being considered a castle/moat of security being best practice. Any IT person that thinks that if they see a device with an 10/8 (or 172.16/12 or 192.168/16) IP and think you're safe you should be fired: it's lazy thinking.
At least if you had a GUA address it would force you to pay more attention to the rest of your security controls. Just recently a co-worker retired some systems that were accessible to the outside via DNAT—but forget to clean up the firewall rules. So he then—for some fucking stupid reason—decided to re-use those same IPs, even though we had so many fucking other IPs available, and one of the boxes got compromised because it happened to have a simple, guessable password on the initial image install.
katbyte 11 hours ago [-]
Home networks are usually, nearly always, not run by anyone who is capable of “paying attention to the rest of their security controls”
jpc0 10 hours ago [-]
Home networks are almost exclusively secure by default on any reasonable hardware.
The bigger issues is not remembering hostnames vs IP addresses.
Unless you have explicitly changed it what is the hostname of your mobile device? How about your PC?
The reality is with an even mildly competent DNS+DHCP implementation that is all you would need...
And mDNS otherwise but it seems only Apple ever bothered with that being default.
throw0101a 7 hours ago [-]
Home networks have the same security whether IPv4 or IPv6: CPEs with a default deny rule, and hopefully folks install patches regularly.
coldstartops 16 hours ago [-]
Google hits 50% IPv6, very good for accessing websites.
But my TP-Link router blocks by default inbound IPv6 connections, without any option to configure it, still bad for pure IPv6 bidirectional streaming, gaming or services on home networks.
Leonard_of_Q 15 hours ago [-]
Put OpenWRT on the thing and you'll be able to do what you want. Experience the joy of adding not port forwarding rules for IPv4 but more or less identical (same ports) access rules for IPv6.
newsoftheday 11 hours ago [-]
> But my TP-Link router blocks by default inbound IPv6 connections
I selfhost web and email over my Wireguard VPN using a free VPS (at OCI but I did it with AWS Lightsail too, though it wasn't free but cheap). This can work for you too or you can use easier to configure solutions like Tailscale. This way, your home isn't exposed directly to the Internet.
ddtaylor 12 hours ago [-]
Not that it really matters because almost all the consumer roiter manufacturers are pretty bad, but TP-Link is really, really bad. I would highly recommend not using any of their hardware.
p1mrx 10 hours ago [-]
TP-Link hardware is decent, if you buy one with OpenWrt support.
jmyeet 16 hours ago [-]
All these systems are a reflection of the time that they were designed. IPv6 is 30 years old. At that time a lot of threats just didn't exist. One of my favorite is the decision to default to /64 blocks. There was a time when the designers believed that you'd use your 48 bit MAC address as part of this. Now we know that's a PII nightmare and nobody does it. Yet we're still stuck with the 128 bit addresses that came from that.
To your point, IPv6 sought to replace NAT with just having enough addresses but interestingly, that created a problem. If you used NAT and had a service on your computer request a port for incoming connections, that showed intent on behalf of the owner of that service. IPv6 doesn't have that intent, which forces home router makers do block addresses by default because you don't want most PCs on the Internet such that an external agent can scan your PC. You may end up with an unintended service on the open Internet.
So is the bigger address range better? Technically, maybe? But you have to consider defaults and intents of users. And that can take a good technical solution to a bad solution or at least create a whole bunch of problems.
BadBadJellyBean 16 hours ago [-]
I don't think this is inherently a problem. It's good for home routers to have sensible defaults. Blocking incoming IPv6 connections is such a thing. Opening a port in the firewall shows the same kind of intent as forwarding a port with NAT. The burden is on the router manufacturers to expose these options in a sensible way. My router for example has a similar UI to forwarding a port with IPv4 and opening the port for IPv6.
Using NAT as a firewall might work but it brings it's own problems. I find the IPv6 way better.
lxgr 15 hours ago [-]
> I don't think this is inherently a problem. [...] My router for example has a similar UI to forwarding a port with IPv4 and opening the port for IPv6.
Glad to hear that you don't have a problem with your router, but how does that relate to GPs problems with theirs?
BadBadJellyBean 15 hours ago [-]
It isn't. But It's also not an answer to GP.
The solution for them is "get a better router" because the problem is not the IPv6 protocol. Opening a port is not harder than creating a NAT forwarding and if your hardware can't do it then it's bad.
lxgr 15 hours ago [-]
Exactly, and “there are a lot of bad v6 implementation CPEs out there” is an important data point worth acknowledging.
5 hours ago [-]
gucci-on-fleek 16 hours ago [-]
> There was a time when the designers believed that you'd use your 48 bit MAC address as part of this. Now we know that's a PII nightmare and nobody does it.
Nobody includes their MAC address in their public IPv6 addresses anymore, but every IPv6 setup that I've seen still gives every device a unique globally-routable IPv6 address, with no NAT at all.
> One of my favorite is the decision to default to /64 blocks.
The nice thing is that a /64 is big enough that clients can just randomly pick any address, and it will almost certainly be available, meaning that you don't need DHCP. This is actually widely implemented, and is known as SLAAC [0].
> Yet we're still stuck with the 128 bit addresses that came from that.
The extra address space only adds 16 bytes to every packet, and it ensures that we will never run out of addresses like we did with IPv4.
With current addressing scheme we only have 2^13 times more site addresses than IPv4, which is plenty in absolute numbers, but not necessarily enough for more coarse aggregation, and definitely not infinitely future proof.
Crucially though, if we change it, we just have to change how addresses are allocated, not change the protocol again.
gucci-on-fleek 13 hours ago [-]
> Crucially though, if we change it, we just have to change how addresses are allocated, not change the protocol again.
Yup, and only less than an eighth of the total IPv6 address space has been allocated [0] [1], so there's still plenty of room to expand, even if we have to throw every current address out and start from scratch.
> but every IPv6 setup that I've seen still gives every device a unique globally-routable IPv6 address, with no NAT at all.
Mine all have link-local addresses (I do have a real static IPv6 address block from my ISP, at great expense…) - so I’m not sure what I did wrong in my Ubiquiti gear.
gucci-on-fleek 13 hours ago [-]
A link-local address is required with IPv6, so your devices probably just have that in addition to a globally-routable IPv6 address. This isn't a problem though, since devices have no problem having lots of different addresses on the same interface [0].
> Now we know that's a PII nightmare and nobody does it. Yet we're still stuck with the 128 bit addresses that came from that.
Randomizing the local address doesn't mean it isn't useful. You can't scan a /64 so that's already a major improvement. The fact that randomly selecting a number is effectively never going to collide greatly simplifies automatic network configuration.
The major issue is that the /64 isn't mandatory from a technical perspective. Being merely a subset of the larger address it's nothing more than a convention. In the end not all providers make it available to you even though supposedly they ought to.
If we're going to complain about anything it should be the godawful notation that so easily breaks parsers. Or the fact that the width is massively excessive which creates a usability nightmare due to normal humans not being able to readily recall 128 bit numbers (let alone how long it takes to type them in).
lxgr 15 hours ago [-]
The point of local networks of a minimum size of 64 bit isn't only to have MAC-based addresses (48 bit would have been enough for that, fwiw), but in general to support non-coordinated/probabilistic self-assignment schemes with negligible collision probability.
Picking a random local address (which is very important for privacy, as you've mentioned) is much easier if you don't have to do an elaborate dance of listen, announce, listen for collisions etc. first (practically that still happens, but collisions are the absolute exception).
> So is the bigger address range better?
Yes, because consider the alternative of re-doing all of this again in a future in which IP usage for some reason jumps by a few orders of magnitude again.
Due to hardware getting better over time, the per-packet cost of a few extra bits is going down all the time, while the cost of rolling out a future IPv7 increases with every new deployed host.
inigyou 15 hours ago [-]
The best thing about SLAAC is that it forces your ISP to give you at least 64 bits. Otherwise you know Comcast would only give out a /128 and charge you for more, so you'd use NAT at home just like IPv4.
jlokier 12 hours ago [-]
Unfortunately SLAAC doesn't force upstream to provide a /64 universally.
Some ISPs are reportedly giving out a /128, and SLAAC works adequately with a router performing IPv6 NAT, so those ISPs don't see a problem.
Mobile phone as WiFi access point is another common way people access the net nowadays. I've occasionally seen permanent installations, with a phone taped to a window. I've never seen a mobile phone AP offer IPv6 to clients, but if they do they have to use SLAAC-compatible IPv6 NAT in that situation.
lxgr 4 hours ago [-]
> Some ISPs are reportedly giving out a /128, and SLAAC works adequately with a router performing IPv6 NAT, so those ISPs don't see a problem.
Wow, that’s diabolical. Presumably these routers are some custom CPEs then? I don’t even know whether regular home routers support NAT66.
> I've never seen a mobile phone AP offer IPv6 to clients
I’ve only even seen it work without NAT when there was any v6! Usually the phone gets a /64, and there is a bit of trickery involved to make that shareable to other devices (NDP rewriting), but it works pretty well.
boredatoms 6 hours ago [-]
Thats why android supports dhcpv6-pd for a /64, but not assigning a /128 from dhcpv6
inigyou 11 hours ago [-]
Well, my phone as access point grants an IPv6 public IP without NAT. There's a stateful firewall somewhere in the chain though.
throw0101a 14 hours ago [-]
> IPv6 doesn't have that intent, which forces home router makers do block addresses by default because you don't want most PCs on the Internet such that an external agent can scan your PC. You may end up with an unintended service on the open Internet.
Every residential router already has PCP (RFC 6887) and UPnP IGD to deal with the NAT44 non-sense that is the status quo, and both protocols support IPv6 hole punching, so IPv6 default deny as a policy is hardly an issue in the residential space.
MiniUPnPd, which many Linux-based CPEs use, has supported IGDv2 (needed for IPv6) since 2012 (as well as PCP).
CrLf 15 hours ago [-]
Cloudflare sees over 40%, and it hasn't gone up in the last year even with the overall traffic increase. Personally, as the APNIC article also says about their own observations, I guess the overall adoption is somewhere in between.
But we have to remember that this reflects the adoption on the client side. With many high profile services still IPv4-only, the fraction of IPv6 flowing on the public Internet might be much lower.
I wonder what incentives are needed to push this forward, because it's not the same incentives as years ago for sure. We've long since exhausted new IPv4 allocations.
kalleboo 13 hours ago [-]
If we're looking at the portion of traffic, most of the big bandwidth heavy services (the video streaming sites and CDNs) are on IPv6, the long tail of IPv4-only services tend to be lower bandwidth stuff.
Fabricio20 9 hours ago [-]
I believe one big anti-incentive is rate limiting, especially nowadays. With IPv4 getting a range ban is somewhat effective, way less effective on ipv6 (theres a reason HE tunnelbroker is marked bad nowadays, discord bots doing music load balance over ips on tunnelbroker for pulling youtube audio data.. they ban a /64 but you balance over a /48 or bigger). I believe this was the main reason Discord disabled IPv6 (not sure if thats still the case, but it was back in the day since bans and api rate limiting was ip based).
Dagger2 4 hours ago [-]
Why is it less effective on v6? You just ban the /48 or bigger.
mmwelt 16 hours ago [-]
Interesting to see the per-country rates[1]. France is up to 85%, apparently!
Reason that Google isn't seeing more is a) some BigCo v4 holdouts b) happy eyeballs sometimes landing on v4 because their v6 is shitty 6rd or something (e.g Free SAS)
vbernat 13 hours ago [-]
6rd will soon get away to get native IPv6 instead. Also, 6rd is what allowed France to lead IPv6 deployment.
BrandoElFollito 15 hours ago [-]
You mean that Free's ipv6 is not implemented correctly?
well_ackshually 13 hours ago [-]
Free has ipv6 enabled on 100% of their customers, and while sometimes their software has a few issues, it's working perfectly fine. People just get pissy because Free refuses to pay for peering with Google for e.g. Youtube, and it feels slower, even more on v6.
The only ISP not putting out v6 widely is SFR, and thankfully they've gone bankrupt and we will be rid of this scourge.
BrandoElFollito 11 hours ago [-]
I am on Free (after a few years with Orange because Free could not bother to provide fiber here) but I am considering switching to Bouygues because I pay too much for the connection.
The connection is solid, though - thus my lack of enthusiasm.
inigyou 12 hours ago [-]
[dead]
CorrectHorseBat 15 hours ago [-]
Here in Belgium it's the other way around. we've had IPv6 for over 10 years for basically all home internet, but mobile is still ipv4 only. Not sure why since it's all the same companies.
Scroll_Swe 14 hours ago [-]
Mobile and fixed broadband is a separate infra/boxes (virtual).
LTE arch with the PGW handles IP allocation to devices
I'd however mention, the two biggest ISPs that remain today both have adopted IPv6 on their fiber connections. They're also heavily using CGNAT for IPv4. It makes sense, the volume at which they're working makes dedicated IPv4 very uneconomical.
wongogue 14 hours ago [-]
Even smaller ISP have done that. But I switched to JioFiber last year and it loses its IPv6 network every week for a few hours. Diagnostics tell me that everything is okay and the customer support just doesn’t understand the problem.
jeroenhd 15 hours ago [-]
My home internet has IPv6 but my mobile carrier doesn't. IPv6 on mobile carriers is unfortunately still not universal.
stcg 15 hours ago [-]
Anyone know why there is a high frequency signal on top of the long term trend in that graph?
People connect through cellphones more on weekends, and cellular has higher IPv6 usage.
AndrewDucker 13 hours ago [-]
People connect from home more at the weekends and home ISPs support ipv6 more than offices do.
whatever1 10 hours ago [-]
The great news is that India is at 75%, otherwise the price pressure for ipv4 addresses would be insane
BadBadJellyBean 17 hours ago [-]
I wonder if there will ever come a day when IPv6 will provide a better web experience than IPv4.
At the moment pretty much every website is reachable via IPv4 but a lot not via IPv6. Will there be a day when this turns around?
mritzmann 17 hours ago [-]
> a better web experience than IPv4
That's already the case. IPv6 is often faster because most ISPs these days use cgnat for IPv4.
jck86 16 hours ago [-]
In my experience not true in practice cause I have experienced way more issues with the IPv6 endpoints of sites than their IPv4 counterparts.
This becomes noticeable when pipelines on IPv6 connected servers suddenly have random request/post failures to public services. Then either the whole service is temporarily having issues or there are a few bad IPv6 endpoints while all the IPv4 endpoints are fine.
Seemingly this failure mode can go unnoticed for days while the same won't be true for IPv4 due IPv4-only still being the norm for corporate networks. And no, current form of happy eyeballs v2 won't account for this.
Besides bad endpoints it could also be a problem with bgp route advertisements where the IPv6 prefix takes a weird path and ends up being blocked by a CDN at the other side of the ocean.
This happens more than you'd think. Obtaining pypi packages was quite a challenge last year for us for a couple of weeks due to this.
Not really a fault of IPv6 technology wise, and in general can be solved client side through retry functionality, but in practice it still can lead to a worse outcome due to lackluster IPv6 adoption.
I used to think ISPs, organisations, admins and users were just being lazy for not implementing IPv6 or turning it off as the first thing to do when network problems happen, but when this far in the rollout such basic things still lead to difficult troubleshooting sessions then perhaps time has come to say something has gone terribly wrong.
It saddens me to say that I totally understand that businesses do not want to pay the price for implementing IPv6 unless absolutely necessary, because until the majority of traffic is IPv6 or even IPv6-only it does not make a lot of sense.
The flipping point is nearer than ever, though I fear it will in the short term lead to even worse stability for both protocols until IPv6 truly becomes the norm, whenever that may be.
throw0101a 14 hours ago [-]
> In my experience not true in practice cause I have experienced way more issues with the IPv6 endpoints of sites than their IPv4 counterparts.
If you've ever visited a website from your smartphone (over 4G/5G), your first hop has in all likelihood been over IPv6. If you have visited a website from your phone that only had an A record then you probably went through a CG-NAT box, which added latency.
If you streamed a Youtube video to your phone, or checked Gmail, or Instagram or Facebook, then it was over IPv6.
People (including probably you) use IPv6 everyday, multiple times, without knowing it.
zinekeller 12 hours ago [-]
Without disputing the added latency of CGNAT, the v6-only peering fights (not just the infamous Cogent-HE dispute but smaller regional ISPs peering only on v4) means that there are indeed cases where v6 is worse than v4 in practice. Again, nothing inherently wrong with v6 itself, but peering disputes means bad latency on v6, which means that protocols relying on TCP (like plain FTP, SFTP and rsync) really takes a hit in transfer speeds.
Also there are cases where the ISP didn't bother even optimizing their routing in v6. I understand that some ISPs in Asia (and especially in Japan, where it shows up on ordinary customers in terms like MAP-E and VNEs) have separate backplanes for v4 and v6 (some are legacy reasons, some are business reasons). Guess which one is being devoted more in practice (hint: not the one being devoted more by IETF).
> This becomes noticeable when pipelines on IPv6 connected servers suddenly have random request/post failures to public services. Then either the whole service is temporarily having issues or there are a few bad IPv6 endpoints while all the IPv4 endpoints are fine.
Do you have examples for this? I've never experienced this, and I've been using IPv6 for years.
Also, how can you be sure that the same request to IPv4 would have been fine? Did you actually see consistent failures on v6 and consistent success on v4? Otherwise, if a service has a reasonably low error rate, success on retry is the expected outcome, regardless of the path the retry takes.
jck86 14 hours ago [-]
There were indeed consistent failures to specific IPv6 endpoints, clearly identifiable through curl, while all the IPv4 endpoints were ok.
This happened with pypi (IPv6 BGP routing problem caused by a bad route from one of our peers combined with their fastly CDN not reply to us on IPv6 from the other side of the ocean for some weird reason), but also with yum and apt mirrors (seemingly random problems with the IPv6 service or firewall of the remote endpoint), and various other web resources accessed from pipelines.
The solution always was to temporarily block the bad IPv6 endpoint(s) or temporarily completely disabling IPv6 on the server itself or on the squid proxy server for workloads without direct connectivity.
Obviously it also can be the other way around, but in practice it appears to happen less often with IPv4, and if it does things get addressed quickly instead of taking hours or days or weeks.
toast0 13 hours ago [-]
Open source download mirrors often have much better targetting for v4 than v6. Just a few days ago, I was downloading installer images to check an issue and adding -4 to the command line reduced the download time significantly.
liveoneggs 13 hours ago [-]
I saw HE stop routing to europe over ipv6 for an extended period of time two-ish years ago.
BadBadJellyBean 15 hours ago [-]
I have been on a dual stack IPv4 and IPv6 connection for a while now. IPv6 is the preferred protocol. I think I'd have noticed if there were widespread IPv6 issues. It used to be worse, but that was years ago.
BadBadJellyBean 16 hours ago [-]
True but not deploying any IPv4 connectivity would be a worse experience than not deploying IPv6.
VorpalWay 15 hours ago [-]
I have yet to see any ISP use CGNAT here in Sweden. It seems to be a highly regional problem for some reason. Both on mobile and on broadband I get publicly routable IPv4.
inigyou 15 hours ago [-]
That's because Sweden joined the internet relatively early when enough addresses were available. It's like that in most 1st-world countries. Places like Argentina, on the other hand, may have to share 8 IPv4 addresses per city.
VorpalWay 14 hours ago [-]
That makes sense. However, I also don't get IPv6 on either my broadband or my mobile. So we seem to be far behind there.
fundatus 12 hours ago [-]
Wow a publicly routable IPv4 address on a mobile phone? Wouldn't that drain the battery a lot? Or is there some kind of carrier-level firewall still?
Hikikomori 10 hours ago [-]
Telia does it for mobile, I think Tele2 and 3 as well? Bahnhof, Bredband2 and other small ones also use it for wired customers, but you can usually get a public if you ask for it.
CrLf 13 hours ago [-]
When CGNAT is present, my guess is that's the case. It would be nice to see a study on that; don't know if there is one already.
Users doing speed tests in CGNAT may be seeing numbers that aren't exactly real for a (still) mostly IPv4 Internet.
mort96 16 hours ago [-]
That fraction of a millisecond doesn't meaningfully translate into a better experience for users.
kalleboo 16 hours ago [-]
You're assuming the ISP has dimensioned their CGNAT properly and it's not congested.
Hendrikto 16 hours ago [-]
Milliseconds matter for gaming, for example.
commandersaki 14 hours ago [-]
We are still talking a fraction of a millisecond, a few hundred microseconds at most. People are blowing out of proportion latency saved with v6, it's negligible at best, or at worst let's not forget IPv6 is two separate island because two tier-1 carriers refuse to peer (Cogent & HE).
hdgvhicv 15 hours ago [-]
Vast majority of people gaming are doing it via wifi
hdgvhicv 15 hours ago [-]
That depends on your isp. Mine certainly doesn’t, and I’ve never had an isp on the U.K. which didn’t give me at least a dynamic ipv4 address to my router.
Infact the only isp I have seen do it is starlink and I have contacts with ISPs in 60 different counties.
inigyou 15 hours ago [-]
Note that most ISPs are cellphone networks and most end devices are cellphones.
commandersaki 14 hours ago [-]
Sparing a few hundred microseconds of latency is tangibly a better experience?
vbernat 13 hours ago [-]
It already does. With IPv6, you don't go through some CGNAT box, that could misbehave or just break (and since the biggest chunk of content is available through IPv6, this may not be a priority). Also, a shared IPv4 can be banned by various sites if one of the owner misbehaves. This issue is not present with IPv6.
Faster webrtc establishments and other negotiated connections. CGNAT means more relayed than P2P connections so it should be possible to have more direct traffic for services that want to save that bandwidth.
AndyMcConachie 17 hours ago [-]
I would expect online video games to be a more important driver.
inigyou 15 hours ago [-]
and anything P2P. Maybe that would have been a driver 20 years ago, but now everything is expected to be centralised. Our culture has shifted. Remember when people used to host their game servers? If you're under 16, you don't because it was never in your lifetime.
hdgvhicv 15 hours ago [-]
I have to open a hole in my firewall to host any service. Nat doesn’t change that.
Unless you want to host multiple minecraft servers on the same port on different servers at home?
Indeed hosting anything at home is such a rare workflow that someone wanting it can choose an isp which gives them the facilities they need.
Unless you don’t live in a competitive market based economy and just have the single government mandated isp aimed at the lowest common denominator, in which case you’ve got far worse problems.
TeMPOraL 14 hours ago [-]
Or unless you do live in a competitive market based economy, and have a choice of several ISPs with practically equivalent offering aimed at the lowest common denominator, none of whom supports something niche like "giving you facilities for hosting stuff at home".
If there's one thing market competition does well, is remove any kind of meaningful variety - because supporting a niche offering costs money, and is not worth it unless it nets positive, otherwise it's just a drag that makes you fall behind your competition.
inigyou 15 hours ago [-]
The average person finds port forwarding much more confusing than "allow Minecraft y/n"
sznio 14 hours ago [-]
it's more like that the IPv6 switchover was so fumbled that we went from fast P2P like with Skype, to shitty, centralized and data-mined Discord.
The internet would be much less centralized if IPv6 happened when it was supposed to.
Jerry2 11 hours ago [-]
FTA:
>Individual economies such as India, Viet Nam, and Saudi Arabia exhibit adoption curves that differ markedly from the global average. As the APNIC Labs data shows, this global trend does not necessarily reflect the experience of individual economies.
>APNIC’s own measurement records a 42% worldwide IPv6 capability (Figure 2). That’s a substantial difference, which also needs clarifying."
The nuance is that IPv6 is growing faster in developing countries with poorer economies. I'm guessing this is because building modern IPv6 network from scratch is cheaper & more efficient than acquiring scarce and expensive IPv4 addresses. This is a major advantage for newer providers in growing economies.
So while the Google is showing it at 50%, APNIC's weighted global measurement shows it at 42%.
adithyassekhar 13 hours ago [-]
Whenever I turn on ipv6 on my router (isp supports it, dual stack) randomly I get half the download speeds, YouTube video freezes, and eventually a captcha screen on google. The moment I disable v6 even only at the client side I get to max out my bandwidth. Tested on google drive, sites on azure and aws and netflix’s fast.com which show’s your ip just to confirm I was connecting over v6.
I've never seen this chart before, was taking a peek from the link in the article. Does anyone with networking knowledge know why IPv6 usage peaks on Saturdays and dips during the middle of the week? (something related to mobile ISPs?)
jdw64 16 hours ago [-]
I made my homepage (www.makonea.com) support IPv6 too, but the number of people actually using it is much smaller than I expected. Is IPv6 really that widely used? I'm supporting both because I heard it's good to support both, but I'm not sure what the actual benefit is. Sometimes, when behind Cloudflare, I think even if someone connects via IPv6, it ends up coming through as IPv4
BadBadJellyBean 16 hours ago [-]
It's good to support it to resolve the chicken egg problem. If no service supports it, there is no sense in deploying it to the customers and the other way around.
Also you made the life better of people who have DS lite. They only get a public IPv6 and all their IPv4 traffic goes through a CGNAT.
reddalo 16 hours ago [-]
For people like me: DS Lite stands for "IPv6 dual-stack lite". My mind went directly to Nintendo and I was confused.
ash 16 hours ago [-]
Unfortunately, individual actions would never be enough to solve the IPv6 chicken and egg problem. See djb's "IPv6 mess" article:
Yes, it is old, many examples are outdated, but the main points still hold. Decades later his suggestions for making IPv6 succeed are still not implemented.
tormeh 15 hours ago [-]
This stuff is obvious now, but I think back then this was probably quite clever.
BadBadJellyBean 16 hours ago [-]
It's not a lot but it's better to be part of the solution than the problem even if it is an insignificant contribution.
commandersaki 13 hours ago [-]
Which is which?
fc417fc802 16 hours ago [-]
For client server web browsing what's the downside of CGNAT? I'd understand if we were talking about self hosting a service from home but for typical consumer usage?
gucci-on-fleek 16 hours ago [-]
1. Peer-to-peer networking won't usually work correctly. And quite a bit of software uses P2P networking these days---BitTorrent, Zoom/Teams (via WebRTC), Tailscale, PlayStation/Xbox multiplayer, etc. Most of these services have automatic fallbacks when P2P networking doesn't work, but these fallbacks are usually slower and less reliable.
2. Most websites assume that 1 IPv4 address==1 household, so you'll often run into rate limits. Or even worse, you might be blocked entirely if your CGNAT neighbours are spammers or otherwise breaking website rules.
fc417fc802 15 hours ago [-]
While true, neither of those are relevant in context (and I even explicitly acknowledged your first bullet in my comment above). It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that. I do of course appreciate that going via CGNAT to a clueless operator that eagerly adds IPv4 bans can be problematic but that's more a question of why you as a consumer might want IPv6 connectivity not why a service provider would want to deploy it.
gucci-on-fleek 15 hours ago [-]
> While true, neither of those are relevant in context (and I even explicitly acknowledged your first bullet in my comment above).
Yeah, I just mentioned that because P2P networking is used a lot more than most people think these days, since even things like Zoom that look like typical client–server web browsing actually use P2P networking internally.
> It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that.
Reliability and latency will be marginally better with IPv6 than with CGNAT, but this is so minor that I doubt that most people will notice this. And many CGNATs will RST connections that last too long, but most protocols have some sort of automatic retry/reconnect built in, so this shouldn't cause issues very often either.
IPv6 addresses are quite a bit cheaper than IPv4 addresses in most clouds, but since most servers still need to support IPv4, this doesn't help you directly. Supporting IPv6 means that others using the cheaper IPv6-only cloud services will be able to connect to your server, but this doesn't matter for consumer-only services.
So yeah, you're probably right that enabling IPv6 server-side won't have (m)any benefits.
> I do of course appreciate that going via CGNAT to a clueless operator that eagerly adds IPv4 bans can be problematic but that's more a question of why you as a consumer might want IPv6 connectivity not why a service provider would want to deploy it.
Being able to ban IP addresses without worrying about collateral damage is a pretty big benefit to the service provider though, for certain applications at least.
inigyou 12 hours ago [-]
If you're using a cloud you'll probably find it useful to have ipv6 on every server and ipv4 only on the front end gateway
throw0101a 12 hours ago [-]
> It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that.
Non-legacy, newly formed ISPs have to spend a lot of money on either buying or leasing IPv4 address space, and even then if they grow they probably won't be able to keep up, and so have to deploy 100.64.0.0/10 to the WAN interface of CPEs and then buy a bunch of CG-NAT hardware.
The problems are on not entirely visible at the end-user side of things because of the Herculean efforts by ISPs.
IPv4-only services are thus externalizing the costs of connectivity to ISPs (especially newly formed ones).
fc417fc802 12 hours ago [-]
> externalizing the costs of connectivity to ISPs
Isn't that literally their raison d'être? Point taken that in aggregate it increases the costs of network operators but still that's got nothing to do with an individual instance of an individual user visiting an individual website.
hdgvhicv 15 hours ago [-]
1) my stateful firewall is going to break most of that anyway
2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
inigyou 12 hours ago [-]
P2P protocols don't have much problem opening up a stateful firewall connection as you just have to send one packet out to open a known address and port.
I prefer to run scrapers behind CGNAT because websites can't ban it without causing collateral damage, which matters more to some than to others. The website probably has to put up a captcha. Which hurts its human traffic. Think about how much more traffic you could have if you didn't show everyone a captcha, and you might see that you should also be in favour of IPv6.
throw0101a 12 hours ago [-]
> 1) my stateful firewall is going to break most of that anyway
Your CPE is probably running UPnP IGD and/or PCP for hole punching of P2P services, and IGD/PCP can hole punch just as easily for IPv6.
> 2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
It's not whether CG-NAT is an edge case or not, it's whether there are things that are completely impossible with it or not. Want to play with your friends on your Xbox/PS? Too bad, CG-NAT makes it completely impossible.
Why should we be happy with a technology that makes certain use cases impossible? On what planet is that a good thing?
gucci-on-fleek 14 hours ago [-]
> 1) my stateful firewall is going to break most of that anyway
Stateful firewalls and even regular NAT aren't much of an issue for P2P, but CGNAT is much more problematic [0].
> 2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
You'd hope, but people tend to be pretty slow to update their networking assumptions, so this is still pretty common. And it doesn't help that most CGNAT users tend to be either from poorer, since poorer countries and mobile data providers are far more likely to use CGNAT than legacy North American ISPs.
> people tend to be pretty slow to update their networking assumptions, so this is still pretty common.
My ISP doesn't do CGNAT in FTTH deployments, but I'm paying extra for a static IPv4 allocation anyway since I was increasingly getting hit with captchas every time my IPv4 rotated to flagged IPs that were trashed by my fellow subscribers with poor infosec practices - i.e. 99.9% of residential subscribers.
Once I got a static allocation, captchas are getting easy to pass.
Hendrikto 16 hours ago [-]
> Is IPv6 really that widely used?
Mobile carriers use it almost exclusively, which is already a huge chunk of the internet, and newer ISPs are switching to it too.
> I'm supporting both because I heard it's good to support both, but I'm not sure what the actual benefit is.
The benefit is that you allow IPv4-only and IPv6-only clients to connect.
tormeh 15 hours ago [-]
I accidentally became the user of an IPv6-only device a while back for some obscure reason I never could figure out. Let me tell you: There are no IPv6-only users. Absolutely nothing except Google, Facebook, and YouTube works. Any website not in the top 20 are IPv4-only. It was so bad I briefly thought I didn't have an internet connection at all. Anyone stuck on an IPv6-only connection would immediately cancel their contract on the grounds that they don't have de-facto internet access.
inigyou 15 hours ago [-]
So, like, the three most popular things still worked. I wonder if working more is related to their popularity.
tormeh 12 hours ago [-]
I think it's more that Google and Meta have the surplus engineering resources to implement IPv6 for what is essentially no reason.
inigyou 12 hours ago [-]
Probably for lower latency and higher reliability on mobile networks.
hdgvhicv 15 hours ago [-]
You can do IPv6 only if you have a 64 nat on your edge and use dns64 and just use a limited set of applications and devices.
Some applications will still fail to work though unless you also have 46 nat on your device which still doesn’t work transparently on majority of types of device.
You also need all devices on your lan to support v6 natively, and v6 only. From your printer to your speaker.
You might be able to do something with mdns and nat64 to get them working on an IPv4 only subnet. But you’re talking layers and layers of complexity for things which just have to work.
I’m posting this from my phone on my IPv6 only subnet, not sure if it’s using a 64 gateway or 6 native to HN, but it’s possible.
Hendrikto 15 hours ago [-]
All the more reason to support it. There are lots of ISPs that only assign you an IPv6, and do hacky trickery to make IPv4 work over that. We wouldn’t need all of this.
jon-wood 16 hours ago [-]
When hosting a server IPv6 doesn't make a huge difference beyond your logs will probably be a bit more accurate, people behind CGNAT where an ISP has multiple customers sharing a block of IPv4 will show up with their actual IPv6 address. They'll maybe also find it slightly quicker because they're not being funnelled through NAT gateways but realistically not enough to notice.
From the user side IPv6 is great for me. My ISP is using CGNAT and would bill me ten pounds a month for a static IPv4 address but I automatically get a vast block of IPv6. I'm using that block to allow me to VPN back home when out and about, and if I wanted to I could also host services from devices on my home network without needing any NAT nonsense, I can just open access to the relevant device on the router. (Because this is a world where not everywhere supports IPv6 yet if I'm on an IPv4 only network the VPN endpoint is a dedicated server I rent which forwards the relevant port back to my home router over IPv6)
hdgvhicv 14 hours ago [-]
So your isp is rinsing you for the cost of a an IPv4 address. £10 a month will pay for a whole /24 in 3 years.
Chances are they also skimping on other areas including over subscription. Choose a better isp if you want a better service.
Your “just open traffic to internal host 1 on your firewall is the same no matter if it has nat or not, unless you are using a non stateful firewall? Or perhaps your configuration layer splits the two for reasons.
jdw64 15 hours ago [-]
Thank you for the advice. By any chance, have you worked with Ruby before? I remember seeing your username back when Ruby was popular and I first started learning it in university
nottorp 9 hours ago [-]
I recently enabled ipv6 on an unadvertised server i use just with people i know... it's on my home connection actually.
The great news is those vulnerability scans from random IPs are coming just on ipv4, there hasn't been any yet on ipv6 :)
inigyou 12 hours ago [-]
A lot of internet spambots and vulnerability scanners are v4 only. I discovered this when I found an open mail relay on v6, contacted the owner and he said it's been like that for ages due to a config mistake and he'd never heard a complaint. It wasn't an open relay on v4.
newsoftheday 11 hours ago [-]
My selfhosted email has been dual stack for close to a year and my eyeball estimate of the logs is around 10% of the traffic is IPv6.
The real question is -- how much of them are bot traffic?
We knew bot traffic is more than half of the internet, right?
radiator 12 hours ago [-]
All the projects I have ever worked on, the internal networks always were IPv4. Maybe because it is much simpler for humans to have an overview of the internal subnets in that way. Maybe IPv6 uses numbers that are too large for us.
kccqzy 9 hours ago [-]
The IPv6 addresses on my internal network look like fd7a::1, fd7a::2, etc. They are shorter than v4 addresses.
tgma 9 hours ago [-]
Is this a failure? Absolutely. The article tries to brush this off, but there is no denying it. Operating without an IPv4 stack is not going to happen with v6.
Cider9986 17 hours ago [-]
How does IPV6 affect ip blocking. As a VPN user I wish it wasn't used as a metric for sites shaking you down.
lxgr 15 hours ago [-]
It's just as easy or hard to map out a VPN's egress subnets on v6 than it is on v4.
BadBadJellyBean 16 hours ago [-]
I assume for aggressive blocking the only prefix size will change. What is a /32 for IPv4 might become a /64 or smaller for IPv6.
hdgvhicv 14 hours ago [-]
Larger. A /56 and get multiple hits from nearby /56s and you block the /48.
mahboi 10 hours ago [-]
Shouldn't blocking v6 also be based on /32 if you want the attacker's cost to be the same?
BadBadJellyBean 7 hours ago [-]
Well in the IPv4 world /32 would be a single IP or what a residential connection usually gets. With IPv6 you have 128 bits for the whole IP and usually a residential connection get get between a /64 to /48 prefix. Going above a /64 might hit other unrelated customers. Going to a /128 prefix would only block a single IP but since we started doing privacy extensions your computer will have multiple IPv6 addresses with a short lifetime which means that the user will be able to connect again soon after you block them. There are 18,446,744,073,709,551,616 IPs in a single /64 prefix so it would be useless to block every single one of them.
A more reasonable approach might be to block a /64 first, monitor if you get more blocks within the /56 block that contains the /64 and maybe block that.
birb07 8 hours ago [-]
Globally, it’s 50%, but local French (>85%) businesses could already go IPv6-only and force others to adopt it
jessinra98 14 hours ago [-]
> Is IPv6 really that widely used?
Mobile carriers use it almost exclusively, which is already a huge chunk of the internet, and newer ISPs are switching to it too.
decorner 8 hours ago [-]
When your router ships with IPv6 default on, this makes sense
bilsbie 13 hours ago [-]
It’s weird we’re all still behind NATs. IPv6 was supposed to be trillions of devices all having their own ip.
inigyou 12 hours ago [-]
On IPv6 we're not. Are you saying it's weird we still use IPv4 in addition?
bilsbie 4 hours ago [-]
So when I go to hn.com I’m on v4?
17 hours ago [-]
commandersaki 14 hours ago [-]
Still not fit for purpose.
hugodan 13 hours ago [-]
In Portugal one of the biggest ISPs (NOS) still does not have IPv6
CrLf 13 hours ago [-]
That's not exactly true, they've been increasing in the last few months and are close to 30% now. Let's hope they don't revert it like one year ago.
This graph even shows them doing step deployments:
Literally all we had to do was add a byte to IPv4 and we'd be done but noooo we need to overengineer the next protocol and make it as painful as possible to adopt.
inigyou 12 hours ago [-]
Why one byte? Is that enough bytes? An extra 4 bits each for source and destination? Maxing out at 2^36 addresses? That seems uncomfortably small safety margin.
sherburt3 12 hours ago [-]
I was saying adding a byte to the address so its a 40 bit address which would be two bytes to the header. Obviously it would still have the same issue where hardware and software would be incompatible and would need to be replaced but the same concepts that worked in IPv4 would work in my fake protocol instead of IPv6 where the network needs to be redesigned from the ground up.
Also IPv6 addresses are ugly
inigyou 12 hours ago [-]
How sure are you that 40 bits is a good number of bits? What's your justification? It takes over 30 years to deploy new bits, so you have to be really sure before you start that effort.
sherburt3 11 hours ago [-]
40 bits would've bought us a lot of time and would've kicked the can down the road several decades. People from the future would be much better equipped to design a new protocol because they understand their needs better.
inigyou 5 hours ago [-]
How many decades? If several means six, we're already halfway there and at 50% deployment. What's the point of designing something you know will be obsolete the moment it hits 100% deployment?
ralfd 11 hours ago [-]
> It takes over 30 years
Only because it is overengineered. Parents pragmatic protocol would have been adopted faster
inigyou 5 hours ago [-]
IPv6 is just IPv4 with more address bits.
bluGill 8 hours ago [-]
That would be just as hard to switch to and even more complex. If you think ipv6 is over engineered you haven't had to deal with ipv4. (Source routing is a pain)
convolvatron 12 hours ago [-]
this keeps coming up, if you add a byte to ipv4 you still have a transition problem. 5 byte machines can't talk to 4 byte machines. pretty much the only thing that solves is people not liking the :: syntax. the only other change is auto configuration, which...kind of doesn't matter? is that really causing problems?
sherburt3 8 hours ago [-]
I think the addresses are a big issue. The address space is just stupid big, I don't understand why we need to prepare for every grain of sand on Earth having a WiFi chip in it.
Most people can pick up calculating subnets in their head in ipv4 pretty quickly and ipv4 addresses are easy to memorize on accident. My brain turns to mush as soon as I start seeing hexadecimal characters in addresses.
mahboi 10 hours ago [-]
Yeah but they could've picked something that at least lets the 4 byte host talk to a 5 byte one. Like if I have 8.8.8.8 and they want to give me 8.8.8.8.0, cool. Or make it 8 bytes instead of 5, same thing.
convolvatron 9 hours ago [-]
well, if you want to add an extra byte you kinda have a problem, since v4 is fixed format and is actually cooked into hardware in a lot of places. so if you want to keep v4 mostly untouched you have to use an option, which is going to be pretty slow on the backbone.
you can send a packet from an extended address host to a vanilla v4 host if you map the address space into a range like you suggest..but that v4 host just has no way of sending a message back..so its kinda useless
mahboi 9 hours ago [-]
It'd be useless until everyone switches to the 5-byte thing and people can start putting something besides 0 into that last byte. But at least they could turn on v5 or whatever it's called without having to think about it. Right now I could have two hosts that both agree to use ipv6 and it's still hard because you have to reconfigure everything.
TacticalCoder 8 hours ago [-]
> ... but noooo we need to overengineer ...
We need to pretend we overengineer. But some in the committee made it sure data exfil would be basically impossible to detect / block with IPv6, which all the others, always in love with the most rube-goldberg design possibles, loved the "overengineered" solution.
With rube-goldberg designs, you can then always say stuff like:
"The xz backdoor was TOTALLY unrelated to systemd"
Yet it only concerned distro that shipped with systemd.
Ah yes, it's because of that. So it's so totally unrelated right?
Except it still only affect distro using systemd.
Or maybe, you know, backdoors and exfils were the plan from the very start.
"The protocol won't work correctly unless you let crazy ping packets doing you-know-what". And nobody is ever going to properly firewall all that.
Overengineering is one thing, yes.
But we know for a fact that there are xxxINTs infiltrating committees and pushing "solutions" that are only solutions to them.
agnishom 11 hours ago [-]
Finally some good news in 2026
charcircuit 15 hours ago [-]
In America I've never had a non-mobile ISP offer IPv6. At this point it would be best to recognize the sunk cost and give up on the migration. IPv6 will never reach the 100% needed to turn off IPv4.
throw0101a 14 hours ago [-]
> IPv6 will never reach the 100% needed to turn off IPv4.
As was predicted in 1994:
Furthermore, we note that, in all probability, there will be IPv4
hosts on the Internet effectively forever. IPng must provide
mechanisms to allow these hosts to communicate, even after IPng
has become the dominant network layer protocol in the Internet.
It was also predicted that the address exhaustion problem would be averted, in fact that was the purpose of v6. It failed to deliver.
throw0101a 12 hours ago [-]
> It was also predicted that the address exhaustion problem would be averted, in fact that was the purpose of v6. It failed to deliver.
It was averted: how do you think we got several billion smartphones connected to the Internet? Do you think that would have been practicable without IPv6?
Comcast—not even mobile—had to move to IPv6 on their landline ISP business because they ran out of IPv4 addresses for TR-069: they were using multiple 10/8 networks in different regions NATed to hide them from each other. IPv4 became untenable.
commandersaki 12 hours ago [-]
NAT / CGNAT has been doing the heavy lifting extending the life of the Internet; ipv6 has done jack shit. If v6 was useful and actually averted v4 exhaustion we'd all be accessing v6 sites/addresses at this point.
Put another way, we can drop v6 completely and the Internet will still work. Obviously wouldn't work the other way around.
As for telco addressing handsets, they could use any addressing scheme to be honest. When people talk about averting address exhaustion, they're not talking about internal addressing of networks, different problem altogether.
throw0101a 3 hours ago [-]
> NAT / CGNAT has been doing the heavy lifting extending the life of the Internet; ipv6 has done jack shit.
Given they made the transition to IPv6 on handsets, T-Mobile US, which has 140 million subscribers, would disagree:
> As for telco addressing handsets, they could use any addressing scheme to be honest. When people talk about averting address exhaustion, they're not talking about internal addressing of networks, different problem altogether.
I'm sure if T-Mobile US thought they could, they would have:
> T-Mobile in the United States was running out of IPv4 addresses and needed an IPv6 transition strategy. Their solution was 464XLAT and IPv6-only.
Similarly Comcast rolled out IPv6 because they ran out of addresses for managing their CPE modems using TR-069: they were using 10/8 multiple times over, and it was too much of a hassle so they went to IPv6 (both internally and to their customers).
baby_souffle 11 hours ago [-]
> NAT / CGNAT has been doing the heavy lifting extending the life of the Internet; ipv6 has done jack shit. If v6 was useful and actually averted v4 exhausted we'd all be accessing v6 sites/addresses at this point.
This is factually difficult to support.
(Sent from my iPad which doesn’t have an ipv4 address… to hacker news which has an ipv6 address)
mahboi 9 hours ago [-]
You've put yourself in a position where you can't access a lot of websites, including things like GitHub. That might be fine for you personally but isn't what most people do.
baby_souffle 7 hours ago [-]
> but isn't what most people do.
Most people run dual stack and as $favoriteHost gets AAAA, their traffic moves over.
My broader point was that your use of overstatement and a false dichotomy isn't _helping_ us get to a world where IPv6 is dominant.
commandersaki 4 hours ago [-]
20 years too late.
mahboi 10 hours ago [-]
> how do you think we got several billion smartphones connected to the Internet
Only because of NAT. Those cellular CGNATs are v6 on the inside but v4 on the outside (well also v6 but customers need the v4 more).
toast0 12 hours ago [-]
Comcast does IPv6 (in most areas, at least), AT&T does IPv6 (was 6rd when I was a customer), CenturyLink (or whatever they're called today) had 6rd on DSL when I was a customer... and it made their CPE do terrible things so it needed to be disabled, but it was offered. My muni fiber ISP offers IPv6.
> At this point it would be best to recognize the sunk cost and give up on the migration. IPv6 will never reach the 100% needed to turn off IPv4.
That was probably a reasonable take 15 years ago. But we're at 50% v6 globally, and the ISPs that are doing v6 + cgnat would not want to move all that v6 traffic to cgnat. v6 traffic is managed with stateless routing; cgnat is stateful and costly.
There are many lessons that can be learned, but v4 only is not the future. v6 only might never happen... people are going to keep running old software in emulation that will never support v6... But global routability of v4 will likely end one day. And I'd suspect the tail of the migration will be much shorter than the head was.
lxgr 15 hours ago [-]
And I've only ever had v6, both on DOCSIS and fiber. Both observations are pretty useless in the grand scheme of things; actual adoption rates are what matter.
> At this point it would be best to recognize the sunk cost and give up on the migration.
That's a pretty wild thing to say in the comment section of an article about v6 reaching 50% eyeballs-side deployment.
hdgvhicv 14 hours ago [-]
After 30 years, with 99% of servers and devices having been designed decades after ip6 was created, half of traffic is still ip4.
If that’s not a failure I hate to see what is.
throw0101a 14 hours ago [-]
> If that’s not a failure I hate to see what is.
How would several billion smartphones be able to connect to the Internet without IPv6?
There isn't enough RFC 1918 (or 100.64.0.0/10) space for IPv4-only to be practical: Comcast—not even mobile—went to IPv6 because running their TR-069 management over multiple 10/8 became untenable.
IPv6 is making all sorts of things possible without most people realizing it.
9 hours ago [-]
hdgvhicv 14 hours ago [-]
Those phones are reaching half the internet via 64 gateways, no difference to reaching via 44 gateways.
throw0101a 12 hours ago [-]
> Those phones are reaching half the internet via 64 gateways, no difference to reaching via 44 gateways.
And how would they have gotten first-hop connectivity without IPv6?
Comcast added IPv6 many years ago on their wired ISP side because they ran out of IPv4 for TR-069 management, and they had way fewer subscribers (at least at the time) than many mobile telcos.
And that half of the Internet is also some of the most bandwidth intensive stuff: Youtube, Netflix, Instagram. The CG-NAT hardware costs of streaming would be huge.
inigyou 12 hours ago [-]
The network isn't just the open internet. There's also the part inside the network. You can view Comcast as a black box that magically gets packets from one side to the other, but Comcast engineers can't.
hdgvhicv 8 hours ago [-]
If you want to run a single massive scale network sure. One of the costs of scaling that the majority don’t see
No reason you can’t carry IPv4 over any protocol you want. Multi tennant vxlans can carry whatever you want over your base network. Maybe an IPv6 underlay makes sense there, doesn’t really matter
inigyou 5 hours ago [-]
Mostly they do carry IPv4 over IPv6 if they have vaguely newish equipment, otherwise they carry IPv6 over IPv4.
hdgvhicv 14 hours ago [-]
Thugs are slowly moving. Another 5 years and most windows machines will support clat. Another 20 and most machines will hopefully support it. I wish it was embedded in the Linux kernel though as that increases the chance of your device working transparently on an IPv6 only subnet using slaac and the application creator doesn’t need to know anything other than their internal dhcp gets a 10.x address and everything works using 464.
I think the future is bright and most problems will be solved by 2040, and almost all by 2050.
theandrewbailey 13 hours ago [-]
I've had IPv6 addresses on Comcast, Spectrum, and Verizon FIOS.
inigyou 12 hours ago [-]
If we have to give up on things that haven't reached 100%, shouldn't we give up on IPv4 first since that's even further away from 100%?
tonymet 7 hours ago [-]
it’s safe to say that we will never see total adoption, not within 2 generations. We will taper around 65% at best.
Think about the migration plan, and nearly every positive force to move to ipv6 has been exhausted. Routing hardware, consumer hardware, server hardware & software all have the capability. Mobile deployments were a big driver of ipv6, and that didn’t reach the level of adoption expected. Now hosting providers are charging for ipv4 addresses, and it’s not having a measurable impact.
Most migrations start to hit the hockey stick well before this stage, and the taper occurs around 95%+ when outlier hardware or legacy devices are the last remnants. We are not seeing a pattern like that here.
b112 17 hours ago [-]
And 32% is all llm/bots using AWS and other "pay for ipv4 IP" use cases.
benjojo12 17 hours ago [-]
As someone on the fighting end of scrapers, this is absolutely not true. If anything I should bais towards v6 as the traffic is on par better than v4
Sesse__ 16 hours ago [-]
Just remove the A record, and nearly all the scrapers disappear. :-) (And then you get one email per month or so that “your host does not resolve in DNS”.)
b112 16 hours ago [-]
Google is having a real issue with LLMs using it for search. As in, real load issues. Unless you're running a publicly accessible search engine, and the top one at that, the LLM traffic you're seeing is not representative.
jeroenhd 15 hours ago [-]
Every scraper I have blocked seemed to use IPv4 primarily. Only when IPv4 gets blocked, some of them fall back to IPv6. Others just stay dead.
With AI companies using botnets ("residential proxies") for scraping, they're probably going to be in the 50% that doesn't use IPv6.
jcgl 17 hours ago [-]
Citation needed. These numbers are quite consistent with the growth pattern that started well before usable LLMs were even a thing.
ck2 12 hours ago [-]
is it because some cellphone carriers are now completely ipv6 externally like t-mobile?
skywhopper 16 hours ago [-]
I’ve yet to live anywhere where the available mainstream ISPs were willing or able to provide IPv6 service. I’d be happy to use it, if I were able.
I also have built cloud infrastructure for multiple SaaS providers with tens of thousands of customers over the past decade. Only one customer I’m aware of has ever even requested IPv6 support. And if customers aren’t asking for it, my employers have never been interested in the full network re-architecture required to truly support it internally.
There are still several basic services you can’t run IPv6-only in AWS, and a handful of AWS service features that don’t support it at all.
As a sysadmin for decades now, I’ve always found IPv6 to be overengineered and in many ways completely ridiculous. But I’d love to be supporting it in everything I do. Only I still can’t, even after 20+ years of being lectured about it; even after complete IPv4 exhaustion has been reached. I don’t think we’re ever going to turn IPv4 off. At best it will be progressively hidden, even from technical users. And folks like me will just have to keep building workarounds to patch the holes where IPv6 still doesn’t work.
gucci-on-fleek 15 hours ago [-]
> I’ve always found IPv6 to be overengineered and in many ways completely ridiculous.
Most software continues to have horrible IPv6 support and documentation making it look more complicated, but the actual protocol is considerably simpler than IPv4. For example:
1. An IPv4 packet header is variable-length, and the checksum must be recalculated by every router because the TTL is included in the checksum. Whereas an IPv6 packet header is fixed-length and has no checksum.
2. NAT is effectively required with IPv4, but it makes everything much more complicated, since it means that most computers don't even know their "real" IP address, it makes peer-to-peer networking very challenging, and it's tricky for routers to implement. Whereas with IPv6, no NAT is required.
3. Any router along the network path is allowed to fragment an IPv4 packet, and is in fact required to if its MTU is smaller than the packet's size. Whereas only the originating node is allowed to fragment an IPv6 packet.
4. To acquire an IPv4 address, both clients and routers must implement DHCP, which is a fairly complicated protocol, and both clients and routers must remember the list of assigned addresses. Whereas with IPv6, the client can just choose a random address (via SLAAC) and then start using it immediately.
5. IPv6 multicast is considerably simpler than IPv4 multicast, and NDP (v6) is considerably simpler than ARP (v4).
Despite all this, I agree with you that setting up IPv6 networking is harder than setting up IPv4 networking, but this is more of a software problem than a protocol problem.
hdgvhicv 14 hours ago [-]
2 is a security nightmare but that’s why firewalls prevent it by default
3 well you can set the dont fragment bit at a client side or a router can drop the packet. These are choices. If a 1500 byte IPv6 packet arrives on a router with an 1100 byte next hop, does it just drop? Or send back a fragmentation needed icmp? How is that different from setting a “don’t fragment” option on a router.
4 isn’t created from a security or management point of view either. And v4 has the 169.254 range for this purpose. I guess the lack of router advertisement is the primary difference. And the operational expectations.
5a I’m not sure about. My main experience with multicast is pim-sm on v4. SSM v4 multicast however seems simple, and while I don’t use it as I have kit that’s too old for it is v6 really easier than v4/ssm/igmp3?
As for arp, I don’t see any real complexity with it as a network operator, but maybe that’s because I’m used to it. Perhaps it’s easier to implement nd rather than arp, but given almost every v6 deployment for the last 30 years is dual stack all it does is increase complexity.
gucci-on-fleek 14 hours ago [-]
> If a 1500 byte IPv6 packet arrives on a router with an 1100 byte next hop, does it just drop? Or send back a fragmentation needed icmp?
Yup [0].
> How is that different from setting a “don’t fragment” option on a router.
It's the exact same, of course with the difference that it's the default and that nothing needs to support packets with the “don’t fragment” option disabled (since it's mandatory).
> And v4 has the 169.254 range for this purpose.
Sure, but seeing 169.254.x.x usually means that something is broken, while seeing IPv6 link-local address is perfectly normal.
> As for arp, I don’t see any real complexity with it as a network operator, but maybe that’s because I’m used to it.
Well it's part of the reason why 802.11 tries so hard to pretend that it's Ethernet, and I've seen ARP storms a few times but never any NDP storms.
> but given almost every v6 deployment for the last 30 years is dual stack all it does is increase complexity.
Yeah, IPv6 is great, but dual-stack is fairly annoying, and given that IPv4 is the older protocol and still essentially mandatory, I definitely get why people dislike IPv6 (even when it's really IPv4 that's the problem).
NDP is not simpler than ARP. For one, NDP relies on link-local addresses to work which in turn relies on MAC multicast where ARP relies on MAC broadcast only.
inigyou 15 hours ago [-]
The only one I don't understand is how NDP is simpler than ARP. ARP is an Ethernet broadcast while NDP is built on IPv6 multicast which creates a recursive chicken and egg situation.
gucci-on-fleek 14 hours ago [-]
> The only one I don't understand is how NDP is simpler than ARP. ARP is an Ethernet broadcast while NDP is built on IPv6 multicast
ARP is a special protocol implemented on the data link layer, while NDP is just another type of ICMPv6 packet.
> which creates a recursive chicken and egg situation
I believe that NDP mostly uses the special ff02::/16 link-local multicast addresses [0], which don't require any configuration to use.
Considerably simpler? There's two ways (maybe more?) to autoconfigure v6 addresses on a host, I'll never know or remember which to use. In v4 there's DHCP, that's all you need to know (nobody uses BOOTP). These endless choices go on and on with v6 with umpteen transition technologies to work with v4.
BadBadJellyBean 15 hours ago [-]
I'm interested, apart from the chicken egg problem, what are things that you found bad about IPv6. What do you think is overengineered?
I personally found that the features I interacted with were useful (SLAAC, address size, router advertisements, ...) and the changes made it cleaner (removal of broadcast for multicast, removal of fragmentation fields, ...).
tormeh 15 hours ago [-]
> apart from the chicken egg problem
"But other than that, Ms. Lincoln, how was the play?"
BadBadJellyBean 14 hours ago [-]
I am more interested in the technical perspective than the deployment perspective.
inigyou 15 hours ago [-]
Did you call your ISP and ask? Some of them support it but won't enable it by default.
shevy-java 16 hours ago [-]
I want Google gone. This company is causing too many problems.
I am still sometimes using Google Search. First results are now
almost always videos on youtube, aka self-promo. These videos are
in 99.9% of the search results I use, totally useless and worthless.
Even searching on youtube has recently gotten worse. It is also
crap now. I know that because I bookmark various videos, and I
can not find older videos anymore either. I can eliminate some
results I don't care via ublock origin hero-blocking this Google
garbage, but I really think we should no longer allow this de-facto
monopoly to worsen the global situation any longer. The USA is
protecting these gangsters - it is time to have true legislation
that gets rid of that mafia bloc that is Google.
rkcr7 15 hours ago [-]
[dead]
tsouth2 13 hours ago [-]
[flagged]
brador 15 hours ago [-]
2026. Literally no reason to be using this outdated limited addressing.
New regex: IP(any collection of numbers and dots).
Now we have infinite IP address possibilities and no one controls the space.
Done.
codingdave 14 hours ago [-]
Do you think routers perform their work using the human-readable addresses?
If so, that is incorrect. They use the binary values. The actual difference between IPv4 and IPv6 is that IPv6 uses 128-bit addresses, not 32. So you can devise whatever human-readable abstraction you like, it won't change how networking actually operates.
brador 14 hours ago [-]
And there’s no reason we should be limited to 128. It’s all just so dated and stagnant.
Chips can be made that dwarf that limitation, instead we’re stuck with this decade old nonsense to “work around” again.
Flip flopping between “the code needs it” and “the chips need it”.
inigyou 12 hours ago [-]
How long should addresses be? 256 is good, lets you encode a whole ec25519 key. 512 for expandability? 1 megabyte for post-quantum?
brador 11 hours ago [-]
Why cap it at all?
If you can process 512 then you get access to those, else you don’t.
Let the free market decide where it’s comfortable like it did with wireless security.
inigyou 11 hours ago [-]
What good is a standard if it doesn't make devices interoperable?
brador 11 hours ago [-]
Catcher pitcher model. Pitchers pitch, catchers decide what to catch. You want access to the 512 space, pick up the 512+ capable device.
Free market decides where it lands.
If there’s nothing of value at 512, it’ll naturally flop.
inigyou 5 hours ago [-]
So why have a standard at all then? I want access to the Google Verizon space, I buy a Google Verizon device. The most flexible standard: one that imposes no requirements at all and allows vendors to do anything.
inigyou 15 hours ago [-]
What does a packet header look like?
xyst 16 hours ago [-]
Took them long enough. Now if only Google would follow with their own services.
Sure Gmail has ipv6 enabled and routable ip6 MX. but sending to those addresses is often rejected and forced to retry over ipv4.
Don’t get me started on gh
rvba 16 hours ago [-]
Great example of how fixing things "the correct way" does not seem to work sometimes.
They added those new addresses that can store more information.. but this requires a rewrite of old software to make it work.
If they used the old >bolting on top< method by extending ip4 from 4 octets to 8 (or more) octets, then old software could be extended much easier too / probably addresses could be simply mechanically translated too, so ancient software can work.
throw0101a 12 hours ago [-]
> If they used the old >bolting on top< method by extending ip4 from 4 octets to 8 (or more) octets, then old software could be extended much easier too / probably addresses could be simply mechanically translated too, so ancient software can work.
In every fucking IPv6 thread this "just add more addresses" idea comes up. There is no "just" in expanding the address space:
"""
Whether you expand the address size to 33, 64 or 128 bits, all IPv4 implementations will discard the packets. So it's a matter of mathematical and physical fact that to expand the address size, you must change the protocol, and that means two things immediately:
1. You have to change the version number.
2. You have to add new code to handle the new version.
Furthermore, you don't want to split the Internet in two, so you must design a method of interworking between the old version and the new version. Annoyingly, you need to do that in a way that can be done completely in machines that know about the new version, because other machines don't know anything at all about the new version, by definition. So,
3. You need a coexistence technique so that updated systems, with the new protocol, can connect to old systems that know nothing of the new protocol.
Two minutes of thought show that this third requirement has only two solutions:
(3A) Dual stack, in which the new machines speak both the old (IPv4) and new (IPng) protocol.
(3B) Translation, in which something translates addresses between the old and new protocols.
This has been known for more than 30 years [RFC1671], although people still sometimes try to deny it.
Any IPv4+ idea that "just" adds more address bits will same issues we've faced with IPv6.
mahboi 9 hours ago [-]
Yes, we want ipv5 that just does 1, 2, 3 instead of ipv6 which does the most complicated variants of those and more. We didn't have requirements 4. change all the pre-existing addresses 5. make addresses randomly assigned 6. make routers accept inbound connections by default 7. give every device its own public IP by default. Ipv6 did those anyway.
Like I own 8.8.8.8. You want to add more bits, fine, I'm 8.8.8.8.0.0.0.0 now. If anyone switches to the new thing, they know where to find me.
throw0101a 3 hours ago [-]
> Like I own 8.8.8.8. You want to add more bits, fine, I'm 8.8.8.8.0.0.0.0 now. If anyone switches to the new thing, they know where to find me.
Yeah… from the above link:
"""
Incidentally, "IPv8" proponents often ask why IPv6 didn't simply stick some extra bits on the front of IPv4 addresses, instead of inventing a whole new format. Actually, we tried that: the "IPv4-Compatible IPv6 address" format was defined in [RFC3513] but deprecated by [RFC4291] because it turned out to be of no practical use for coexistence or transition. The related "IPv4-Mapped IPv6 address" format is still valid and has a role in the POSIX socket API. Mappings of this kind also figured in the moderately successful coexistence technologies known as 6to4 [RFC3056, RFC3068] and Teredo [RFC4380], which have now been overtaken by events.
The people who created IPv6 weren't stupid: if you think you've thought up of a new idea, you probably haven't. Your "new idea" is either in the exact same situation as IPv6 or it was actually attempted and ended up being discarded.
tolien 8 hours ago [-]
> 5. make addresses randomly assigned
and
> 7. give every device its own public IP by default.
Both of these are optional. Don’t want them? Don’t use them - if you don’t configure them, it won’t happen.
> 6. make routers accept inbound connections by default
That’s not a new feature with v6.
> Like I own 8.8.8.8. You want to add more bits, fine, I'm 8.8.8.8.0.0.0.0 now. If anyone switches to the new thing, they know where to find me.
Now you (and everything in between) have to be able to handle packets addressed to 8.8.8.8 and 8.8.8.8.0.0.0.0, so you’ve done point 4 without knowing it.
BadBadJellyBean 6 hours ago [-]
The problem with IPv6 is really not the changes it made. Support was flaky for a while but that is pretty much over.
The problem is that you have to deploy it. You have to handle the bigger IP space safely, you have to assign the IPs, add DNS records, routing, etc. All this is work and the pressure is low. NAT has mostly taken that away.
Nothing would have saved us from that. There is no way to expand the number of addresses from IPv4 to more than 32 bits apart from a new protocol. There would always be software and infra changes. The server still needs to be changed to a new IPv4+ address, the client needs a new address, there needs to be internet routing for that address.
There were of course changes that were more than just a bigger address space. But I think that if you have to make software changes anyways you could also add some improvements. SLAAC is pretty nice (you can use DHCPv6 if you don't like it). Removing Broadcast is a good idea. Fixed header sizes are an improvement. There is a lot in IPv6 that are really smart ideas. None if these changes are the reason why it hasn't been fully adopted yet.
tolien 8 hours ago [-]
If anything demonstrates the Dunning-Kruger effect on this forum, it’s the “just add more bits” crowd.
CableNinja 10 hours ago [-]
The issue the GP is making is that rather than devising a whole new protocol altogether, including resolution and assignments, other things like that, adoption likely would have been much faster and wider.
Had the original plan been simply "extend address space" instead of "extend address space and while we are at it revamp and rewrite every part of the whole scheme including assignment, discovery, and everything else we see wrong with ipv4"; we would be in a much better place.
Adding extra address bytes would of course require new changes across the internet, but that change would be easier to swallow compared to having to rip and replace large swaths of processes to make ipv6 work because of all of the other changes that came with ipv6.
Also, the stupid idea of turning addresses to hex as the default, and more specifically the dumb :: shortening methods really made it confusing for everyone and didnt help at all in the efforts.
inigyou 15 hours ago [-]
Actually no software rewrite is needed because the Berkeley Sockets API is agnostic to address format. If your software requires a particular address format, that's a bug. if you pass an IPv6 literal to getaddrinfo, you get a result with an IPv6 address structure and it tells you the IPv6 socket type you need to connect to it.
mkj 11 hours ago [-]
getaddrinfo was added after ipv6. Software had to be rewritten to use getaddrinfo.
Prior to that programs used gethostbyname() etc, which only works with ipv4.
BadBadJellyBean 16 hours ago [-]
There is no space to put the additional octets. Supporting this would have needed a rewrite anyways. Nothing won there. They took that as a chance to improve the protocol overall.
johannes1234321 16 hours ago [-]
Software availability isn't really the problem. For most software there was no change at all ("connect to that host" or "listen to any device" and operating system will handle details), most software which needed adaption had it for a while (picking up a devices explicitly, handling of IPv6 addressees, ...) while maybe not equally good (missing GUI improvements for better handling of IPV6 addresses)
The problems, as I observe, are more in network infrastructure, routing, etc.
noduerme 16 hours ago [-]
I never heard this idea before, but more octets would be a lot prettier!!
inigyou 15 hours ago [-]
Are you just talking about how you write the addresses or are you talking about the actual protocol?
The IPv4 protocol has 4 octets each for source and destination address. Period. If you change that, your packets won't work on any IPv4 routers or software any more.
If you want to write IPv6 addresses as numbers separated by dots no one's stopping you but I don't see how it's better. They switched to hex because the old format was too long.
BadBadJellyBean 16 hours ago [-]
They added 12 more octets. I mean we could have written IPv6 addresses in the old format but I don't think that
You have not heard if before, because that is the most naive and stupid take imaginable. It is the “let them eat cake” of networking.
It does not work like that. Put extra octets where exactly? Where would a hardware router put the extra bytes? Where would software with 32 bit buffers?
You would still need to replace all of the software and hardware and have the exact same problem.
rvba 14 hours ago [-]
Your hardware can do Natural Address Translation. More octets is basically taking this idea further, to make a "big NAT".
BadBadJellyBean 13 hours ago [-]
You are aware that packets don't magically appear at the server side when sent by a client, right? All packets have to be routed to the destination by several routers. All these have to understand the full address to route the packet. The IPv4 header is strictly defined though. It says 32 bits for the source and 32 bits for the target. If you change anything about that all IP parsers will go haywire. If you put the information somewhere else, every router that doesn't understand that will send it somewhere else.
Every client, server, and router, every device that uses the address needs to understand where it comes from and where it's going. That means all the software needs to understand the protocol. So instead of having incompatible implementations live within the same protocol and make a lot of chaos it's better to have a new separate protocol that can be implemented gradually. Now the distinction is between having or not having IPv6 connectivity and my package on IPv4 goes no where because it hit a router that doesn't understand the extension.
PacificSpecific 17 hours ago [-]
First thing I do on a fresh Linux install is set ipv6 to deactivated. Fixes all my initial Linux install problems. I don't question it, it just works every time.
BadBadJellyBean 17 hours ago [-]
Something is very wrong with your network then. I never needed to disable IPv6. Maybe you should question it.
inigyou 12 hours ago [-]
If your ipv6 internet is broken you should probably turn it off on your router - hosts on the LAN can still communicate using ipv6 link-local, as some apps will want to do.
ash 16 hours ago [-]
It is harder to maintain two networks instead of one. Potential problems double. Hacks like RFC8305 "Happy Eyeballs" become a must.
PacificSpecific 17 hours ago [-]
Fair enough. I do question it often.
It's a standard Asus router but it's given me a lot of ire. I hate to say it but it's never a problem when I install windows on the same machines
(I'm currently in the process of trying to completely remove windows from my life)
CrLf 16 hours ago [-]
There are maybe many buggy routers still out there that reset the IPv6 flow label field when they shouldn't, breaking hash-based load-balancers (the symptom is TCP connections spontaneously reset).
IIRC, a workaround was to prevent Linux from setting this field, or force-reset it on every outbound packet using netfilter.
drewfax 15 hours ago [-]
Similar experience. I bought an ASUS router and enabled IPv6. It slowed down everything down. Immediately flashed OpenWrt on it, IPv6 works like charm.
It's usually bad configuration done by the router vendors. It doesn't mean IPv6 is bad.
PacificSpecific 9 hours ago [-]
Thanks for the info! I'll look into openwrt
xyst 16 hours ago [-]
[flagged]
CrLf 16 hours ago [-]
UX issue, and UX issues are often downplayed by engineers, leading to adoption failures.
Another such example is SELinux, which would have prevented so many vulnerabilities from being exploited, but whose poor UX also caused everyone to disable it at install time.
SELinux's UX was significantly improved many years later, but already too late to change ingrained opinions. There are a lot of ingrained opinions about IPv6 too.
inigyou 15 hours ago [-]
Conversely it means people who have ISPs that do IPv6 just have IPv6 and don't need to turn it off. Because it just works. The other day my IPv4 was down and I didn't even notice.
CrLf 14 hours ago [-]
I don't expect any ISP to do IPv6 today and deploy routers with a flow label bug... Those types of bugs no longer go unnoticed.
IPv6-only ISPs might hit other issues, though. They have to bridge to IPv4 somewhere.
Levitating 15 hours ago [-]
> SELinux's UX was significantly improved many years later
in what way?
CrLf 14 hours ago [-]
Most of what people see as "SELinux" is actually the default policy, which started out as way too strict. Then SELinux-enabled distros such as Red Hat moved to a policy that only applies to system services, and leaves user-launched binaries as if SELinux was disabled.
And even for system services, you can disable SELinux for one service (permissive mode) and leave it enabled for the rest.
This has been the case for more than 10 years, but the damage was done. It's now very hard for users even considering learning the basics (which are not hard).
wolvoleo 11 hours ago [-]
I have it switched off on most networks and servers including my home network. I just don't need it here and I have zero to do with asia.
I wish they had just made an IPv5 though. With e.g. 6 bytes instead of 4. 65535 times the current internet should be plenty. I feel like IPv6 is overengineered and I'm glad it didn't take off yet. I like being able to memorise IP addresses, it really helps testing.
If I ever do switch it on on my home network I'll probably use NAT on the router so I can still keep it exclusively IPv4 internally on the network.
I first learned about IPv6 when I was studying (1993) and I already felt like it was an overengineered monstrosity back then. They were campaigning like it would be the internet next year. Well that aged well, lol. That's now 33 years ago.
I truly think that if they had made it simpler and more IPv4 compatible we would have been moved over in 2-3 years. But no they had to keep supporting this thing. Well, at this point I'm going to avoid playing ball as long as I can.
lambdaone 11 hours ago [-]
A changeover to your IPv5 would be just as agonizing as the changeover to IPv6. A system with a larger address space is fundamentally uninteroperable with one with a smaller address space as there is nowhere to put the extra bits in the old protocol. The lack of motivation to move to the new protocol would also be just the same.
And as for memorization: do you actually memorize MAC addresses for your interfaces? The answer is no, you don't, becase ARP handles all that for you. Well, for IPv6, DNS, mDNS and so on handles all that for both your IPv4 and your IPv6 addresses - or should, if you know what you are doing, as memorizing IPs doesn't really scale beyond a few dozen machines.
Yes, IPv6 is overengineered, but it gets the pain of having larger addresses in the packet done once and for all - the odds of needing more than 128 bits in the rest of human history are very small indeed. And if something radically new needs to replace the current IPv6 architecture, which is much more likely, the extra address bits are already there; only 2000::/3 is assigned for public use so far, and the new addresses would fit in the current IPv6 packet format already.
cynicalkane 10 hours ago [-]
One big advantage of IPv6 local addresses is that you can pack a lot of semantic information in an address that's easy to remember, plus bits to help with routing and/or firewalling if you need.
DNS and mDNS don't "just work". You don't need but probably really want HA for DNS which is overkill for a homelab user, and you really want a fixed address for that DNS, because who wants to fix issues when you can't even address your services, and you really want your routers to have fixed addresses for the same reasons; you need VLAN and/or Avahi reflecting for mDNS, and if you need firewalling on your LAN, have fun dealing with the fact that mDNS clients prefer GUAs, then IPv4s, then ULAs in that order, by RFC rule, and managing GUAs sensibly when your ISP keeps changing your prefix -- well, IPv6 is almost 30 years old and home/SMB equipment still can't handle that reliably or flexibly, if it even lets you do anything besides assign /64s, and there's nothing stopping your ISP from saying "here just have a single /64, sorry if you wanted to actually use IPv6 for anything clever like having multiple subnets, who would ever want that?" So you say "I'll just use DHCPv6" and it turns out that DHCPv6 kind of sucks and it also turns out many devices don't support that by default or at all, including every single Android and Chrome device, for starters.
IPv6 is full of these design issues where you have a lot of things that are supposed to Just Work, Look It's So Much Simpler Than IPv4, and look at all these address bytes (excuse us while we take 64 of them away for no reason), except you discover that nothing Just Works with anything else in mildly nontrivial cases. You end up on a yak shave only to discover no yak underneath, and you end up just having a broken network while standing in a pile of yak hair. The whole story above is just one example. IPv6 is a migraine in RFC form, and if it weren't that I accidentally bought some expensive IOT devices that are IPv6-only, I'd be happy to never touch it. At this point, it would have been a better time-money tradeoff to have thrown those in the trash as soon as I had seen the problem.
wolvoleo 11 hours ago [-]
Yeah but that ridiculous overdimensioning is something I object to. There's more IPs than is needed to give each grain of sand on this planet its whole IPv4-sized internet. That's just overkill.
And the problem seems to be solving itself as the world is turning its back on globalism. China and North Korea already have separated themselves. Iran too. China still uses the same address space but it's not like there's open connectivity with the rest of the world. We'll probably cut off Russia at some point completely as part of some sanction (they've been preparing for that for years), and Europe will break with America if things continue. We'll just have interoperability at a few controlled border points then, like China already does with its great firewall. It'll be easy to do some address translation then.
Ps that's not something I'm necessarily happy about but I do see this trend emerging of every region trying to wall itself off.
vaylian 10 hours ago [-]
> Yeah but that ridiculous overdimensioning is something I object to. There's more IPs than is needed to give each grain of sand on this planet its whole IPv4-sized internet. That's just overkill.
People also thought that 4 byte wide IPv4 Adresses would be large enough. It's really hard to estimate how much you will need. And because numbers are effectively a free resource, it is better to overestimate.
IPv6 also gives you shortcuts to write addresses. You can abbreviate the longest run of zeroes with `::` and leading zeroes within a hextet can be omitted. This makes IPv6 address notation elastic.
wolvoleo 8 hours ago [-]
Well considering the 4 bytes were designed in the time of a small research network between defense and universities, it's great foresight that they made it as big as it is. It still runs most of the internet to this day.
But it's not free, after all every packet carries this burden. I know about the annotation but it also makes it very difficult to parse.
mahboi 10 hours ago [-]
If ipv5 worked just like ipv4 except with a larger address space, it would be easier than moving to ipv6. I shouldn't have to change my address to switch for example.
eddd-ddde 11 hours ago [-]
> I like being able to memorise IP addresses, it really helps testing.
This is even easier with IPv6. At work we have a bunch of test devices, and you calculate the IPv6 from the device's serial number. Simple as that, no memorization at all.
wolvoleo 11 hours ago [-]
But for an IPv4 device I only have to remember one number :) And nothing to do with a long random serial number.
lambdaone 11 hours ago [-]
<prefix>::1, <prefix>::2, <prefix>::3, <prefix>::4... exactly how hard can that be?
Or if you're feeling playful, <prefix>::b0d, <prefix>::bed, <prefix>::dad, <prefix>::b1d...
wolvoleo 11 hours ago [-]
The prefix is too long and it's not the same at every site.
When I'm at a different location, the biggest problem is usually figuring out if they use 192.168.0 or 192.168.1 :)
tcfhgj 10 hours ago [-]
lucky you, IPV6 indeed uses the same prefix everywhere: fe80::
And with ULAs (fd00::/8) you can pick your own prefix. Officially you should pick a random one to prevent collisions when you connect private networks, but you can choose something memorable if you don’t care about that
matja 8 hours ago [-]
> I feel like IPv6 is overengineered
In what metrics? IPv6 is more simple to implement than IPv4. In Linux 7.1.1 IPv4 is 84kLOC, IPv6 is 59kLOC.
Hikikomori 10 hours ago [-]
An IPv5 would have all the same issues switching over to it. Its been proposed so many times over the years.
zadikian 9 hours ago [-]
Not necessarily. I've gone down this rabbit hole in another thread, tldr there are alternatives that would've been easier initially but with the downside of leaving the routes fragmented.
Hikikomori 8 hours ago [-]
Nuh uh.
mahboi 10 hours ago [-]
If they're going to make ipv5, might as well make it 8 bytes instead of 4
the_real_cher 10 hours ago [-]
I dont think its that over engineered for what its capable of.
mahboi 10 hours ago [-]
That's what overengineered implies, it's capable of things you don't need. The problem with v6 isn't 128-bit addrs though.
* https://havevirginmediaenabledipv6yet.co.uk/
A major ISP in the U.K., that said in a public statement on World IPv6 Day in 2011 that
> As well as our core and access networks being capable of supporting IPv6, we're rigorously testing our entire network to ensure that all customers have a smooth and simple transition when the time comes to flick the switch and turn IPv6 on. We're really pleased with how our tests are advancing and are happy to say that by the end of 2012, we'll be able to fully support customers looking to switch to IPv6.
has not managed to actually flick that switch in 15 years.
* https://ispreview.co.uk/story/2011/06/08/uk-isp-fluidata-hai...
1. Sites that help shoppers choose can add a big visual red flag to any ISP that doesn’t support IPv6. Consumers don’t know what IPv6 is by and large but they do understand seeing a big red flag.
2. Same thing for websites. Add a banner that says “hey your ISP doesn’t support proper internet connectivity which this site utilizes. Contact them to let them know that you are having internet issues.” Again, consumers do not know what’s IPv6 is, but they do know what annoying banners are.
(It’s true that you can use cellular for your home internet, but I consider that extremely compromised.)
The parent was noting that most of the US lives in a region, that is under a monopoly of wireline ISP (DOCSIS, FTTH). Starlink can't shatter a wireline monopoly because it is OTA.
This is one of those “if everyone just” solutions that doesn’t work because shopping websites would never do that. Amazon has tons of evidence that even the slightest bits of friction result in noticeable drops in sales.
I don't think I bothered asking them again!!
(Edit "them" = Virgin Media)
But the way that they dealt with the whole thing smelt very "we don't know what we're talking about", enough to put us off.
And shifting all the IP space about would have had costs with very little return, so little business appetite to go through it.
I only found out because I could no longer access a swath of things I used to be able to.
not virgin media, but in the EU
That plus other ISPs v6 implementations breaking things randomly, I understand why they don't bother.
This has taken pressure off the IPv4 legacy address pool, reducing the urgency for older providers.
End-users are typically completely unaware of whether their traffic is being carried over IPv6 or IPv4, and so simply do not care one way or the other. (This particular post is more than likely being made over IPv6, since news.ycombinator.com has an IPv6 address and my OS, browser, router and ISP all support IPv6 straight out of the box, as is now true for the majority of users in my country.)
IPv6 not being supported in many places means the internet is more centralised, less likely to use proper p2p tech- because it's a lot harder to make it work rather than throwing up a TURN box and relaying everything.
"The latency? Who cares? IPv6 sometimes breaks right now" - because nobody is testing it, so why should people be the first to support it? There's no easy upside.
The only real upside for businesses is not having to pay for increasingly expensive IPv4 allocations. But they don't really care, its not nearly expensive enough yet. Customers will get GCNAT, businesses will continue as normal.
All that will happen is that the internet gets slower and less equal.
Which is exactly the same thing that's happening with inefficient memory hungry software: people either have to buy a more expensive laptop or they have a shitty experience.. Nobody is advocating for them, they just feel things getting shittier year on year and many are just choosing to avoid technology instead.
Realistically nobody outside some devoted HN readers are going to self host their own content. At best you'd see something like netflix trying to offload their video hosting costs onto their customers.
bittorent has been around for decades and nobody used it. They emailed files to themselves instead, or used dropbox. This all happened before the ipv4 shortage and people getting moved to CGNAT.
no reason this has to be centralised.
in fact, Jitsi uses p2p with WebRTC until a third person joins the call: then migrates the call to be relayed.
A really nice latency win.
ISPs had/have whole groups trying to stomp it out.
And it was a nightmare due to NAT even then.
It just got worse with CGNAT.
Even Linux distros push you so direct downloads now rather than pointing to trackers.
BitTorrent only has healthy usage for content that’s untenable to host legitimately.
Also, hey now - I have a lot of (actual) Linux disk images, and it works well for that!
P2P is not “self hosting”.
It’s video/audio conferencing working with less latency. It’s the ability to send a file directly and not via some file sharing site. It’s multiplayer gaming simplified. It’s faster software updates via BitTorrent.
It's almost always faster than anything else available, and ipv6 would make that method of sending files closer to the default for most people.
Having VOIP in games or 1v1 lobbies is, in the strictest sense, "hosting" something in the same way.
FD: I work in video games so I speak from this bias.
Similarly, using P2P for game VOIP is a Really Bad Idea as it basically doxxes the player. Even 1v1 lobbies aren't always with people you trust enough to invite them into your house, so you shouldn't be handing them your IP address! In 99% of cases it is better to proxy it via a server instead.
[0]: https://localsend.org/
Isn't self hosting, and small, private/semi-private communities the only way forwards for much of the internet? AI has made content extremely valuable, which in turn has started to destroy the openness of the web. Things are getting more and more siloed, with entry fees.
There's a world where self hosting comes back in a big way. AI ironically makes it much easier.
Someone DDoSing the $10 VPS hosting my personal website is no big deal. I don't care about it strongly enough that it must stay online, so they'll eventually get bored and move on.
Someone DDoSing my home internet connection? That's going to be a serious inconvenience - especially with WFH. No internet for a week isn't an option.
How about Xbox/PS multiplayer/P2P gaming? Hosting a Minecraft server?
When Skype first came out it was P2P, but had to come up with the "supernode" concept (basically STUN/TURN/ICE) because of NAT: now all of our communication methods basically have to phone into the mothership.
Do we want the Internet to be more centralized (possibly given more power to the tech bros) or more decentralized?
A hosted and managed Minecraft server is available for less than the cost of a cup of coffee per month. At that price point it makes very little sense to deal with the hassle of having to run your own home server. Even if you want to geek out and manage it yourself, a VPS is a very attractive option.
And for the handful of people that remain and really want to homelab a Minecraft server for their friends but are stuck behind CGNAT, there's always software like Hamach - which solved the gaming NAT problem back in 2004.
So no, self hosting isn't a problem which needs IPv6 to solve it.
You talk of a singular number in this analogy, but that is completely non-sensical in the IPv6 context: even brain dead ISPs assign /64s to residential connections, so you could give random strangers a random IPv6 address that's valid for a few hours and then you remove it from service.
Want to provide a service? Generate a new address, assign it to the server, publish it to whomever you wish. When you're done remove the ip addr alias. Give each rando their own IPv6 address for the service that's only live for a finite amount of time.
In fact you could generate a new IPv6 address each second in your assigned /64 and you wouldn't run out for 584,942,417,355 years.
So p2p stuff still doesn’t work without explicit configuration that rules out 99% of your users. It’s super annoying.
https://tailscale.com/blog/how-nat-traversal-works
It's a shame because if we could only get over stateful firewalling we'd be one step closer to the impossible task of using voice chat in console video games.
Right now they don't have that of course and the only hurdle is "NAT Types" which, as we all know, is a much easier problem to solve for the average person...
(this was sarcasm, if it wasn't clear).
If I'm with a small-time ISP that has to use CG-NAT because they don't have the cash to buy/lease enough IPv4 addresses to give one to each CPE WAN interface, then using things like Xbox/PS multiplayer/P2P gaming is no longer possible. Want to host a Minecraft server? Too bad.
Are those two use-cases "useful to the consumer"?
2. Perhaps our expectations of what you should be allowed to do is too low?
It wasn't meaningfully more difficult than setting up the server.
CGNAT doesn't have to draw a random ip:port combo out of a hat for every new connection. Nothing is stopping an ISP from implementing it by taking one ip and assigning ports 1-10.000 to customer A, 10.001 - 20.000 to customer B, and so on. Similarly, nothing is stopping an ISP from adding long-lived mappings to an otherwise-random pool which outlive the initial connection.
Some ISPs offer CGNAT traversal by letting you request a fixed ip:port combo via their self-service website. It's pretty much the same as regular NAT traversal, except that you can't freely pick the outside port. And because the number of people who actually care about it is so small: some ISPs even let you request to be exempted from CGNAT altogether! They'll already have a pool of legacy non-CGNAT customers and a pool of new CGNATted ones, so assigning a handful of nerds to the legacy pool to prevent them from complaining isn't a big deal.
It’s gotten much worse.
It also just reduces resource waste (of labor time). Countries like China that have insufficient IPv4 addresses and political power have mandated it. One IP per home is manageable, for now, but CGNAT is really bad.
The reason to regulate in maybe 2000 or so was that staying with IPv4 led to NAT. NAT led to it being impossible for users to receive incoming connections. Inability to receive incoming connections led to (a) horrendous protocol complexity, (b) probably some applications never even being invented, and, (c) everybody using ultra-centralized services. Ultra-centralized services led to advertising-driven distortions of service utility, concentration of political and economic power, and choke points. Choke points led to surveillance state bullshit that's just fully ripening today.
And, yes, this was (in broad outline) foreseeable in 2000. I wasn't the only one.
Their core network has IPv6, but not their customers, 17% market share in telecom in the Netherlands.
Are there more?
PS: From the millions of customers' details leaked it sounds like their market share is a hell of a lot higher than 17%!
That's 30% of the NL population.
It's Optimum Communications and Frontier (my provider) that are really holding the numbers down at ~15% each. The latter is improving very slowly, but not a lot of evidence of change in the former.
* https://stats.labs.apnic.net/ipv6
Virgin Media exist for two reasons: first they were given a monopoly by their Tory chums (Thatcher) and, second, all ISPs are allowed to make you sign absurdly long, anti-competitive contracts (18 months is common). If ISPs were treated the same as utility suppliers we'd probably be in a better place.
IPv6 traffic crosses the 50% mark - https://news.ycombinator.com/item?id=47777894 - April 2026 (621 comments)
---
Other recent threads, if anyone would like a thousand more IPv6 comments:
The world in which IPv6 was a good design (2017) - https://news.ycombinator.com/item?id=47821429 - April 2026 (166 comments)
IPv6 is the only way forward - https://news.ycombinator.com/item?id=47680124 - April 2026 (339 comments)
IPv6 Adoption in 2026 - https://news.ycombinator.com/item?id=47083086 - Feb 2026 (21 comments)
IPv6 is not insecure because it lacks a NAT - https://news.ycombinator.com/item?id=46696303 - Jan 2026 (577 comments)
Good example of the 2020s on why there is practically truly only one Internet instead of many.
My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. I disagree, but I do agree that having 4 and 6 is a higher risk than 4 alone or 6 alone, and 6 alone sadly still doesn’t work reliably.
All the “promise” of ip6, direct connections etc, were lost when stateful firewalls became required and memory became cheaper than $20 a megabyte. Some bespoke old protocols don’t like ports changing, which can be a problem, but it’s a very small number and easier to work around with modern protocols than support a dual stack environment securely for the majority of places that struggle securing a single stack.
If your corporate laptops are running Windows, then you're going against the officially supported configuration of the vendor (Microsoft):
> Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions.
> We don't recommend that you disable IPv6 or IPv6 components or unbind IPv6 from interfaces. If you do, some Windows components might not function.
* https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
> Cg nat does everything that’s needed […]
Except for making it convenient for end-user to, say, play P2P video games, or host Mindcraft servers, etc.
> […] and 6 alone sadly still doesn’t work reliably.
It's so unreliable that half of all Internet traffic uses it. It's so unreliable that Microsoft has been going IPv6-only in their corporate networks (a decade ago):
* https://labs.ripe.net/author/mirjam/ipv6-only-at-microsoft/
It's so unreliable that Google is now 99% IPv6-only/mostly on their corporate networks:
* https://www.youtube.com/watch?v=UTRsi6mbAWM
With ipv4 you have a two tier internet. Computers talk to servers, servers talk to servers, computers can't talk to computers so every video call must be routed through a server.
That the server can figure out that two computers in the same house are different since your laptop and phone no longer share the same ipv4 address but instead have two ipv6 address?
Your phone and laptop can just have multiple ipv6 addresses and rotate through them regularly... as apple does by default https://support.apple.com/en-ca/guide/security/seccb625dcd9/...
Security? NAT is not a firewall, you need a firewall, and switching to IPv6 does not remove your firewall.
Before IPv6: The server gets "1.2.3.4:56789" for your device. After IPv6: the server gets "1:2:3:4::56" or whatever for your device. In either case, if the server makes a connection to 1.2.3.4:56789 or 1:2:3:4::56, your router sees the packet and firewalls the connection. Cool.
Want to give me a concrete example of where IPv6 is hurting my privacy or security, because I've been using it for over a decade with zero mishaps, zero privacy issues, zero security issues (to my knowledge at least)
I've only read that on HN, I've never heard this anywhere else. Since it's been a good 20+ years since my CCNA (and haven't needed to renew it since), could you please offer a real-world example where NAT is not a firewall w/ practical examples relating to 99.9% of cases of home use? I just can't get why people say this a lot here.
NAT works and passes the grandma test. If grandma buys a crappy vulnerable 40$ printer and plugs it in, even if it accepts unauthenticated stuff on every local port, you will not be able to connect to it behind NAT. So what's the difference? The only way I could think this can apply is if the ISP is compromised or criminally mismanaged, in which case you probably already have bigger problems.
Well-regarded networking architect, author, and instructor:
* https://blog.ipspace.net/2011/12/is-nat-security-feature/
> NAT works and passes the grandma test.
So does my Asus with a default deny IPv6 rule on incoming connections.
You're more likely to click on a link that installs malware that attacks your network from the inside, and that attack works regardless of IPv4 or IPv6.
Treating a firewall as some impenetrable moat has not been network security practice for a decade(+), and waving around RFC 1918 address space like systems with a 10.8 or 192.168/16 can't get infected is lazy thinking. It leads to complacency: I'm behind NAT, I'm safe.
But why would you rather have an always-broken network that might block attackers instead of a deliberate "deny incoming" rule that does exactly what you want -- and that you can punch holes in if desired?
Instead we have apps circumventing this accidental barrier with STUN, uPNP, etc with little/no oversight and we also regularly encounter brokenness.
Using a random address (Privacy Extensions) solves this problem though, but do we expect everyone to know what that is and check it's enabled? Mine wasn't enabled by default (on Linux) and I only noticed when a bittorrent site warned me.
* https://support.apple.com/en-ca/guide/security/seccb625dcd9/...
As does Windows (since Vista), and Android (8+).
So why are we still talking about this?
(All of that hinges on the key question that people seldom ask: what is being protected, and from who. The "two-tier" Internet is, in a way, pointing out a case where regular users are seen as threat actors.)
Some people will mention stateful firewalls. They're pretty easy to holepunch through because you just need each side to send a packet to the other, then each firewall sees it as an outgoing connection and allows it. It's nothing like IPv4 NAT.
For example here is how to achieve the same result in PF, note the single additional operator needed to specify nat.
block in on $EXT_IF
#NAT
pass in on $INT_IF to any rdr-to $EXT_IF
#statefullfirewall
pass in on $INT_IF to any
I had a very concreteish security risk with IPv6 and openvpn. At least in Debian config openvpn tunneled only IPv4 by default. I only noticed this by being surprised I got results tailored to my origin country instead of the VPN out node country.
It's eternal (dual stack) paper cuts like this why just turning IPv6 off makes life a lot easier.
Ubiquity gateways also seem to not support it sadly. It would be awesome if they supported something like Hurricane Electric’s tunneling.
HE tunnel IP space is now sufficiently penalized as non-residential/office that I’ve had to turn it off anyway. YouTube, for example, largely seems to block users in HE space unless they are logged in, and I frequently ran into neverending captchas.
While T-Mobile US has been IPv6-only since ~2018:
* https://www.youtube.com/watch?v=d6oBCYHzrTA
But you can't use HE tunnels because every website you visit will block you. You also can't use them from CGNAT or if your home router doesn't have a DMZ.
Is there a law mandating this?
I forgot one detail: your ISP could pay a different tier-1 ISP, as they all interconnect. Nonetheless, your ISP pays top rates for that traffic - tier-1 routes are usually last-resort routes.
Obviously if the ISP is buying transit from HE, they'd have to pay for it, but it'd be surprising if HE was strongarming their customers by adding a clause that's like "oh also, if any of your customers use our ipv6 tunnel, we'll charge you $x/user/month" or whatever.
All my packets go through Seattle, using a Seattle tunnel server adds negligble latency.
But as someone else said, being connected with an he.net tunnel gets you marked as undesirable traffic these days, so that's annoying.
But simply it is impossible to go full ipv6, as many of isps of the clients do not support it.
Currently there is no pressure to the isps to move to ipv6. In fact the incentives are OPPOSITE! They love charging for static IPs.
Put all work into reorg, for what? Some numbers to change? Why when IPv4 works?
The real security risk is thinking that just because you have an internal RFC 1918 address space your security has improved.
It's been a decade+ since a firewall being considered a castle/moat of security being best practice. Any IT person that thinks that if they see a device with an 10/8 (or 172.16/12 or 192.168/16) IP and think you're safe you should be fired: it's lazy thinking.
At least if you had a GUA address it would force you to pay more attention to the rest of your security controls. Just recently a co-worker retired some systems that were accessible to the outside via DNAT—but forget to clean up the firewall rules. So he then—for some fucking stupid reason—decided to re-use those same IPs, even though we had so many fucking other IPs available, and one of the boxes got compromised because it happened to have a simple, guessable password on the initial image install.
The bigger issues is not remembering hostnames vs IP addresses.
Unless you have explicitly changed it what is the hostname of your mobile device? How about your PC?
The reality is with an even mildly competent DNS+DHCP implementation that is all you would need...
And mDNS otherwise but it seems only Apple ever bothered with that being default.
But my TP-Link router blocks by default inbound IPv6 connections, without any option to configure it, still bad for pure IPv6 bidirectional streaming, gaming or services on home networks.
I selfhost web and email over my Wireguard VPN using a free VPS (at OCI but I did it with AWS Lightsail too, though it wasn't free but cheap). This can work for you too or you can use easier to configure solutions like Tailscale. This way, your home isn't exposed directly to the Internet.
To your point, IPv6 sought to replace NAT with just having enough addresses but interestingly, that created a problem. If you used NAT and had a service on your computer request a port for incoming connections, that showed intent on behalf of the owner of that service. IPv6 doesn't have that intent, which forces home router makers do block addresses by default because you don't want most PCs on the Internet such that an external agent can scan your PC. You may end up with an unintended service on the open Internet.
So is the bigger address range better? Technically, maybe? But you have to consider defaults and intents of users. And that can take a good technical solution to a bad solution or at least create a whole bunch of problems.
Using NAT as a firewall might work but it brings it's own problems. I find the IPv6 way better.
Glad to hear that you don't have a problem with your router, but how does that relate to GPs problems with theirs?
The solution for them is "get a better router" because the problem is not the IPv6 protocol. Opening a port is not harder than creating a NAT forwarding and if your hardware can't do it then it's bad.
Nobody includes their MAC address in their public IPv6 addresses anymore, but every IPv6 setup that I've seen still gives every device a unique globally-routable IPv6 address, with no NAT at all.
> One of my favorite is the decision to default to /64 blocks.
The nice thing is that a /64 is big enough that clients can just randomly pick any address, and it will almost certainly be available, meaning that you don't need DHCP. This is actually widely implemented, and is known as SLAAC [0].
> Yet we're still stuck with the 128 bit addresses that came from that.
The extra address space only adds 16 bytes to every packet, and it ensures that we will never run out of addresses like we did with IPv4.
[0]: https://en.wikipedia.org/wiki/IPv6#Stateless_address_autocon...
Crucially though, if we change it, we just have to change how addresses are allocated, not change the protocol again.
Yup, and only less than an eighth of the total IPv6 address space has been allocated [0] [1], so there's still plenty of room to expand, even if we have to throw every current address out and start from scratch.
[0]: https://www.iana.org/assignments/ipv6-address-space/ipv6-add...
[1]: https://datatracker.ietf.org/doc/html/rfc3513#section-4
Mine all have link-local addresses (I do have a real static IPv6 address block from my ISP, at great expense…) - so I’m not sure what I did wrong in my Ubiquiti gear.
[0]: https://news.ycombinator.com/item?id=44773981
Randomizing the local address doesn't mean it isn't useful. You can't scan a /64 so that's already a major improvement. The fact that randomly selecting a number is effectively never going to collide greatly simplifies automatic network configuration.
The major issue is that the /64 isn't mandatory from a technical perspective. Being merely a subset of the larger address it's nothing more than a convention. In the end not all providers make it available to you even though supposedly they ought to.
If we're going to complain about anything it should be the godawful notation that so easily breaks parsers. Or the fact that the width is massively excessive which creates a usability nightmare due to normal humans not being able to readily recall 128 bit numbers (let alone how long it takes to type them in).
Picking a random local address (which is very important for privacy, as you've mentioned) is much easier if you don't have to do an elaborate dance of listen, announce, listen for collisions etc. first (practically that still happens, but collisions are the absolute exception).
> So is the bigger address range better?
Yes, because consider the alternative of re-doing all of this again in a future in which IP usage for some reason jumps by a few orders of magnitude again.
Due to hardware getting better over time, the per-packet cost of a few extra bits is going down all the time, while the cost of rolling out a future IPv7 increases with every new deployed host.
Some ISPs are reportedly giving out a /128, and SLAAC works adequately with a router performing IPv6 NAT, so those ISPs don't see a problem.
Mobile phone as WiFi access point is another common way people access the net nowadays. I've occasionally seen permanent installations, with a phone taped to a window. I've never seen a mobile phone AP offer IPv6 to clients, but if they do they have to use SLAAC-compatible IPv6 NAT in that situation.
Wow, that’s diabolical. Presumably these routers are some custom CPEs then? I don’t even know whether regular home routers support NAT66.
> I've never seen a mobile phone AP offer IPv6 to clients
I’ve only even seen it work without NAT when there was any v6! Usually the phone gets a /64, and there is a bit of trickery involved to make that shareable to other devices (NDP rewriting), but it works pretty well.
Every residential router already has PCP (RFC 6887) and UPnP IGD to deal with the NAT44 non-sense that is the status quo, and both protocols support IPv6 hole punching, so IPv6 default deny as a policy is hardly an issue in the residential space.
MiniUPnPd, which many Linux-based CPEs use, has supported IGDv2 (needed for IPv6) since 2012 (as well as PCP).
https://radar.cloudflare.com/adoption-and-usage#ipv4-vs-ipv6
But we have to remember that this reflects the adoption on the client side. With many high profile services still IPv4-only, the fraction of IPv6 flowing on the public Internet might be much lower.
I wonder what incentives are needed to push this forward, because it's not the same incentives as years ago for sure. We've long since exhausted new IPv4 allocations.
[1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
https://www.arcep.fr/fileadmin/reprise/observatoire/ipv6/Arc...
(2025, from 2024 data)
Reason that Google isn't seeing more is a) some BigCo v4 holdouts b) happy eyeballs sometimes landing on v4 because their v6 is shitty 6rd or something (e.g Free SAS)
The only ISP not putting out v6 widely is SFR, and thankfully they've gone bankrupt and we will be rid of this scourge.
The connection is solid, though - thus my lack of enthusiasm.
LTE arch with the PGW handles IP allocation to devices
https://mobilepacketcore.com/lte-4g-network-architecture/
https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
At the moment pretty much every website is reachable via IPv4 but a lot not via IPv6. Will there be a day when this turns around?
That's already the case. IPv6 is often faster because most ISPs these days use cgnat for IPv4.
This becomes noticeable when pipelines on IPv6 connected servers suddenly have random request/post failures to public services. Then either the whole service is temporarily having issues or there are a few bad IPv6 endpoints while all the IPv4 endpoints are fine.
Seemingly this failure mode can go unnoticed for days while the same won't be true for IPv4 due IPv4-only still being the norm for corporate networks. And no, current form of happy eyeballs v2 won't account for this.
Besides bad endpoints it could also be a problem with bgp route advertisements where the IPv6 prefix takes a weird path and ends up being blocked by a CDN at the other side of the ocean. This happens more than you'd think. Obtaining pypi packages was quite a challenge last year for us for a couple of weeks due to this.
Not really a fault of IPv6 technology wise, and in general can be solved client side through retry functionality, but in practice it still can lead to a worse outcome due to lackluster IPv6 adoption.
I used to think ISPs, organisations, admins and users were just being lazy for not implementing IPv6 or turning it off as the first thing to do when network problems happen, but when this far in the rollout such basic things still lead to difficult troubleshooting sessions then perhaps time has come to say something has gone terribly wrong.
It saddens me to say that I totally understand that businesses do not want to pay the price for implementing IPv6 unless absolutely necessary, because until the majority of traffic is IPv6 or even IPv6-only it does not make a lot of sense.
The flipping point is nearer than ever, though I fear it will in the short term lead to even worse stability for both protocols until IPv6 truly becomes the norm, whenever that may be.
If you've ever visited a website from your smartphone (over 4G/5G), your first hop has in all likelihood been over IPv6. If you have visited a website from your phone that only had an A record then you probably went through a CG-NAT box, which added latency.
If you streamed a Youtube video to your phone, or checked Gmail, or Instagram or Facebook, then it was over IPv6.
People (including probably you) use IPv6 everyday, multiple times, without knowing it.
Also there are cases where the ISP didn't bother even optimizing their routing in v6. I understand that some ISPs in Asia (and especially in Japan, where it shows up on ordinary customers in terms like MAP-E and VNEs) have separate backplanes for v4 and v6 (some are legacy reasons, some are business reasons). Guess which one is being devoted more in practice (hint: not the one being devoted more by IETF).
Edit: I thought this was just in Asia, but apparently this is also the case in an ISP in UK (https://news.ycombinator.com/item?id=48618403)
Do you have examples for this? I've never experienced this, and I've been using IPv6 for years.
Also, how can you be sure that the same request to IPv4 would have been fine? Did you actually see consistent failures on v6 and consistent success on v4? Otherwise, if a service has a reasonably low error rate, success on retry is the expected outcome, regardless of the path the retry takes.
This happened with pypi (IPv6 BGP routing problem caused by a bad route from one of our peers combined with their fastly CDN not reply to us on IPv6 from the other side of the ocean for some weird reason), but also with yum and apt mirrors (seemingly random problems with the IPv6 service or firewall of the remote endpoint), and various other web resources accessed from pipelines.
The solution always was to temporarily block the bad IPv6 endpoint(s) or temporarily completely disabling IPv6 on the server itself or on the squid proxy server for workloads without direct connectivity.
Obviously it also can be the other way around, but in practice it appears to happen less often with IPv4, and if it does things get addressed quickly instead of taking hours or days or weeks.
Users doing speed tests in CGNAT may be seeing numbers that aren't exactly real for a (still) mostly IPv4 Internet.
Infact the only isp I have seen do it is starlink and I have contacts with ISPs in 60 different counties.
More on this: https://vincent.bernat.ch/en/blog/2024-why-ipv6
Unless you want to host multiple minecraft servers on the same port on different servers at home?
Indeed hosting anything at home is such a rare workflow that someone wanting it can choose an isp which gives them the facilities they need.
Unless you don’t live in a competitive market based economy and just have the single government mandated isp aimed at the lowest common denominator, in which case you’ve got far worse problems.
If there's one thing market competition does well, is remove any kind of meaningful variety - because supporting a niche offering costs money, and is not worth it unless it nets positive, otherwise it's just a drag that makes you fall behind your competition.
The internet would be much less centralized if IPv6 happened when it was supposed to.
>Individual economies such as India, Viet Nam, and Saudi Arabia exhibit adoption curves that differ markedly from the global average. As the APNIC Labs data shows, this global trend does not necessarily reflect the experience of individual economies.
>APNIC’s own measurement records a 42% worldwide IPv6 capability (Figure 2). That’s a substantial difference, which also needs clarifying."
The nuance is that IPv6 is growing faster in developing countries with poorer economies. I'm guessing this is because building modern IPv6 network from scratch is cheaper & more efficient than acquiring scarce and expensive IPv4 addresses. This is a major advantage for newer providers in growing economies.
So while the Google is showing it at 50%, APNIC's weighted global measurement shows it at 42%.
I've never seen this chart before, was taking a peek from the link in the article. Does anyone with networking knowledge know why IPv6 usage peaks on Saturdays and dips during the middle of the week? (something related to mobile ISPs?)
Also you made the life better of people who have DS lite. They only get a public IPv6 and all their IPv4 traffic goes through a CGNAT.
https://cr.yp.to/djbdns/ipv6mess.html
Yes, it is old, many examples are outdated, but the main points still hold. Decades later his suggestions for making IPv6 succeed are still not implemented.
2. Most websites assume that 1 IPv4 address==1 household, so you'll often run into rate limits. Or even worse, you might be blocked entirely if your CGNAT neighbours are spammers or otherwise breaking website rules.
Yeah, I just mentioned that because P2P networking is used a lot more than most people think these days, since even things like Zoom that look like typical client–server web browsing actually use P2P networking internally.
> It was suggested that a website operator deploying IPv6 would somehow improve the end user experience by virtue of avoiding CGNAT and I was questioning that.
Reliability and latency will be marginally better with IPv6 than with CGNAT, but this is so minor that I doubt that most people will notice this. And many CGNATs will RST connections that last too long, but most protocols have some sort of automatic retry/reconnect built in, so this shouldn't cause issues very often either.
IPv6 addresses are quite a bit cheaper than IPv4 addresses in most clouds, but since most servers still need to support IPv4, this doesn't help you directly. Supporting IPv6 means that others using the cheaper IPv6-only cloud services will be able to connect to your server, but this doesn't matter for consumer-only services.
So yeah, you're probably right that enabling IPv6 server-side won't have (m)any benefits.
> I do of course appreciate that going via CGNAT to a clueless operator that eagerly adds IPv4 bans can be problematic but that's more a question of why you as a consumer might want IPv6 connectivity not why a service provider would want to deploy it.
Being able to ban IP addresses without worrying about collateral damage is a pretty big benefit to the service provider though, for certain applications at least.
Non-legacy, newly formed ISPs have to spend a lot of money on either buying or leasing IPv4 address space, and even then if they grow they probably won't be able to keep up, and so have to deploy 100.64.0.0/10 to the WAN interface of CPEs and then buy a bunch of CG-NAT hardware.
The problems are on not entirely visible at the end-user side of things because of the Herculean efforts by ISPs.
IPv4-only services are thus externalizing the costs of connectivity to ISPs (especially newly formed ones).
Isn't that literally their raison d'être? Point taken that in aggregate it increases the costs of network operators but still that's got nothing to do with an individual instance of an individual user visiting an individual website.
2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
I prefer to run scrapers behind CGNAT because websites can't ban it without causing collateral damage, which matters more to some than to others. The website probably has to put up a captcha. Which hurts its human traffic. Think about how much more traffic you could have if you didn't show everyone a captcha, and you might see that you should also be in favour of IPv6.
Your CPE is probably running UPnP IGD and/or PCP for hole punching of P2P services, and IGD/PCP can hole punch just as easily for IPv6.
> 2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
It's not whether CG-NAT is an edge case or not, it's whether there are things that are completely impossible with it or not. Want to play with your friends on your Xbox/PS? Too bad, CG-NAT makes it completely impossible.
Why should we be happy with a technology that makes certain use cases impossible? On what planet is that a good thing?
Stateful firewalls and even regular NAT aren't much of an issue for P2P, but CGNAT is much more problematic [0].
> 2) if cg nat is as popular as people claim then they won’t be doing that as it’s not an edge case
You'd hope, but people tend to be pretty slow to update their networking assumptions, so this is still pretty common. And it doesn't help that most CGNAT users tend to be either from poorer, since poorer countries and mobile data providers are far more likely to use CGNAT than legacy North American ISPs.
[0]: https://tailscale.com/blog/how-nat-traversal-works
My ISP doesn't do CGNAT in FTTH deployments, but I'm paying extra for a static IPv4 allocation anyway since I was increasingly getting hit with captchas every time my IPv4 rotated to flagged IPs that were trashed by my fellow subscribers with poor infosec practices - i.e. 99.9% of residential subscribers.
Once I got a static allocation, captchas are getting easy to pass.
Mobile carriers use it almost exclusively, which is already a huge chunk of the internet, and newer ISPs are switching to it too.
> I'm supporting both because I heard it's good to support both, but I'm not sure what the actual benefit is.
The benefit is that you allow IPv4-only and IPv6-only clients to connect.
Some applications will still fail to work though unless you also have 46 nat on your device which still doesn’t work transparently on majority of types of device.
You also need all devices on your lan to support v6 natively, and v6 only. From your printer to your speaker.
You might be able to do something with mdns and nat64 to get them working on an IPv4 only subnet. But you’re talking layers and layers of complexity for things which just have to work.
I’m posting this from my phone on my IPv6 only subnet, not sure if it’s using a 64 gateway or 6 native to HN, but it’s possible.
From the user side IPv6 is great for me. My ISP is using CGNAT and would bill me ten pounds a month for a static IPv4 address but I automatically get a vast block of IPv6. I'm using that block to allow me to VPN back home when out and about, and if I wanted to I could also host services from devices on my home network without needing any NAT nonsense, I can just open access to the relevant device on the router. (Because this is a world where not everywhere supports IPv6 yet if I'm on an IPv4 only network the VPN endpoint is a dedicated server I rent which forwards the relevant port back to my home router over IPv6)
Chances are they also skimping on other areas including over subscription. Choose a better isp if you want a better service.
Your “just open traffic to internal host 1 on your firewall is the same no matter if it has nat or not, unless you are using a non stateful firewall? Or perhaps your configuration layer splits the two for reasons.
The great news is those vulnerability scans from random IPs are coming just on ipv4, there hasn't been any yet on ipv6 :)
HE shows 41% ASNs support v6: https://ipv6.he.net/
We knew bot traffic is more than half of the internet, right?
A more reasonable approach might be to block a /64 first, monitor if you get more blocks within the /56 block that contains the /64 and maybe block that.
This graph even shows them doing step deployments:
https://radar.cloudflare.com/adoption-and-usage/as2860?dateR...
Also IPv6 addresses are ugly
Only because it is overengineered. Parents pragmatic protocol would have been adopted faster
Most people can pick up calculating subnets in their head in ipv4 pretty quickly and ipv4 addresses are easy to memorize on accident. My brain turns to mush as soon as I start seeing hexadecimal characters in addresses.
you can send a packet from an extended address host to a vanilla v4 host if you map the address space into a range like you suggest..but that v4 host just has no way of sending a message back..so its kinda useless
We need to pretend we overengineer. But some in the committee made it sure data exfil would be basically impossible to detect / block with IPv6, which all the others, always in love with the most rube-goldberg design possibles, loved the "overengineered" solution.
With rube-goldberg designs, you can then always say stuff like:
"The xz backdoor was TOTALLY unrelated to systemd"
Yet it only concerned distro that shipped with systemd.
Go figure.
It's always "because insert-crazy-non-sensical-hair-pulling-reason-here".
Ah yes, it's because of that. So it's so totally unrelated right?
Except it still only affect distro using systemd.
Or maybe, you know, backdoors and exfils were the plan from the very start.
"The protocol won't work correctly unless you let crazy ping packets doing you-know-what". And nobody is ever going to properly firewall all that.
Overengineering is one thing, yes.
But we know for a fact that there are xxxINTs infiltrating committees and pushing "solutions" that are only solutions to them.
As was predicted in 1994:
* https://datatracker.ietf.org/doc/html/rfc1726#section-5.5It was averted: how do you think we got several billion smartphones connected to the Internet? Do you think that would have been practicable without IPv6?
Comcast—not even mobile—had to move to IPv6 on their landline ISP business because they ran out of IPv4 addresses for TR-069: they were using multiple 10/8 networks in different regions NATed to hide them from each other. IPv4 became untenable.
Put another way, we can drop v6 completely and the Internet will still work. Obviously wouldn't work the other way around.
As for telco addressing handsets, they could use any addressing scheme to be honest. When people talk about averting address exhaustion, they're not talking about internal addressing of networks, different problem altogether.
Given they made the transition to IPv6 on handsets, T-Mobile US, which has 140 million subscribers, would disagree:
* https://www.youtube.com/watch?v=d6oBCYHzrTA
> As for telco addressing handsets, they could use any addressing scheme to be honest. When people talk about averting address exhaustion, they're not talking about internal addressing of networks, different problem altogether.
I'm sure if T-Mobile US thought they could, they would have:
> T-Mobile in the United States was running out of IPv4 addresses and needed an IPv6 transition strategy. Their solution was 464XLAT and IPv6-only.
* https://www.internetsociety.org/deploy360/2014/case-study-t-...
Similarly Comcast rolled out IPv6 because they ran out of addresses for managing their CPE modems using TR-069: they were using 10/8 multiple times over, and it was too much of a hassle so they went to IPv6 (both internally and to their customers).
This is factually difficult to support. (Sent from my iPad which doesn’t have an ipv4 address… to hacker news which has an ipv6 address)
Most people run dual stack and as $favoriteHost gets AAAA, their traffic moves over.
My broader point was that your use of overstatement and a false dichotomy isn't _helping_ us get to a world where IPv6 is dominant.
Only because of NAT. Those cellular CGNATs are v6 on the inside but v4 on the outside (well also v6 but customers need the v4 more).
> At this point it would be best to recognize the sunk cost and give up on the migration. IPv6 will never reach the 100% needed to turn off IPv4.
That was probably a reasonable take 15 years ago. But we're at 50% v6 globally, and the ISPs that are doing v6 + cgnat would not want to move all that v6 traffic to cgnat. v6 traffic is managed with stateless routing; cgnat is stateful and costly.
There are many lessons that can be learned, but v4 only is not the future. v6 only might never happen... people are going to keep running old software in emulation that will never support v6... But global routability of v4 will likely end one day. And I'd suspect the tail of the migration will be much shorter than the head was.
> At this point it would be best to recognize the sunk cost and give up on the migration.
That's a pretty wild thing to say in the comment section of an article about v6 reaching 50% eyeballs-side deployment.
If that’s not a failure I hate to see what is.
How would several billion smartphones be able to connect to the Internet without IPv6?
There isn't enough RFC 1918 (or 100.64.0.0/10) space for IPv4-only to be practical: Comcast—not even mobile—went to IPv6 because running their TR-069 management over multiple 10/8 became untenable.
IPv6 is making all sorts of things possible without most people realizing it.
And how would they have gotten first-hop connectivity without IPv6?
Comcast added IPv6 many years ago on their wired ISP side because they ran out of IPv4 for TR-069 management, and they had way fewer subscribers (at least at the time) than many mobile telcos.
And that half of the Internet is also some of the most bandwidth intensive stuff: Youtube, Netflix, Instagram. The CG-NAT hardware costs of streaming would be huge.
No reason you can’t carry IPv4 over any protocol you want. Multi tennant vxlans can carry whatever you want over your base network. Maybe an IPv6 underlay makes sense there, doesn’t really matter
I think the future is bright and most problems will be solved by 2040, and almost all by 2050.
Think about the migration plan, and nearly every positive force to move to ipv6 has been exhausted. Routing hardware, consumer hardware, server hardware & software all have the capability. Mobile deployments were a big driver of ipv6, and that didn’t reach the level of adoption expected. Now hosting providers are charging for ipv4 addresses, and it’s not having a measurable impact.
Most migrations start to hit the hockey stick well before this stage, and the taper occurs around 95%+ when outlier hardware or legacy devices are the last remnants. We are not seeing a pattern like that here.
With AI companies using botnets ("residential proxies") for scraping, they're probably going to be in the 50% that doesn't use IPv6.
I also have built cloud infrastructure for multiple SaaS providers with tens of thousands of customers over the past decade. Only one customer I’m aware of has ever even requested IPv6 support. And if customers aren’t asking for it, my employers have never been interested in the full network re-architecture required to truly support it internally.
There are still several basic services you can’t run IPv6-only in AWS, and a handful of AWS service features that don’t support it at all.
As a sysadmin for decades now, I’ve always found IPv6 to be overengineered and in many ways completely ridiculous. But I’d love to be supporting it in everything I do. Only I still can’t, even after 20+ years of being lectured about it; even after complete IPv4 exhaustion has been reached. I don’t think we’re ever going to turn IPv4 off. At best it will be progressively hidden, even from technical users. And folks like me will just have to keep building workarounds to patch the holes where IPv6 still doesn’t work.
Most software continues to have horrible IPv6 support and documentation making it look more complicated, but the actual protocol is considerably simpler than IPv4. For example:
1. An IPv4 packet header is variable-length, and the checksum must be recalculated by every router because the TTL is included in the checksum. Whereas an IPv6 packet header is fixed-length and has no checksum.
2. NAT is effectively required with IPv4, but it makes everything much more complicated, since it means that most computers don't even know their "real" IP address, it makes peer-to-peer networking very challenging, and it's tricky for routers to implement. Whereas with IPv6, no NAT is required.
3. Any router along the network path is allowed to fragment an IPv4 packet, and is in fact required to if its MTU is smaller than the packet's size. Whereas only the originating node is allowed to fragment an IPv6 packet.
4. To acquire an IPv4 address, both clients and routers must implement DHCP, which is a fairly complicated protocol, and both clients and routers must remember the list of assigned addresses. Whereas with IPv6, the client can just choose a random address (via SLAAC) and then start using it immediately.
5. IPv6 multicast is considerably simpler than IPv4 multicast, and NDP (v6) is considerably simpler than ARP (v4).
Despite all this, I agree with you that setting up IPv6 networking is harder than setting up IPv4 networking, but this is more of a software problem than a protocol problem.
3 well you can set the dont fragment bit at a client side or a router can drop the packet. These are choices. If a 1500 byte IPv6 packet arrives on a router with an 1100 byte next hop, does it just drop? Or send back a fragmentation needed icmp? How is that different from setting a “don’t fragment” option on a router.
4 isn’t created from a security or management point of view either. And v4 has the 169.254 range for this purpose. I guess the lack of router advertisement is the primary difference. And the operational expectations.
5a I’m not sure about. My main experience with multicast is pim-sm on v4. SSM v4 multicast however seems simple, and while I don’t use it as I have kit that’s too old for it is v6 really easier than v4/ssm/igmp3?
As for arp, I don’t see any real complexity with it as a network operator, but maybe that’s because I’m used to it. Perhaps it’s easier to implement nd rather than arp, but given almost every v6 deployment for the last 30 years is dual stack all it does is increase complexity.
Yup [0].
> How is that different from setting a “don’t fragment” option on a router.
It's the exact same, of course with the difference that it's the default and that nothing needs to support packets with the “don’t fragment” option disabled (since it's mandatory).
> And v4 has the 169.254 range for this purpose.
Sure, but seeing 169.254.x.x usually means that something is broken, while seeing IPv6 link-local address is perfectly normal.
> As for arp, I don’t see any real complexity with it as a network operator, but maybe that’s because I’m used to it.
Well it's part of the reason why 802.11 tries so hard to pretend that it's Ethernet, and I've seen ARP storms a few times but never any NDP storms.
> but given almost every v6 deployment for the last 30 years is dual stack all it does is increase complexity.
Yeah, IPv6 is great, but dual-stack is fairly annoying, and given that IPv4 is the older protocol and still essentially mandatory, I definitely get why people dislike IPv6 (even when it's really IPv4 that's the problem).
[0]: https://en.wikipedia.org/wiki/Path_MTU_Discovery
ARP is a special protocol implemented on the data link layer, while NDP is just another type of ICMPv6 packet.
> which creates a recursive chicken and egg situation
I believe that NDP mostly uses the special ff02::/16 link-local multicast addresses [0], which don't require any configuration to use.
[0]: https://www.iana.org/assignments/ipv6-multicast-addresses/ip...
I personally found that the features I interacted with were useful (SLAAC, address size, router advertisements, ...) and the changes made it cleaner (removal of broadcast for multicast, removal of fragmentation fields, ...).
"But other than that, Ms. Lincoln, how was the play?"
I am still sometimes using Google Search. First results are now almost always videos on youtube, aka self-promo. These videos are in 99.9% of the search results I use, totally useless and worthless. Even searching on youtube has recently gotten worse. It is also crap now. I know that because I bookmark various videos, and I can not find older videos anymore either. I can eliminate some results I don't care via ublock origin hero-blocking this Google garbage, but I really think we should no longer allow this de-facto monopoly to worsen the global situation any longer. The USA is protecting these gangsters - it is time to have true legislation that gets rid of that mafia bloc that is Google.
New regex: IP(any collection of numbers and dots).
Now we have infinite IP address possibilities and no one controls the space.
Done.
If so, that is incorrect. They use the binary values. The actual difference between IPv4 and IPv6 is that IPv6 uses 128-bit addresses, not 32. So you can devise whatever human-readable abstraction you like, it won't change how networking actually operates.
Chips can be made that dwarf that limitation, instead we’re stuck with this decade old nonsense to “work around” again.
Flip flopping between “the code needs it” and “the chips need it”.
If you can process 512 then you get access to those, else you don’t.
Let the free market decide where it’s comfortable like it did with wireless security.
Free market decides where it lands.
If there’s nothing of value at 512, it’ll naturally flop.
Sure Gmail has ipv6 enabled and routable ip6 MX. but sending to those addresses is often rejected and forced to retry over ipv4.
Don’t get me started on gh
They added those new addresses that can store more information.. but this requires a rewrite of old software to make it work.
If they used the old >bolting on top< method by extending ip4 from 4 octets to 8 (or more) octets, then old software could be extended much easier too / probably addresses could be simply mechanically translated too, so ancient software can work.
In every fucking IPv6 thread this "just add more addresses" idea comes up. There is no "just" in expanding the address space:
"""
Whether you expand the address size to 33, 64 or 128 bits, all IPv4 implementations will discard the packets. So it's a matter of mathematical and physical fact that to expand the address size, you must change the protocol, and that means two things immediately:
1. You have to change the version number.
2. You have to add new code to handle the new version.
Furthermore, you don't want to split the Internet in two, so you must design a method of interworking between the old version and the new version. Annoyingly, you need to do that in a way that can be done completely in machines that know about the new version, because other machines don't know anything at all about the new version, by definition. So,
3. You need a coexistence technique so that updated systems, with the new protocol, can connect to old systems that know nothing of the new protocol.
Two minutes of thought show that this third requirement has only two solutions:
(3A) Dual stack, in which the new machines speak both the old (IPv4) and new (IPng) protocol.
(3B) Translation, in which something translates addresses between the old and new protocols.
This has been known for more than 30 years [RFC1671], although people still sometimes try to deny it.
"""
* https://github.com/becarpenter/book6/blob/main/01.%20Introdu...
Any IPv4+ idea that "just" adds more address bits will same issues we've faced with IPv6.
Like I own 8.8.8.8. You want to add more bits, fine, I'm 8.8.8.8.0.0.0.0 now. If anyone switches to the new thing, they know where to find me.
Yeah… from the above link:
"""
Incidentally, "IPv8" proponents often ask why IPv6 didn't simply stick some extra bits on the front of IPv4 addresses, instead of inventing a whole new format. Actually, we tried that: the "IPv4-Compatible IPv6 address" format was defined in [RFC3513] but deprecated by [RFC4291] because it turned out to be of no practical use for coexistence or transition. The related "IPv4-Mapped IPv6 address" format is still valid and has a role in the POSIX socket API. Mappings of this kind also figured in the moderately successful coexistence technologies known as 6to4 [RFC3056, RFC3068] and Teredo [RFC4380], which have now been overtaken by events.
"""
* https://github.com/becarpenter/book6/blob/main/01.%20Introdu...
The people who created IPv6 weren't stupid: if you think you've thought up of a new idea, you probably haven't. Your "new idea" is either in the exact same situation as IPv6 or it was actually attempted and ended up being discarded.
and
> 7. give every device its own public IP by default.
Both of these are optional. Don’t want them? Don’t use them - if you don’t configure them, it won’t happen.
> 6. make routers accept inbound connections by default
That’s not a new feature with v6.
> Like I own 8.8.8.8. You want to add more bits, fine, I'm 8.8.8.8.0.0.0.0 now. If anyone switches to the new thing, they know where to find me.
Now you (and everything in between) have to be able to handle packets addressed to 8.8.8.8 and 8.8.8.8.0.0.0.0, so you’ve done point 4 without knowing it.
The problem is that you have to deploy it. You have to handle the bigger IP space safely, you have to assign the IPs, add DNS records, routing, etc. All this is work and the pressure is low. NAT has mostly taken that away.
Nothing would have saved us from that. There is no way to expand the number of addresses from IPv4 to more than 32 bits apart from a new protocol. There would always be software and infra changes. The server still needs to be changed to a new IPv4+ address, the client needs a new address, there needs to be internet routing for that address.
There were of course changes that were more than just a bigger address space. But I think that if you have to make software changes anyways you could also add some improvements. SLAAC is pretty nice (you can use DHCPv6 if you don't like it). Removing Broadcast is a good idea. Fixed header sizes are an improvement. There is a lot in IPv6 that are really smart ideas. None if these changes are the reason why it hasn't been fully adopted yet.
Had the original plan been simply "extend address space" instead of "extend address space and while we are at it revamp and rewrite every part of the whole scheme including assignment, discovery, and everything else we see wrong with ipv4"; we would be in a much better place.
Adding extra address bytes would of course require new changes across the internet, but that change would be easier to swallow compared to having to rip and replace large swaths of processes to make ipv6 work because of all of the other changes that came with ipv6.
Also, the stupid idea of turning addresses to hex as the default, and more specifically the dumb :: shortening methods really made it confusing for everyone and didnt help at all in the efforts.
Prior to that programs used gethostbyname() etc, which only works with ipv4.
The problems, as I observe, are more in network infrastructure, routing, etc.
The IPv4 protocol has 4 octets each for source and destination address. Period. If you change that, your packets won't work on any IPv4 routers or software any more.
If you want to write IPv6 addresses as numbers separated by dots no one's stopping you but I don't see how it's better. They switched to hex because the old format was too long.
42.0.20.80.64.1.192.15.0.0.0.0.0.0.0.113
is easier to remember than
2a00:1450:4001:c0f::71 (or 2a00:1450:4001:0c0f:0000:0000:0000:0071)
It does not work like that. Put extra octets where exactly? Where would a hardware router put the extra bytes? Where would software with 32 bit buffers?
You would still need to replace all of the software and hardware and have the exact same problem.
Every client, server, and router, every device that uses the address needs to understand where it comes from and where it's going. That means all the software needs to understand the protocol. So instead of having incompatible implementations live within the same protocol and make a lot of chaos it's better to have a new separate protocol that can be implemented gradually. Now the distinction is between having or not having IPv6 connectivity and my package on IPv4 goes no where because it hit a router that doesn't understand the extension.
It's a standard Asus router but it's given me a lot of ire. I hate to say it but it's never a problem when I install windows on the same machines
(I'm currently in the process of trying to completely remove windows from my life)
IIRC, a workaround was to prevent Linux from setting this field, or force-reset it on every outbound packet using netfilter.
It's usually bad configuration done by the router vendors. It doesn't mean IPv6 is bad.
Another such example is SELinux, which would have prevented so many vulnerabilities from being exploited, but whose poor UX also caused everyone to disable it at install time.
SELinux's UX was significantly improved many years later, but already too late to change ingrained opinions. There are a lot of ingrained opinions about IPv6 too.
IPv6-only ISPs might hit other issues, though. They have to bridge to IPv4 somewhere.
in what way?
And even for system services, you can disable SELinux for one service (permissive mode) and leave it enabled for the rest.
This has been the case for more than 10 years, but the damage was done. It's now very hard for users even considering learning the basics (which are not hard).
I wish they had just made an IPv5 though. With e.g. 6 bytes instead of 4. 65535 times the current internet should be plenty. I feel like IPv6 is overengineered and I'm glad it didn't take off yet. I like being able to memorise IP addresses, it really helps testing.
If I ever do switch it on on my home network I'll probably use NAT on the router so I can still keep it exclusively IPv4 internally on the network.
I first learned about IPv6 when I was studying (1993) and I already felt like it was an overengineered monstrosity back then. They were campaigning like it would be the internet next year. Well that aged well, lol. That's now 33 years ago.
I truly think that if they had made it simpler and more IPv4 compatible we would have been moved over in 2-3 years. But no they had to keep supporting this thing. Well, at this point I'm going to avoid playing ball as long as I can.
And as for memorization: do you actually memorize MAC addresses for your interfaces? The answer is no, you don't, becase ARP handles all that for you. Well, for IPv6, DNS, mDNS and so on handles all that for both your IPv4 and your IPv6 addresses - or should, if you know what you are doing, as memorizing IPs doesn't really scale beyond a few dozen machines.
Yes, IPv6 is overengineered, but it gets the pain of having larger addresses in the packet done once and for all - the odds of needing more than 128 bits in the rest of human history are very small indeed. And if something radically new needs to replace the current IPv6 architecture, which is much more likely, the extra address bits are already there; only 2000::/3 is assigned for public use so far, and the new addresses would fit in the current IPv6 packet format already.
DNS and mDNS don't "just work". You don't need but probably really want HA for DNS which is overkill for a homelab user, and you really want a fixed address for that DNS, because who wants to fix issues when you can't even address your services, and you really want your routers to have fixed addresses for the same reasons; you need VLAN and/or Avahi reflecting for mDNS, and if you need firewalling on your LAN, have fun dealing with the fact that mDNS clients prefer GUAs, then IPv4s, then ULAs in that order, by RFC rule, and managing GUAs sensibly when your ISP keeps changing your prefix -- well, IPv6 is almost 30 years old and home/SMB equipment still can't handle that reliably or flexibly, if it even lets you do anything besides assign /64s, and there's nothing stopping your ISP from saying "here just have a single /64, sorry if you wanted to actually use IPv6 for anything clever like having multiple subnets, who would ever want that?" So you say "I'll just use DHCPv6" and it turns out that DHCPv6 kind of sucks and it also turns out many devices don't support that by default or at all, including every single Android and Chrome device, for starters.
IPv6 is full of these design issues where you have a lot of things that are supposed to Just Work, Look It's So Much Simpler Than IPv4, and look at all these address bytes (excuse us while we take 64 of them away for no reason), except you discover that nothing Just Works with anything else in mildly nontrivial cases. You end up on a yak shave only to discover no yak underneath, and you end up just having a broken network while standing in a pile of yak hair. The whole story above is just one example. IPv6 is a migraine in RFC form, and if it weren't that I accidentally bought some expensive IOT devices that are IPv6-only, I'd be happy to never touch it. At this point, it would have been a better time-money tradeoff to have thrown those in the trash as soon as I had seen the problem.
And the problem seems to be solving itself as the world is turning its back on globalism. China and North Korea already have separated themselves. Iran too. China still uses the same address space but it's not like there's open connectivity with the rest of the world. We'll probably cut off Russia at some point completely as part of some sanction (they've been preparing for that for years), and Europe will break with America if things continue. We'll just have interoperability at a few controlled border points then, like China already does with its great firewall. It'll be easy to do some address translation then.
Ps that's not something I'm necessarily happy about but I do see this trend emerging of every region trying to wall itself off.
People also thought that 4 byte wide IPv4 Adresses would be large enough. It's really hard to estimate how much you will need. And because numbers are effectively a free resource, it is better to overestimate.
IPv6 also gives you shortcuts to write addresses. You can abbreviate the longest run of zeroes with `::` and leading zeroes within a hextet can be omitted. This makes IPv6 address notation elastic.
But it's not free, after all every packet carries this burden. I know about the annotation but it also makes it very difficult to parse.
This is even easier with IPv6. At work we have a bunch of test devices, and you calculate the IPv6 from the device's serial number. Simple as that, no memorization at all.
Or if you're feeling playful, <prefix>::b0d, <prefix>::bed, <prefix>::dad, <prefix>::b1d...
When I'm at a different location, the biggest problem is usually figuring out if they use 192.168.0 or 192.168.1 :)
192.168/16 is a private IPv4 subnet (https://en.wikipedia.org/wiki/Private_network#IPv4) and the equivalent for IPv6 is the fd00/8 subnet (RFC 4193).
In what metrics? IPv6 is more simple to implement than IPv4. In Linux 7.1.1 IPv4 is 84kLOC, IPv6 is 59kLOC.