Hacker News Reader

Comment by Sami_Lehtinen | Hacker News Reader

Hacker News ... no IPv6.

HN is hosted behind CloudFlare, too, so this should be as simple as flipping a switch...

I've no direct knowledge at all into this, but... for my own forums I found that most of the comment spam tools I was using presumed IPv4. This was especially true of "spam from same network" type logic that these tools were using.

For example only: Stop Forum Spam only recently began testing their work for IPv6: https://www.stopforumspam.com/forum/viewtopic.php?pid=44371

I re-wrote my comment spam solution (not specifically for the comment spam problem, was doing some other stuff) and have long since enabled IPv6, but it's worth bearing in mind that network is one thing, sometimes what holds someone back from flipping the switch are the tools we use.

CloudFlare does have a pretty compelling compatibility layer just for that purpose:

https://support.cloudflare.com/hc/en-us/articles/202494830-P...

Thanks for letting me know :)

Doing blacklisting of IPv6 addresses is actually quite hard, because you can't know how network owners lay out their addresses. Some networks (especially VPS providers) will use one /64 (or so) per datacenter, while other will give out a /64 for individual users.

So when 2001:db8:a1:b2::c:3 has sent spam to you, you can't know if you should block the network 2001:db8:a1:b2::/64 or the specific address 2001:db8:a1:b2::c:3. Some blacklists (carelessly) take the former approach and block entire datacenters.

Honestly, if an entire datacenter is using a single /64 it sounds like they are doing something wrong. It's as easy to get a /48 with 65k individual /64 (one for each customer) as it is to get a single /64

Reply on news.ycombinator.com