Hacker News Reader

> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now.

Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.)

> - In general latency is not affected by header lengths these days. In some cases, networks are prioritising IPv6 for the opposite affect. In other cases ISPs have dropped their entire IPv6 support without noticing for quite some time. sigh

I wondered if this may be the case; I may need to rerun some tests.

> - The addressing scheme in use should have nothing to do with your privacy. Yes NAT does accidentally hide you a little bit. However I can fingerprint your browser instead, for example. I'll trade easy SIP n RTP over NAT any day.

A website I navigate to may, but how will the carrier fingerprint my browser?

All in all, it seems like we are talking about very different threat models to privacy/security. You are worried about the likes of Google and Facebook profiling you, whereas I am worried about the likes of $intellectualpropertymonopolist sending me a $20k bill for identifying me in a torrent, or experiencing a nasty surprise at $nationalborder (or at home, [1]!) for something I said on an internet forum.

(This does not seem like an abstract or overblown threat to me; I've seen 2 out of the 3 things above happen to friends and even one schoolmate more than 2 times.)

[1] https://www.theguardian.com/uk/2012/nov/12/teenager-arrested...

Most of the things I do with memorised addresses have nothing to do with the browser or HTTP. (Mind you, though, the moment a browser won't let me access a bare IP, I'm switching away from that browser.)

Me too. Wireshark, nmap and co are in regular use in my job. All browsers are playing nanny, more and more apart from the likes of Links (which I also use quite often). A lack of https is already flagged and I suspect that things will get worse in this regard. Links2 has saved my bacon many times in the past so you may enjoy it 8)

You are worried about the likes of Google and Facebook profiling you

No mate. I'm CREST accredited: I'm not worried about G and F profiling me - I know they do. However I also know that my choice of addressing scheme does not affect my privacy whatsoever. A carrier can use metadata to derive loads of facts about your usage even if you are connecting to the oher end over say https. NAT will save you from some silly firewall screw ups but not much else. A VPN can help but is no silver bullet either. If I really put my mind to it I could probably make myself near enough anonymous with enough use of proxies, VPNs and TOR but I'm not too sure about that!

I too am from the UK and have seen silly overreactions such as your [1] link. However, this is the world we have nowadays and in our case we have a horrific level of CCTV pointed at us as well as some pretty impressive levels of IP traffic mining. We also have the rather unpleasant RIP Act and a few others to belie our supposed liberal way of life in the UK. You do have to be careful what you say nowadays, within reason.

Well, my assumption was always that in a scenario such as: ISP makes me share my public-facing IP with 15 randos -> I get on a torrent for Sony Corporate Secrets [full pack] [2018].zip -> Sony's legal department connects a honeypot and harvests all IPs it sees on it and sends out subpoenae to identify everyone who is in a friendly jurisdiction, the circumstance that I'm NATted by my provider will actually do nontrivial work in reducing the probability that I am ultimately identified in a legally actionable way (especially if it were to take Sony a while to process its data). Is this not accurate?

Your ISP would usually have port mapping logs.

GDPR in theory means that we should be able to tell exactly what data ISPs have about us.

But surely you can visit a McDonald's car park, run tor-browser and download whatever that Sony thing was without being traced.

> - If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit. Browsers will keep on enforcing SSL/TLS more and more until the point where typing in an IP address into the URL bar will be as painful as using the web GUI for say an elderly HP switch is right now.

This heavily reminded me of the good old Night Watch essay[1]. You can punch DNS names into the address bar on a browser, because someone out there traded normal sleep schedules for the tremendous opportunity to think about BGP trees, netmasks, and other exciting arcana.

[1] https://www.usenix.org/system/files/1311_05-08_mickens.pdf

> If you go around memorising addresses then you are doing IT wrong in general. So many things depend on DNS (not just A records) that punching in IPs by default is a bad habit.

If you are debugging network connectivity, then I have a tough time believing it’s possible without typing in a few network addresses.

>- If you go around memorising addresses then you are doing IT wrong in general.

Because I'll surely have an TLD for my local nginx and for my home router...

This is easily solved with mDNS/Avahi. I had the same gripe years ago, now my hosts advertise their own records or even on behalf of others without running a NS.

Just use home.arpa from https://tools.ietf.org/html/rfc8375 with a custom DNS server or host file. Or one of the many dynamic DNS systems.

Sure, because a custom DNS server is easy to set up.

Depends on your skill set. If you're ok with *nix, then PowerDNS is pretty simple to work with:

https://github.com/PowerDNS/pdns

It's also fairly complete, used in production by some pretty big ISPs.

For a light weight approach instead, Dnsmasq is good:

http://www.thekelleys.org.uk/dnsmasq/doc.html

It's what most home routers (and lots of other stuff) embed. :)

Ok, fair enough. It’s fairly simple to set up.

It’s just a bit of a pain to maintain if the only thing you care about is connecting to server nr 192.168.0.x

I could certainly do it, but there’s 5 services in my house I’d care to connect to, and remembering 1-5 is just as easy as giving them all names. The marginal gains are very low.

Oh, I very much agree. For very small local networks in a flat address space, manually remembering stuff works ok.

Personally I tend to throw the more stable IP addresses in /etc/hosts, as that's simple too. :)

It's actually pretty easy. I was able to set one up when I was a teenager, almost 25 years ago, in the early days of the commercial Internet. It is even simpler now.

Ever heard of dnsmasq? Comes with many home routers. Puts a dns entry for each host that gets it's ip address via dhcp, plus your static mappings.

Yes, it is.

.local?

Using .local in DNS is a violation of RFC6762. You really ought not to do this.

It's also too long for something you type a lot. I use .hm.

You can buy a DNS domain for a few quid per year or you can use a dynamic DNS service such as freeDNS for err free.

If you go around exposing services on the internet then you should know how to do it properly. If you can get a name on it then you can put a SSL certificate on it (cheers Lets Encrypt).

If you have a SSL cert on it then you can be fairly sure you are talking to your gear and not a MitM if you take other precautions.

I absolutely do have a LE SSL cert for my home router and all my home web sites. pfSense has a ACME and dynamic DNS client for many services and HA Proxy built in. What more could you want!

With IPv4 you don't HAVE to buy a domain for your local network. You can do just fine with IP addresses. With IPv6, you probably will need to just to make it sane. That adds a whole new step, and a complex one that most people (general public) won't know how to do.

To be fair, most of the general public doesn't know what an ip address is.

I'm in the group that you're speaking of—I have a personal server set up that I can log into remotely, but the prospect of setting up a domain and TLS is very daunting. But, I don't think people like me are all that common.