Hacker News Reader

Comment by marcosdumay | Hacker News Reader

> The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections.

And that's how we can't transfer large files from one computer to another, and why audio and video calls over the internet are only done through well founded companies, so there's nearly no competition.

View on HN

If I give you the IPv6 address to my desktop computer, you still can't transfer a large file to me or try to video call me.

The reason is I haven't configured my firewall to let any of those things through. IPv6 or IPv4 NAT is in the same boat.

I think the point is that NAT is not necessary in IPv6, whereas it is in IPv4 due to address shortage. You can still have a firewall without NAT, btw.

Yes. What I'm trying to say is that I think embracing NAT would have been a better choice than the IPv6 we ended up with.

You can still use NATs with ipv6, there's just not many reasons too, no?

Yeah that's like the worst of both worlds in a way.

Nobody has configured their firewalls, because those things don't exist. If they existed, your firewall would have come configured by default.

But if your computer had connectivity to the rest of the network, you could choose to disable protection on some port, and help bootstrap some software like those. Instead, with NAT, you can't.

You don't need a firewall; you just need not to be listening on a port. And if you want to receive a file on a port, you can … start listening on it.

I wish I could upvote this 1000 times. Most firewalls are just so much security theater cargo culting. NAT and universal firewalls have done immeasurable, and at this point practically irreversible, damage to network freedom and free software.

And exploits

Reply on news.ycombinator.com