Hacker News Reader

Comment by magicalhippo | Hacker News Reader

If I give you the IPv6 address to my desktop computer, you still can't transfer a large file to me or try to video call me.

The reason is I haven't configured my firewall to let any of those things through. IPv6 or IPv4 NAT is in the same boat.

View on HN

Nobody has configured their firewalls, because those things don't exist. If they existed, your firewall would have come configured by default.

But if your computer had connectivity to the rest of the network, you could choose to disable protection on some port, and help bootstrap some software like those. Instead, with NAT, you can't.

You don't need a firewall; you just need not to be listening on a port. And if you want to receive a file on a port, you can … start listening on it.

I wish I could upvote this 1000 times. Most firewalls are just so much security theater cargo culting. NAT and universal firewalls have done immeasurable, and at this point practically irreversible, damage to network freedom and free software.

And exploits

I think the point is that NAT is not necessary in IPv6, whereas it is in IPv4 due to address shortage. You can still have a firewall without NAT, btw.

Yes. What I'm trying to say is that I think embracing NAT would have been a better choice than the IPv6 we ended up with.

You can still use NATs with ipv6, there's just not many reasons too, no?

Yeah that's like the worst of both worlds in a way.

Reply on news.ycombinator.com