Hacker News Reader

Comment by dathinab | Hacker News Reader

Please no.

The amount of not fully compatible software with potential security implications this produces is outright insane.

Is IPv4 spare: Yes.

But there is NAT or IPv6.

So the only reason for that IMHO high risk proposal is companies not getting their shit together in adapting a standard which was introduced ~25!! years ago. (I'm looking at you cloud provider without proper IPv6 support.)

View on HN

Are cloud providers really an issue here? If you as a service provider want IPv6 and your hosting provider doesn't support it, you can relatively easily switch. But if your users don't have IPv6 (and many don't), you're basically screwed - you can't change your users' ISPs and they certainly won't either.

Also, what would be the security implications of this? The best I can come up with is networks that treat these addresses as internal and services inside trust them by default, but such networks wouldn't allow this traffic from the WAN side anyway, right?

> if your users don't have IPv6 (and many don't), you're basically screwed

Not quite, all you need is to make sure the proxy/CDN is dual stack, like what this IPv6-only hosting service did: https://www.mythic-beasts.com/order/rpi/

Cloudflare, for example, does this for free: https://community.cloudflare.com/t/proxy-ipv4-visitors-to-ip...

You're making a lot of assumptions about people's stacks. Not everyone is running behind a third-party proxy. There are many reasons not to do so and many aren't up for debate (like regulation compliance). And that's ignoring the fact that most protocols aren't like HTTP and don't know a thing about hostnames, so the only way for a "gateway" to exists is using different ports - something that isn't always possible and may require a lot of work to adapt to.

I only said this "proxy" need to be dual-stacked. This "proxy" or "gateway" or whatever refers to the public facing part of the their stack -- if they don't have a public facing part then they don't have this problem.

The "proxy" can outsourced or manged on-perm and does not have to be shared with anyone. This "proxy" may or may not be a L7 proxy that only understands HTTP.

I run my own proxy for HTTP(S), SSH, SMTP and DNS. It took me about 1 hr to set it up. Only 4 IPv4 address are used for my whole stack, the rest are all IPv6-only.

Reply on news.ycombinator.com