https://mailman.nanog.org/pipermail/nanog/2021-November/2164...
I read that email and there's a serious tons of hand waving and 'dude, trust me.'
I am going to ignore "would be useful to a lot of people -- hundreds of millions of people who you may never know." There's no example use case of who the hundreds of millions of people might be, and how this proposal would benefit them. What are the benefits that the existing CG-NAT and ipv6 couldn't provide?
I am also going to ignore "one-line patches is almost risk-free." Sure if all the software in the world is only Linux/Windows/BSD TCP/IP stack and no one build anything on top of the stacks, then the patch would indeed be only 'one -line'.
What I really have a problem is 'simply include them in new releases of the various operating systems and router OS's that implement the Internet protocols.' I work for a _major_ hardware firewall company, and it is ridiculous the amount of effort we would put on our customers to upgrade their firmware. There are still hardware that run with 15 year old firmware (with all the accumulated CVEs). You are telling me it's easy to convince these people to upgrade their stuff? Are you serious??? 'People naturally upgrade their OS's every few years." Oh I guess we can ignore all the IoTs and middle-boxes on the interweb then.
"We have tested major routers, and none so far require software updates to enable most of these addresses." As mentioned I work for a firewall company. I just logged into a sample firewall under my control- yes the configuration is doable. But in enterprise, everything needs to be rigorously tested or else the sysadmin's not gonna touch it. The sysadmins are certainly not going to waste a few weeks of their lives testing things that might bring down their entire network, and would only benefit the select few who managed to grab ahold of the new IPs.
It's late at night and I don't want to continue. So here.
This whole IPv4 address mining thing is only relevant because updating is hard.
...if they use the Windows built-in SSL stack. For instance, Firefox has always used its own SSL stack (NSS) everywhere; and AFAIK, the last version of Firefox which was compatible with these systems already worked fine with TLS 1.2. The same for root certificates: Firefox uses its own CA roots (from NSS).
You have to consider it, it is still millions of devices potentially flooding the new addresses, causing major security holes in legacy networks and a lot of maintenance burden. It is a dream/ nightmare come true for support companies and contractors depending on who you support.
* Personally I think 240/4 is very reasonable since it was always reserved, 0/8 is doable but would require effort enough people might not want to do, and 127/8 is hardcoded in too many places and isn't doable. IPv6 is the future, but it isn't justified to make things now worse to make deployment faster (it won't be). IPv6 will win by default anyway.
Only including 240/4 and parts of the multicast space perhaps in the unicast extension would most likely minimize the impact to potential legacy use-cases and setups and be the 80/20 kind of compromise.
In practice, VMs on PCs for non-technical personnel are a major pain. All kinds of stuff breaks in curious ways e.g. the pass-through of the protocol or the specific interface might not work reliably, there is a custom setup to support, some pop-up causes the windows to overlap in a way that makes it hard for the medical personnel to get going quickly yadayada. Yes, you can do snapshots and other stuff.
Also, the technicians setting this up are usually not trained in IT DevOps/ broad sysadmin tasks so much as in the setup of special medical devices. They also tend to cost a small fortune, because again, they are certified to work on those machines costing on the order $100000 when used and multiple that when new and there might be a handful of them for the whole region. In this particular case, as a patient you also don't want more x-rays than you absolutely need to get. Doing a panoramic x-ray multiple times because e.g. of some software failure could breach some daily/ monthly whatever irradiation limits so you would need another appointment etc. Not something you want to go through as a responsible doctor because of some custom setup.
I get it, I am also enthusiastic about Windows never touching bare metal if at all possible for long running professional stuff precisely because of snapshots and e.g. the possibility to cut the network remotely and bring it back up if needed. But I also come in contact with non-technical folks that don't want to risk stuff, deal with more stuff than they already deal with etc. I respect that, it is an approach that works for them.
Besides, since XP doesn't install IPv6 support by default (and these people never update), we should ditch IPv6 too?
No one wants to be bound by 20 year old never updated installs of ancient OSs, so let's not.
I think that if Microsoft ever does decide to support this extension there'll be a patch for all supported versions including via ESU - just like all supported relevant MS products got a TLS 1.2 patch, even the embedded Windows XP (POSReady 2009) got a TLS 1.2 patch.
CG-NAT is nasty: you can't be reached from the Internet and (this is the more important thing) IP-based rate limiting or activity tracking (think of stuff like Wikipedia and anonymous edits) don't work any more.
IPv6 adoption has been ... sluggish by any measure, I remember playing around with sixxs ~2010ish, and there still are providers that don't hand out native IPv6!
There's still a lot of Linux' that can't handle IPv6 handed out by their ISP as well, for example systemd-networkd got working PD support that's at best a few years old (so only in the latest LTS releases of Ubuntu for ex.).
I think we're now at the hardest 20% to fix and deploy, that 20% includes humans as well.
But it would be useful to a lot of people -- hundreds of millions of people who you may never know.
Microsoft Windows is the biggest laggard; they drop any packet whose destination OR SOURCE address is in 240/4.
We can assume he's not talking about mobile users: they can and usually do get IPv6 addresses. We can assume he's not talking about all the endless servers and so on talking to one another, those aren't "people." He's talking about hundreds of millions of PC users.
Hundreds of millions of PC users, except Windows users. How is that going to work?
It'd be fun and ironic to pick on Microsoft for adhering too closely to established open standards, but unless I'm missing something here, they've got a veto over implementation of these ideas.