Hacker News Reader

Comment by ayushnix | Hacker News Reader

> Cannibalising reserved address space like 127.0.0.0/8 will only get the IPv4 internet so far. Eventually, the scarcity of IP addresses will make IPv6 the more business-conscious choice for many applications

The decision to consume loopback address space has made me even more cynical about IPv6 ever becoming mainstream within my lifetime. Using IPv4 is like using fossil fuels — we know that they are going to run out/cause us harm and yet we keep using them. I don't know of a single ISP in my country which offers functional IPv6. All they do is offer CGNAT IPv4 addresses, which offers a crippled experience of the Internet.

View on HN

This will be controversial, but: I think the EU should set a deadline for IPv6 adoption to ISPs and impose fines afterwards. They seem to be legislating all kinds of crazy things (like type C connectors), so it's quite within the realm of possibility, and unlike some other things, there really isn't a way they can screw this up.

Rationale: It's in the custoners' best interest to have unique publically routable addresses and without IPv6 we'll be stuck with CGNAT. The providers don't care, because rollout is expensive. So, for the good of the customer, legislation with fines is needed to better align the financial incentives.

If it is good for a customer then the provider will care. The customer will switch ISPs to those that support IPv6. Then the IPv4-only providers will get less money.

Sure, if you ask an economist. But here in the real world, switching ISPs is hard (fees, lack of competition, replacing gear...) and the benefit of IPv6 isn't apparent yet to most people. By the time it becomes, it'll be too late and nobody will have it yet, so there won't be anywhere to switch anyways.

There's a reason we have consumer protection regulation and much of it came as a result of situations where evryone thought, as you do, that the market/competition would solve the problem, but of course it didn't. That only happens in ideal markets where switching providers is trivial, the consumer is equally informed about all of them and the providers (and perhaps customers too) have equal economic power.

> But here in the real world...

Your starting point was that any ISP who doesn't implement your preferred technical standard should be fined. With a disregard for whether IPv6 makes sense for them or their customers. You might detect a little pushback here on the idea that your ideas are real world. Laissez faire is a very practical approach.

> By the time it becomes, it'll be too late and nobody will have it yet, so there won't be anywhere to switch anyways.

A crisis so terrible I can't even imagine it. Nobody outside some fairly obscure tech circles would even notice.

Imagine if they'd taken this approach rolling out IPv4 and weren't fast enough to change the legislation. The rollout of IPv6 would look really hard if IPv4 was a legislated requirement. The EU just isn't a competent technical standards body, and it has no business trying to be one because a couple of tech types like IPv6.

> That only happens in ideal markets where switching providers is trivial...

I switched providers to get IPv6 support. It was pretty trivial.

> Your starting point was that any ISP who doesn't implement your preferred technical standard should be fined.

"my preferred standard" == the only alternative to the current collapsing standard that has been agreed upon by industry leaders for some 20 years now.

> With a disregard for whether IPv6 makes sense for them or their customers.

IPv6 can't "not make sense", it can only "not be necessary yet".

> A crisis so terrible I can't even imagine it. Nobody outside some fairly obscure tech circles would even notice.

What, service costs going through the roof because the ISP now has to buy IPv4 addresses? Getting IP blocked from sites because the address you share with half the town got reported for spam? Not being able to access IPv6-only sites from smaller providers who can't afford to lease IPv4 addresses? And only then the ISPs start investing in it, which will take a few years to finish, all the while your service is shit? Pretty obscure, yeah.

> I switched providers to get IPv6 support. It was pretty trivial.

I've been trying to for several years and have not been able to for a multitude of reasons.

>What, service costs going through the roof because the ISP now has to buy IPv4 addresses?

If it was profitable, the ISP would do it and pocket the now unnecessary service costs.

>Getting IP blocked from sites because the address you share with half the town got reported for spam?

99.9% people don't want to run their own SMTP server. It's an ultra-niche use case ISP don't care about.

>Not being able to access IPv6-only sites from smaller providers who can't afford to lease IPv4 addresses?

There aren't any.

Look, it's just an internet addressing protocol, not something that justifies legislation.

> If it was profitable, the ISP would do it and pocket the now unnecessary service costs.

This is another "if you ask an economist" situation. In the real world, people will happily spend more effort justifying not doing v6 and working around problems caused by being v4-only than would be needed to just do v6.

> 99.9% people don't want to run their own SMTP server. It's an ultra-niche use case ISP don't care about.

This misses the point. It only takes one person behind CGNAT to get the CGNAT source IPs on a spam list, at which point it affects everyone. Plus spam exists on the web too, it's not an SMTP-only thing.

> There aren't any.

Which is exactly why it's so important to be deploying v6: so there can be v6-only sites. Or rather, more than there are at the moment, because they do exist.

> Look, it's just an internet addressing protocol, not something that justifies legislation.

I've seen an argument that it's already covered by existing legislation: the refusal of large/old providers to support v6, which forces the use of v4 which small/new providers can't get enough of, is beginning to look rather a lot like an abuse of market position. That would make it an anti-trust issue, which definitely falls within the remit of government.

>This is another "if you ask an economist" situation. In the real world, people will happily spend more effort justifying not doing v6 and working around problems caused by being v4-only than would be needed to just do v6.

Yea, I don't like silly economism too, and I know half the jokes too. However, right now IPv4 addresses aren't so expensive. Sure, way more expensive than the 0 bucks they should cost, but not that expensive in the grand scheme of things.

Here's a very rough calculation: The cost of IPv4 will start to bite when getting the needed addresses costs more than a single engineer salary where one lives. If a one time address buy costs less, it's not something business would care much for, and anti-trust won't touch it.

I'm not smart enough to be able to forecast pricing, right now it's not there yet. Eventually the price will force every public network to IPv6, while many private networks will remain IPv4 forever.

> 99.9% people don't want to run their own SMTP server. It's an ultra-niche use case ISP don't care about. 99.9% of services you can get banned from aren't SMTP. There are many other services which you can be IP banned from.

> Look, it's just an internet addressing protocol, not something that justifies legislation. "Just an internet addressing protocol" kinda puts the entire internet to shame doesn't it? It's important that people can communicate on the internet, with IPv4 we decrease reliability and increase cost (in the long run) for everyone except those who sucked up as many addresses as possible early on.

But if we are to follow your reasoning:

A common charging port is just a port, doesn't require legislation

A standard protocol for troubleshooting your car is just a protocol, doesn't require legislation

* which brings benefits to billions of people but you don't agree with, doesn't require legislation

That one thing you agree with that probably isn't important for a lot of people, requires legislation.

Let's raise the standard and discuss why IPv6 is necessary or not and what implications it has for consumers.

IPv6 decreases privacy because you're not sharing an IP with half of town, which is bad. Even if you're randomizing v6 on the local subnet you're still in the same /64 so it's still relatively easy to track you.

P2P protocols actually work properly with IPv6 since machines can commmunicate directly with each other.

IPv6 is more complex to understand the addressing scheme in.

IPv6 isn't IPv4, so there's a learning curve.

IPv6 encourages decentralization.

IPv4 enourages centralization, because you can't get addresses anymore you can't start up new ISP's and we could call that anti-competetive. It also encourages proprietary solutions like cloudflared, or just hosting your stuff on AWS rather than in a colocated datacenter, because you can't get access to IP addresses.

We can't stack unlimited people on top of IPv4 either, there are only so many port numbers available. And NAT is just such a major PITA to work with.

> It also encourages proprietary solutions like cloudflared, or just hosting your stuff on AWS rather than in a colocated datacenter, because you can't get access to IP addresses.

Obtaining an IPv4 address is not an issue I ever had with hosting. People are using Cloudflare, Akamai or ELB because they are sick of script-kiddies buying a DDoS for 10$ an hour and extorting businesses for 1000$ and/or because they have customers from other continents complaining about load times.

And where are you hosting those services? A "megacorp" or a really old provider which sucked up enough v4 when it was easy?

What if I have a great software stack in the pipe ready to be colocation deployed somewhere and I want to run my own network with multiple transit providers to be sure I don't go down with either of them.

When that possibility is dead, as mentioned in other parts of the thread we're getting awfully close to an anticompetetive market.

Why should existing on the internet be a privilege for the richest of the rich? (Those who can afford to buy IP's/ISP's to fulfill their needs).

But yes, Cloudflare is a great way to protect your site from skiddie "booting". with ELB I'm not sure about pricing, might just prefer it to die for the "booter" duration if it's a personal site, if business.. Well there's hopefully $$$ to foot the AWS bill.

There are some services and sites that run IPv6-only. Some are for testing, sure, like this one: https://www.nebezi.cz/ some are because they are cheaper to run/ easier to setup e.g. some FreeBSD mirrors.

> 99.9% people don't want to run their own SMTP server. It's an ultra-niche use case ISP don't care about.

It's not SMTP. It's StopForumSpam and CloudFlare that you need to worry about.

Good luck switching providers to get IPv6 support. Unless you have true gigabit fiber, the only providers that don't have shit speeds without exorbitant expense (aka - Virgin Media) refuse to support IPv6.

>I switched providers to get IPv6 support. It was pretty trivial.

Your use case is not everyone's.

I was forced to change ISPs recently and didn't have a choice as to which one (which is another, unrelated, issue).

I did some research and the ISP in question does provide IPv6 support for some customers. However, the sales drones I spoke with claimed to not even know what IPv6 was, let alone whether or not it was available in my area.

I'd say that has more to do with the exorbitant fees they charge for static IPv4 addresses than anything else.

As such, it's not always "pretty trivial" to get IPv6 on your ISP link. I sure wish it was.

Edit: Clarified my prose.

Only for spherical customers in a vacuum. IPv6 is one of those things you can't expect the average customer to care about, even though it's ultimately important for them.

At least in the US, residential ISPs are not a real market, many places just have one option.

> The customer will switch ISPs to those that support IPv6.

That assumes it's possible to switch ISPs. Where I live, within the city bounds of the capital of my country, there's only two ISPs that can deliver broadband service and neither do IPv6 properly.

> It's in the custoners' best interest to have unique publically routable addresses and without IPv6 we'll be stuck with CGNAT.

This is absolutely not a given. IoT has drastically changed the equation on how good it is to have devices exposed to unsolicited ingress connections from the internet by default.

This is speaking from experience of enabling ipv6 at an ISP. We were rewarded with: - happy geeks

- anemic ipv6 usage

- a bunch of abuse reports and customer support hours wasted on people with poorly configured IoT (or just old computers with no recent patches).

There is a key difference between having IPv6 (good) and not having a firewall as default (bad). I guess if you have many customers that don't use provided-by-you CPE that can be an issue.

There's a function in my ISP-provided internet router/gateway that allows me to disallow incoming connection on ipv6 address.

I guess you should implement this too?

If my understanding is correct, it's equivalent to using -m state --state ESTABLISHED,RELATED -j ACCEPT in linux/iptables where -P DROP is the default input policy.

Basically you allow ipv6 tcp traffic only for tcp connections initiated from within.

We can either bury our heads in the sand, have a false sense of security behind CGNAT connections and keeping devices running without a firewall, commercialize IPv4 as much as possible to point of consuming loopback address spaces and make everything worse than it already is.

Or, we can move to IPv6. Yes, it might be painful for some people when they get their IoT devices hacked but at least it should spur change and make people realize that they can't just buy a toaster and connect it to the Internet.

Any decent router with IPv6 support sets up stateful v6 firewall rules blocking incoming connections and only allowing outgoing from your v6 subnet. Same as always like you say and most consumers won’t even notice a difference other than increased throughout.

> This is absolutely not a given. IoT has drastically changed the equation on how good it is to have devices exposed to unsolicited ingress connections from the internet by default.

That's why firewalls exist. And they work with IPv6.

My ISP gives out an IPv6 address to my Asus, which also picks up some prefixes for allocation via DHCP-PD. This causes my printer pick up an IPv6 address, but it is not accessible to the outside world.

Statefull firewalls still exist with IPv6, so by default connections from the general Internal cannot connect to your 'internal' systems. Hole punching still needs to be done with UPNP/PCP:

* http://upnp.org/specs/arch/UPnP-arch-AnnexAIPv6-v1.pdf

* https://en.wikipedia.org/wiki/Port_Control_Protocol

The advantage of IPv6 is that you no longer have to have things like STUN, TURN, etc. (Remember Skype super-nodes?) Your client knows its own IP(v6) address, gets the IP address of the other end, and then tells your firewall to allow connections between just those two addresses. Once your session is done the ACL is deleted and you're completely default-blocked from the outside again.

Copy-pasting from a previous discussion a little while ago:

---

An IP connection is started from the 'inside' to the 'outside', and the source-destination tuple is recorded. When an 'outside' packet arrives the firewall checks its parameters to see if it corresponds with an existing connection, and if it does it passes it through. If the parameters do not correspond with anything in the firewall's table(s) it assumes that someone is trying to create a new connection, which is generally not allowed by default, and therefore drops it.

The main difference is that with IPv4 and NAT the original (RFC 1918?) source address and port are changed to something corresponding to the 'outside' interface of the firewall. With IPv6 the address/port rewriting is not done.† Only state tables are updated and checked.

New connections are not allowed past the firewall towards the inside with either protocol, and only replies to connections opened from the inside are passed through.‡

There's no magical security behind NAT: tuples and packet flags are read, looked up in a state table, allowed or not depending on either firewall rule or state presence. The security comes from the state checking.

† It is possible to have private IPv6 addresses using ULA, and then the router/firewall uses NPTv6 to rewrite the prefix (leaving the /64 interface component alone).

‡ Just like with IPv4 (NAT), to allow unsolicited 'new' connections in you have to do do firewall hole punching with (e.g.) UPNP. But by default things are blocked.

---

NAT is not a security feature, not now, not ever. It stumbled into looking like one by accident and that is holding the industry back because people think it’s good for the internet can’t imagine life without one. Honestly it shouldn't even be part of the firewall—it’s just too easy to abuse there. NAT is really bad and we should want nothing to do with it in an IPv6 world. Stateful firewall rules work 100% fine in IPv6. There’s a lot of misunderstanding out there…

Standards adoption is definitely an area where government incentives work.

Standards adoption shouldn't even be controversial, really. Fixing weights and measures has been government policy since time immemorial, as have street addresses, snail mail, and telephone. The idea that the internet should not involve the state is, honestly, pretty weird when you try comparing it to other stuff.

  > The idea that the internet should not involve the state is, honestly, pretty weird when you try comparing it to other stuff.

The "inter" in internet implies that there is no single entity that administers it. It is a network of networks, based on cooperation.

Although I agree in principal that enforcing standards has been (and arguably should be) in the domain of government functions, I feel the principal of keeping the "inter" in "internet" is more important. I'd love to see an incentivized conversion to IPv6, but there are many other incentivized conversions that I would wholly oppose. Thus I would prefer not to see government intervention in internet protocols.

The metric system is also international. Doesn't stop governments from mandating its use, or defining their own standards in terms of metric.

Good point, thank you.

I don't know what you mean by "mainstream", but what I understand by it ipv6 is mainstream since quite a while. It has an adoption rate of around 50% in the western world and signifiant places outside of it (SA,India, Thailand, Vietnam, Japan, Brazil)

I don't know of a single ISP in India which offers functional IPv6 in broadband connections. I won't consider 4G because it's almost useless (at least in India) for doing anything serious.

Jio Fibre does. ACT used to in some places but it's inconsistent.

Last I checked, IPv6 on JioFibre was broken and I couldn't get a publicly discoverable IPv6 address. Have things changed?

Yes, JioFibre now (?) offers fully functional IPv6 all across the board, even in the most rural of places.

Airtel certainly does in some places.

I checked my Airtel Fibre connection, IPv6 is explicitly disabled by Airtel and there's no option to enable it.

> in the western world and signifiant places outside of it (SA,India, Thailand, Vietnam, Japan, Brazil)

Brazil is western

> The decision to consume loopback address space has made me even more cynical about IPv6 ever becoming mainstream within my lifetime.

Wait what? Are you saying that they’re going to allocate the loopback range as v4 addresses?

> Are you saying that they’re going to allocate the loopback range as v4 addresses?

Yes, there's a proposal to do so, which was discussed here last week (https://news.ycombinator.com/item?id=29246420 and https://news.ycombinator.com/item?id=29245466).

The proposal is about shrinking the reserved loopback range from 127.0.0.0/8 to 127.0.0.0/16. Everything from 127.1 to 127.255 would then become ordinary IPv4 addresses.

This is just a proposal. It will likely never happen. The proposal to open 240/4 (former class-E / reserved IPv4 space) is more feasible.

Can't see this being useful. There are so many devices and so much software with 127.0.0.0/8 baked in that I suspect an address in the proposed range would be less routable (overall) than an IPv6-only endpoint, and remain so for years, even if it became official.

IPv6 is already mainstream in many countries, including the United States.

Reply on news.ycombinator.com