Hacker News Reader

Comment by exabrial | Hacker News Reader

HN doesn't like to hear this, but the shortage crated is artificial, and there also is nothing wrong with NAT.

First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records. This could be implemented with "here and now" technology, rather than adopting a new standard for the entire internet backbone.

Next, widespread use of NAT provides plausible deniability for everyone on the internet. Google, Facebook, Comcast, Verizon, etc push ipv6 hard in order to enable causing tracking of individual traffic on the internet. These institutions have exactly 0 business knowing how many physical devices are behind a firewall. No, ipv6 privacy extensions do not provide the same sort of anonymity that a NAT firewall does before you hit that downvote button and take away some of my fake internet points.

View on HN

> there also is nothing wrong with NAT

Hahahaha....

Oh.... The amount of bullshit I've dealt with over the literal decades, going back to secondary school, college and University, as a consumer, because of NAT (The joys of console gaming and "Strict NAT" or skype in the early days just falling straight over).

The privacy implications I will however grant you.

> First, running exactly one open port per IP (443 or 80) is the worst use of resources. The whole "crisis" could be solved with simple browser support of something like SRV records.

TLS SNI[1] and the HTTP Host: header[2] already do this. Enabling multiple HTTP(s) serving ports with something like SRV wouldn't give us any additional capacity here.

> These institutions have exactly 0 business knowing how many physical devices are behind a firewall.

These institutions can already analyze TTL, source port, IPid, and other packet metadata to enumerate hosts behind NAT.[3]

[1]: https://en.wikipedia.org/wiki/Server_Name_Indication

[2]: https://en.wikipedia.org/wiki/Virtual_hosting#Name-based

[3]: https://www.cs.columbia.edu/~smb/papers/fnat.pdf

> there also is nothing wrong with NAT.

Try hole punching for games through CGN:

* https://en.wikipedia.org/wiki/Carrier-grade_NAT

AFAIK there is no way to do it, so you're SOL if that's what your ISP uses.

IPv6 does not make it any easier or any harder to know the number of physical devices behind a firewall. Even if you sat directly in front of the handoff to the ISP with a packet sniffer counting the number of unique sources you'd still get the wrong number. Correlating source tuple with destination tuple and making inference would get you a more accurate number (though still not perfect) but that doesn't care about v4 vs v6.

SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that.

Many ports have also been restricted by the browser because you can format malicious HTTP requests to be an DoS vector for certain services, like IRC, which has been abused by malvertisers in the past. Because of this you'd still be working with a whitelist of ports, only extending the problem a bit longer.

I'm not entirely sure what privacy your NAT guarantees for you. Individual devices can already be fingerprinted by their behaviour, so you'd need to run identical software on identical hardware to combat that. If you manage to do that, you're only one Set-Cookie away from unique identifiers anyway.

Because of the refreshing nature of privacy extensions, you can't derive an exact number of devices active on a network. More and more random new addresses become in use over time to the point where you'd need access to your router (which your ISP already has, unless you configure your own) to get a proper count. You can at best get guesstimations, but that's not much different from the result of NAT.

In theory, I agree with you: pasdive fingerprinting IPv6 is easier than passive fingerprinting IPv4 on an ISP scale or larger. In practice, though, I don't think it matters. Someone who has access to all traffic from your network, probably has access to some kind of boundary as well.

If you already install your own traffic collector to NAT everything through so your ISP modem doesn't see your devices, you can do the exact same for IPv6. NAT may be strongly discouraged, but it's still possible using the same techniques.

> SRV records could work for alternative ports, but those websites wouldn't be able to get Let's Encrypt certificates without talking to the API of their DNS provider. ACME does not allow alternative ports to be used for security reasons, so we'll need a solution for that.

The security reasons would go away with the presence of the SRV record specifying the allowed port for the domain though. Well, at least as much as any other DNS challenged based method is secure.

That's a very pre-emptively defensive statement... Why doesn't HN like to hear this?

I've been downvoted in the past for pointing out what everyone says works in theory vs what actually happens in the real world.

NAT works for some use cases, not so well for others.

I know a database that's updated every night via a server-to-server connection that passes five levels of NAT, and when that crontab broke someone had to fix it by finding and correcting a bug in a 1500-line NAT configuration on one important router where the consequences of a mistake would be very bad indeed.

It works in the sense that the database is updated, but I cannot help thinking of Truth 3 in RFC1925.

Ok, but please don't bait the community like that. Pre-emptive defensiveness puts a negative torque on conversation.

NAT makes it significantly harder to self host things, and as a consequence limits decentralization.

Which makes it easier for typical HN employers and YC startups (esp the social media kind) to stay afloat.

Reply on news.ycombinator.com