Hacker News Reader

Comment by kevincox | Hacker News Reader

I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote:

> This is useful since it can remove the need for some servers to have any outbound internet access at all.

My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.

View on HN

For what it's worth, I've these endpoints in use for VPCs that still had internet access. Meaning that if you attempted to read the "real" internet address you put your VPC subnet on, they would be unreachable.

It's hard/impossible to figure out if the VPC in question has been setup this way. But I agree that it would be likely that most of these VPC with the endpoints on don't have internet access.

However if we assume (dangerously I suppose) that the VPC subnet distribution is similar to other VPCs without private link, we can imagine how many other VPCs are squatting on space that do have internet access!

(Assuming any of this makes sense)

For sure, I'd bet that most of the examples you found were still connected to the internet. I don't think the findings are any less valid I just thought it was an interesting observation that if you are in fact disconnected from the internet there isn't really any reason you should follow the public internet's rules.

>My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.

Hypothetically if you were dealing with a network that had zero access to the outside world then you are right, it doesn't matter. You can use whatever IPs you want and it wouldn't make a difference.

Its a bit of a moot point though since outside of niche situations like high security air gapped networks you don't really see that scenario anymore. Yes, the network at a nuclear missile silo could do that but everyone else is connected to the internet.

This particular survey finds things that are connected to the public internet. For example, the WD NASes used are specifically those NASes whose owners have chosen to connect them to the public internet.

The squatters probably don't intend anything at all evil, but their address use conflicts with access to the general net. If you addresses that aren't yours and you expect to be able to connect to web sites in general, you might by chance use an address that is later allocated to a web site you'll want to use. If you squat on 193.168/16, that's 2¹⁶ addresses and you might block your own access to a few thousand web sites.

I understand you now.

I suppose the argument is you're building a house without a door. While you may believe you have everything you will ever need in that house, there's a likelyhood you will eventually need to leave (or something needs to arrive). Now you're stuck. Of course, it's not all or nothihng when it comes to IP space.

If you were going to use 11.x for an air gapped secure enclave, I would have a very difficult time presenting a scenario where that may bite you later. However, I'd vote to use CGNAT reserved space before any 'unused' public IP space.

Reply on news.ycombinator.com