Hacker News Reader

Comment by merlyn | Hacker News Reader

The reason some of the bigger sites don't offer IPv6 is to not have to deal with stupid broken client configurations.

There are so many groups out there that don't care to setup anything, and ignorantly, or not, break their existing IPv6 in weird ways.

We offer IPv6 services, but have to publish an "IPv4 only" version of some of our endpoints to have customers get around their own brokeness.

Also, I feel the biggest obsticle to IPv6 deployment is mostly the Enterprise firewall tech. Many residential users and mobile users have working IPv6 just fine right now. But I have yet to encounter an enterprise firewall setup for IPv6 properly, even if their ISP offered it.

But yet, they are willing to complain left and right about the CG-NAT restrictions (or overburdened) that they run into, with the easiest solution right in front of their face.

View on HN

> Also, I feel the biggest obsticle to IPv6 deployment is mostly the Enterprise firewall tech. Many residential users and mobile users have working IPv6 just fine right now.

I agree and I feel a little bit ashamed to be part of the problem myself.

Consumers use whatever they tech provides them by default. Which means devices can go from not supporting to supporting something within span of one generation of devices.

On the other hand, enterprise uses whatever their engineers know. And most enterprise engineers learned stuff a long time ago when IPv6 wasn't the thing and in environments where it did not make sense to deploy IPv6.

I never needed to learn IPv6 because incentives were always against doing so.

Also enterprise have money. I expect they are last group to stick IPv4 only.

> The reason some of the bigger sites don't offer IPv6 is to not have to deal with stupid broken client configurations.

That seems like a bunch of FUD. Do you think that the sites that do have ipv6 are spending any significant amount of time "dealing with stupid broken client configurations"? Or indeed that such clients are really common in the wild, considering how much of the internet would be broken for them? Last I checked, about third of alexa top100 is ipv6 enabled; if it works for them then what makes your site so special that you can't enable ipv6?

> That seems like a bunch of FUD. Do you think that the sites that do have ipv6 are spending any significant amount of time "dealing with stupid broken client configurations"?

Ask Google, Cloudflare or Akamai engineers (those who actually deal with IPv6 problems) and they'll probably answer somewhere between "it's harder in practice" to "why can't peering issues go away when they f**king interconnect on IPv4"? It's not that IPv6 is inherently problematic, actually it's a lot better theoretically, but in practice unless you are a large network which has the capability to connect to everywhere in world and sidestep peering issues like Google, Akamai, and Cloudflare, you will encounter problems immediately. This is not theoretical, you haven't seen the likes of OpenStreetMaps who are experiencing peering problems (https://github.com/openstreetmap/operations/issues/559), and not everyone can use US services which exposes them to risks like the CLOUD Act, which allows US law enforcement to access data anywhere as long as it is operated by US companies (most European companies for example).

The real problem of deploying IPv6 is that despite record-high prices of IPv4 addresses and the cost of CGNAT (both monentary and performance-wise), it's still cheaper to do IPv4 only rather than dealing with the hassles of running both IPv4 and IPv6. With IPv4, you can just pick a Tier-1 carrier and you're guaranteed to traverse the whole internet, at least those who didn't proactively blocked you. With IPv6, you are exposed to ugly Tier-1 fights like when Hurricane-Electric tried to interconnect to Cogent to no avail (https://www.datacenterknowledge.com/archives/2009/10/22/peer...), even trying to bake a cake à la Microsoft-Mozilla browser cake wars (https://www.youtube.com/watch?v=7CObnXjmDtg), and even today it's still not resolved (https://www.theregister.com/2018/08/28/ipv6_peering_squabble...). Even Google is not spared with this interconnection woes: it's mitigated, sure, but there are still some parts of IPv6 internet that cannot reach Google, it's just those parts don't really use Google's services or have sane IPv4 interconnectivity (and to clarify, this isn't due to state-level blocking, those people just didn't realised that they don't have a path to Google via IPv6).

Also some internet services (some video streaming protocols for example) also use other services than HTTP and will actually need to adapt to IPv6, but this is a very small issue (because you can fix software easier than pettyness) than the peering issue described above.

Then how does Google do it?

This actually deserves an answer.

Google can do this because it has a clout on ISPs to interconnect to them, and ISPs do have an incentive to not break Google, so Google's job is easier than many others which don't operate an autonomous network. Essentially Google has its own ISP (which to be clear is separate from Google Fiber's), and you don't (unless you're representing a large corporation here). Also the only cost for ISPs to connect to Google is fiber and equipment costs, which incentivises ISPs to peer with Google.

The real problem of deploying IPv6 is that despite record-high prices of IPv4 addresses and the cost of CGNAT (both monentary and performance-wise), it's still cheaper to do IPv4 only rather than dealing with the hassles of running both IPv4 and IPv6. With IPv4, you can just pick a Tier-1 carrier and you're guaranteed to traverse the whole internet, at least those who didn't proactively blocked you. With IPv6, you are exposed to ugly Tier-1 fights like when Hurricane-Electric tried to interconnect to Cogent to no avail (https://www.datacenterknowledge.com/archives/2009/10/22/peer...), even trying to bake a cake à la Microsoft-Mozilla browser cake wars (https://www.youtube.com/watch?v=7CObnXjmDtg), and even today it's still not resolved (https://www.theregister.com/2018/08/28/ipv6_peering_squabble...). Even Google is not spared with this interconnection woes: it's mitigated, sure, but there are still some parts of IPv6 internet that cannot reach Google, it's just those parts don't really use Google's services or have sane IPv4 interconnectivity (and to clarify, this isn't due to state-level blocking, those people just didn't realised that they don't have a path to Google via IPv6).

Do they go exclusively v6?

Speaking as someone who maintains dual-stack production services, you'd be surprised how much extra work is involved for something which (frankly) should be a simple feature to enable.

Reply on news.ycombinator.com