Hacker News Reader

Comment by shmerl | Hacker News Reader

> The thing about IPv6 is it has significant switching costs but almost no benefit to end users.

Real scenario - developer of Valheim initially released the game on Itch.io but then removed it from there, saying that it now has to rely on Steam services for NAT traversal for its multiplayer, making it tied to Steam in result.

Clearly if IPv6 would have been available there wouldn't have been the need for such services, no? So I'd say end users are bitten by this, just not in obvious ways for them to start complaining about it.

View on HN

> Clearly if IPv6 would have been available there wouldn't have been the need for such services, no?

The additional benefit of those services is that they mask clients' IP addresses. This makes doxxing and DDoS attacks much hard to achieve.

Grand Theft Auto 5 Online is notorious for its direct peer to peer connectivity, to the point where it's recommended to play with a VPN. Playing without one exposes you to a very real risk of being hit with a DDoS attack launched by a cheater (or someone with the basic knowledge of Wireshark) who wants to take revenge for one reason or another.

DDoS services are a commodity accessible to anyone with a $5 gift card these days. I don't want to go back to the world of direct peer to peer connections for gaming.

Could be, that that's unrelated to IPv6, so a totally different issue.

Instead of NAT traversal IPv6 is going to require firewall traversal.

Absolutely. I'll say it again and again, I like NATs, especially for home setups. They help hiding devices from the public that never need to be accessible outside of a LAN. And you can never trust home router firewalls to be configured correctly. If all devices had their unique IP address, we'd see much larger botnets out there.

You don't need any traversal services for that though. You can set up port forwarding as needed on you router if something requires special access.

Problems start with NATs that you can't control.

If your router's firewall is set to not allow incoming traffic to an IP behind it, then the IP isn't going to be accessible, and it doesn't matter who knows the IP. This is much simpler than NAT.

Your device also isn't hidden too much if a NAT router lets it have the ability to make outgoing connections - it's just less convenient to access.

You might see more attacks targeting specific internal IPs if NAT never existed more but it doesn't necessarily follow that NAT is preventing or reducing botnets. Dos/DDoS attacks can be focused a your router with or without NAT.

IPv6 space is too big to scan, a /64 network is already a big problem. Botnets require vuln device to have internet connectivity, they don't need to have inbound connections. Most of them use udp/dns etc. for control.

Reply on news.ycombinator.com