Hacker News Reader

Comment by candiddevmike | Hacker News Reader

Businesses and organizations are holding IPv6 back, not consumers. No one I talk to is prioritizing IPv6 migrations or spending money to upgrade gear that will support it. Maybe some net new stuff might get it, but for most businesses IPv4 is and will be the default, simply because they can't be bothered to do something different.

View on HN

It’s worse than that: new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network. Not just unable to use it, but actively incompatible — failing to run if other devices use IPv6!

This was an issue with Azure’s PostgreSQL service, which would fail if you deployed other unrelated IPv6 services in the same virtual network.

We need a guild of software engineering so that the people responsible for this can be summarily ejected from it.

> We need a guild of software engineering

The threat of professional exclusion is one of the big levers provided by such a guild. Given the way tech companies behave, why do you believe that this lever will be left in the hands of good people, and not taken over (like the rest of the internet)?

I think there are more developers opposed to the recent web attestation shenanigans than those for it (even those who might be coerced into being for it by their employer). A majority guild vote could stop everyone working on it and keep the web open.

Who accredits someone to join this guild? Who holds the keys?

Yes, and if you can hold and retain power over the guild then the power of professional exclusion exceeds the coercive power of any one employer. But when your threat model includes adversaries who are willing to subvert the entire open internet to get their way, how do you harden your guild against this attack?

> new software and hardware is being developed or rolled out right now that is incapable of working on an IPv6 network

I would be shocked if this were true for hardware. Even for software, every major OS in the last 10 years as supported IPv6, and prefers it over IPv4

I’m sure there’s horror stories, but I doubt it’s systemic.

> prefers it over IPv4

That's the problem. If the OS starts using IPv6 preferentially but the software on top can't handle it, then you get a crash.

E.g.: if you turn on IPv6 for DNS and it starts returning AAAA records instead of A records, then a lot of applications fall flat on their face.

Usually the type written in C and insisting on maintaining compatibility with whatever Berkley did in the 1970s.

Some enterprise software I guess? I have native IPv6 since 2010 and can't remember a single software that crashed because of it.

Serious question, is there any enterprise gear made today which does not support IPv6? I have assumed that the natural hardware upgrade cycles made it so 99% of all active equipment could support the technology, even if it was not configured to do so.

That door alarm thing that has a Windows XP workstation VM the facilities team touches once a month probably doesn't support IPv6.

Repeat that scenario across multiple BUs and multiple locations and no leader wants to commit to doing that kind of due diligence. What's wrong with our current IP?

Windows XP supports IPv6.

Man in the middle certificate re-signing deep packet inspection firewalls are notorious for not supporting IPv6. Most everything else has switched, but many network admins fear IPv6 and don't want to have to learn something new.

"Made today"? Probably not. "Still in operation today"? Definitely.

My company makes what is essentially an enterprise IoT device. I'd guesstimate 10% of networks with our hardware in them have no ipv6 support at all. And these are businesses that are on the more tech savvy side (I would assume, since they're ordering our stuff).

It is not about the gear, it's about security people that force you to disable IPv6. "You do not have a valid technical or business reason to use it. And, as electricians say, a VISIBLE circuit break provides the best assurance that this circuit will not kill you. Lack of IPv6, as opposed to just firewalling it, is the equivalent of the visible circuit break. I would also enable a whitelist of permitted ethertypes on all switches, and not include IPv6 there."

And let me quote from CIS SUSE Linux Enterprise 15 Benchmark v1.1.1 page 191: "3.1.1 Disable IPv6 (Automated). Profile Applicability: Level 2 - Server, Level 2 - Workstation."

Having an Allowlist of ethertype (ARP/IPv4/IPv6) is an extremely good idea IMO, as Windows and Linux are extremely permissive in what they accept on L2: https://blog.champtar.fr/VLAN0_LLC_SNAP/

TP-Link enterprise wireless access points (the EAP line) don't support IPv6.

Hmm, I use IPv4 mostly because nobody in their right mind can remember a IPv6 address…

Who's out there remembering IPv4 addresses?

If only there were some sort of a system for translating human readable names to network addresses...

damn, imagine if the buddies of the company that owns all of these IPs operated that system. The entire internet would be in their control. Wild dream.

/me slowly raises hand

Plenty of people own ipv4 addresses (I mean, all of them are owned, but most by companies) and have been using the same addresses for a very long time, you start to remember some of them by heart after that :)

Not I. Any commonly accessed IP tends to be named in my SSH config.

Have you tried? I knew my v6 block (and static addresses within that, which is like two: router and server) back when I used v6 ten years ago, same as I know my v4 address, without really actively learning either

For sure this is a self-hoster thing, where you have pets not cattle, but so is memorizing your v4 address(es)

I must be in my wrong mind then. :)

Just because it's a 128-bit number doesn't mean it should be difficult to remember, the standard notation goes a long way toward that. 2001:db8::cafe:f00d and fc00:bad:beef::1 aren't what I'd call the epitome of "can't remember"

Mind that real-world global addresses often have four groups of almost-random at the beginning, but it's usually not terrible to commit to memory.

Use DNS?

Is is really so hard to remember the addresses fd::1, fd::2 etc. for your local network?

There is nothing wrong with ipv4 in the LAN, for public things in the internet DNS is and should be used anyways making ipv6 there a non issue.

> There is nothing wrong with ipv4 in the LAN

Asides from potential address conflicts, should your work VPN space overlap with your LAN subnet, for example.

2600:: is pretty handy

IP addresses should never have had letters and double colons in them.

What's Google's IPv4 DNS? 8.8.8.8.

What SHOULD Google's IPv6 DNS be? 8.8.8.8.8.8.

What SHOULD Google's IPv8 DNS be? 8.8.8.8.8.8.8.8.

What IS Google's IPv6 DNS? 2001::some::shit::I::::can't::remember//::h0ff::affblah

This is why I'm still stuck on IPv4. I'm a walking DNS server for all the instances I own, I can hammer out IPs when DNS fails me and that's a very useful feature, especially when idiot Wi-Fi hotspots try to DNS poison you when you're trying to SSH into something and the poisoned IPs stay cached even after you've accepted the stupid TOS.

If it is the use of colons instead of dots that prevents you from learning the adresses, then I'm not sure you can be helped.

But that discussion aside, if you adopt the IPv4 naming scheme to the 128-bit IPv6 adresses, Google's DNS would be 8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.

I would never be confident that I put in the right number of 8's in that case. And I have a feeling that you being overwhelmed has more to do with the total increase of possibilities, than with hexadecimal notation.

I guess it shows that IPv6 was designed for computers, not humans. Because we need a vast number if IP adressses. And that is fine for me.

> If it is the use of colons instead of dots

Colons are inherently more frightening than dots, especially double colons, which seems like some badly written C++ class escaped from gaol. Dots feel friendly and cute, I would pet an IPv4 address.

> then I'm not sure you can be helped

Sure, and the rest of the planet hasn't adopted IPv6 either. It's a horrible UX.

If I'm allowed to argue using unrelated topics and feelings, here you go ;)

> Colons are inherently more frightening than dots

I highly disagree. In traditional text usage, dots end a sentence. They are terminal. A symbol of stasis. Like death. Contrary to that, a colon always refers to something that comes after: it transcends itself, and wakes my curiosity. It is a symbol of growth and learning.

Lemme introduce you to XML then…

The rest of the world has adopted IPv6 because they never had the vast IPv4 space.

It would be 1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16

> I'm a walking DNS server for all the instances I own

In that case you don't need to remember the google's DNS address or any DNS servers address for that matter.

It would be 8::8

For a memorability, I would prefer using domain names which is invented for the humans.

Reply on news.ycombinator.com