Hacker News Reader

Comment by ktosobcy | Hacker News Reader

I still have Windows7 on my fathers computer and it's more than enough for him (Firefox + FreeCell). We are behind NAT and he doesn't open anything except for a couple of pages + has uBlock.

The whole hype around Win10 loosing support is way overblown…

View on HN

Worth noting that "behind NAT" is not a security measure. Technologies exist that circumvent NAT to various degrees (and that's usually without malicious intent!). WebRTC is a famously annoying example of this where it's got tons of legitimate applications but has also been responsible for serious security issues, especially in earlier implementations.

The same set of tools exist with different names to punch the same sorts of holes automatically in ipv6 firewalls, so are ipv6 firewalls also not security measures?

I'm fully aware, it was mostly a "shorthand". In general it's harder to attac/access a computer that is not directly exposed to the internet and/or not listening on any port.

“We are behind NAT” just means you’ve got a router / home network like everyone else does these days right? Or am I missing something more here.

If you get IPv6 from your ISP you're usually not "behind NAT", even if your home router does NAT IPv4 or your ISP does CGNAT for IPv4.

I am a blue collar layperson (who only understands IPv4's limitation as a lack of total available IP addresses) that disables IPv6 (at the router level) for this exact reason — I feel like I am losing the little bit of control that being "behind NAT" allows on a private IP range/network (e.g. firewall; port mapping).

Obviously I still use Windows 7 Pro 64-bit as my only Microsoft computer — also have an Ubuntu dual Xeon (for LLM/crypto) and several Apple Silicon products (for general browsing).

Do you have a gateway that doesn't do ipv6 firewalling (e.g. allow outgoing, only allow established incoming)? I was under the impression that even no-names manage to get that correct. Why would you need port mapping if not for NAT? Even with NAT, for home use I was always mapping port n to n.

You're misunderstanding the purpose of NAT, which is not a security boundary. Apple, for instance, has (or had) nearly all of their workstations on a public IP space.

You can still equally as effectively firewall and port map devices on public IPs as you can behind NAT -- and actually just a bit easier, since you're taking NAT out of the picture.

Could be ISP CGNAT, but in principle, yeah, anyone not plugging their computer directly into their modem is behind NAT.

Well it's nice that Firefox maintains a security updated version on Windows 7 (Chrome doesn't) but it's missing the new features.

Maybe I am using some (use mostly firefox at home on my Linux box, other than when streaming certain sites where the picture is better on chrome) - but I can't think of many "new" FFox features I actually like, going back to like version 68 or something.. Every time they introduce something new, I have to disable it or work around it, or whatever.. Just let me keep my "it works" workflow, FFS.

I've had my dad, with similar usage patterns, using XFCE for close to 15 years now. Very few problems with it, I only have to play tech support maybe once a year. Worth considering..

I do consider migrating to Linux but... "ItJustWorks" and even the tiniest change throws him off (like order on tiles in firefox) so I'm waiting for the current machine to die completely ;)

Reply on news.ycombinator.com