Hacker News Reader

Comment by warkdarrior | Hacker News Reader

> Running a server used to be trivial: run an executable, tell people your address, done...

This works, until you have more than one person accessing your server. Then you need to worry about accounts, credentials, data isolation, etc. And then if a couple of people connect to your server and start using it, you have to worry about staying online, staying updated, backing up the data. But other than that... yes, trivial.

And just to be really explicit, you always have more than one person accessing your server, and most of the time they are unwanted users trying to break in.

View on HN

> most of the time they are unwanted users trying to break in.

Exactly. Of all the reasons why the average person doesn't have an Internet-visible server, NAT, I would say, is pretty far down on the list.

1. NAT and a firewall are 2 different things 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP. This isn't true security but see 1 for that.

> NAT and a firewall are 2 different things

Exactly. Which is the issue with saying, as the article does, that NAT is the reason most people don't have an Internet visible server, when the real reason is that their computers need to be behind a firewall and once you're behind a firewall, safely opening up just little pieces of it for an Internet visible server is something most people aren't going to want to deal with.

> 2. With IPV6 you can have so many IPS that unwanted users can't guess your IP.

In fact you could have an IPv6 address for each user, and if one starts becoming troublesome both revoke account and stop using that address.

You could create a new IPv6 address every millisecond, and it'd take 584,868,233 years to exhaust a IPv6 subnet (/64).

Perhaps a server run by a large corporation could do this. Perhaps.

But an ordinary person? I don't see it. If it's tough for an ordinary person to handle safely opening a port in their firewall for forwarding, it's tough squared (or perhaps cubed or an even higher power) for an ordinary person to handle auto-creating a separate IPV6 address for every other person that wants to communicate over the Internet with them.

Not to mention, how does this work with DNS? If Ordinary Person wants to put an article up for others to read, how do the others find it? Surely not by Ordinary Person sending individually crafted IPV6 addresses to anyone who wants to read their article. (And how do they even find those other people if they are also creating new IPV6 addresses for everyone else?)

> most of the time they are unwanted users trying to break in

Thankfully, we have wireguard now. It drops all packets by default. From the perspective of people who don't have the requisite cryptographic keys, it's like the computer is not even there to begin with.

I've always found it strange how people just put computers out there on the internet and just allow them to interact with total internet randoms. Why are we allowing our computers to talk to strangers? No wonder people are getting hacked.

If the utility and functionality of the server requires those things, then they're required regardless of whether or not that server is internet-facing.

Jill from Elbonia may be always be a threat, but this doesn't mean that Joe from Accounting is not a threat or cannot ever provide a vector for Jill. :)

I mean, no, you don't have to worry about all that stuff unless the business logic demands it. The OP is entirely correct for eg just serving a static file.

Reply on news.ycombinator.com