Hacker News Reader

Comment by StilesCrisis | Hacker News Reader

>Two hosts on the same subnet can reach each other without leaving the LAN.

Barring "very buggy software," when is this false?

Port- or Client-isolation on Ethernet switches and Wi-Fi access points respectively. Often seen in corporate environments and (properly configured) guest networks.

I feel like the point of those is conceptually "take these things off the LAN." If we allow for that, what even is a LAN?

You are correct. It explicitly breaks the LAN, does not provide a LAN, only an internet gateway in most cases.

There are recent "client isolation" features that prevent P2P communication. Some hosting providers also block customers on the same LAN from attacking each other.

Indeed. You might share a subnet with other customers of your ISP, but your ISP probably doesn't let you ARP poison them.

This isn't even that recent. I remember doing ARP poisoning exactly once and then being surprised that it didn't work everywhere.

Indeed. You might share a subnet with other customers of your ISP, but your ISP probably doesn't let you ARP poison them.

This isn't even that recent. I remember doing ARP poisoning exactly once and then being surprised that it didn't work everywhere.

I think the falsehood here is that same IPv4 subnet = same link layer network, but that doesn't have to be the case.

Did arp poisoning in school and used a tool to show images from websites people visited on the projector. Teacher thought it was fun until someone went to goatse.

Switches and firewalls can do all kinds of things. Probably the most common case is that public/guest wifi networks often have client isolation set up so that different devices on the network can't contact each other. Same subnet, but only access to the gateway and the internet in practice.

(Also can happen if ARP is not working correctly, which can be a right PITA to debug).

Most consumer wifi routers I’ve used have a setting to prevent peer-to-peer traffic. Whether this still counts as being on the same subnet is kind of a philosophical question.

An IP subnet is just a block of addresses anyway. Any two addresses both are and are not in the same block, depending on how big of a block you choose.

Only if you don’t consider the subnet mask as part of the IP address configuration.

LAN spread across sites with a WAN in the middle of it. But that's why I said in my comment that a LAN isn't actually a real thing.

Some tunnel that extends the subnet somewhere else. Guess it depends on how you define lan.

I feel like the better of this is maybe "will" instead of "can"

Yeah… I feel like “falsehoods X believe about Y” need to omit anything a reasonable X would consider to be a bug.

Edit: fair point. Maybe not.

I think generally the point of the phrasing is to make you stop considering it a bug,

Falsehoods programmers believe about programming: you don’t have to work around other people’s bugs.

It might not be your fault but it sure as hell will be your problem.

VPNs

I read that like the meme:

<guy with messy hair>Aliens</guy with messy hair>

Reply on news.ycombinator.com