Hacker News Reader

Comment by chimeracoder | Hacker News Reader

This article is focused on the US, a country which was never really going to feel the brunt of the IPv4 crunch.

For an example of a real victim, look at Qatar, a country which only has a single IP address for the entire country (everyone sits behind a NAT): https://en.wikinews.org/wiki/Qatari_proxy_IP_address_tempora... [0]

Whenever someone from Qatar decides to vandalize Wikipedia, Wikipedia is forced (temporarily) to block the entire country from accessing Wikipedia. This has an adverse impact on the rest of the country.

Non-Qatari Wikipedia users also suffer, because Wikipedia makes those blocks very temporary (since they are effectively shutting off an entire country), which makes it easy for those vandals to regain access to Wikipedia quickly.

[0] This sad state of affairs is not solely due to IPv4 (incompetent/apathetic network administrators are also at fault), but it's a contributing factor.

View on HN

To be fair, Qatar's situation has nothing to do with the IPv4 crisis. It's a country-wide firewall/proxy that exists due to political reasons and it wouldn't behave any differently if it was implemented in IPv6.

Exactly - Qatar is not exactly some poor country. They have the cash to buy all the IP's they want, should they so choose.

Qatar has a huge allocation of unused IP addresses. It's a matter of choice that their censorship proxy only exposes one IP address on the internet side.

I can assure you the US is feeling the brunt of the IPv4 crunch. I'm building something that needs massive amounts of public address space and I simply can't get IPv4 addresses for it. I've asked multiple providers. You are LUCKY if you can get a /28 at this point. Hoarding. Rolling with IPv6 instead.

I get you have an interest in the Qatar/Wikipedia situation, but it seems to be unlikely due to IP address resource management issues. Probably more like tyrannical control, if anything.

I know of multiple providers who have gotten allocations in the last month (up to /19) and will be requesting another one myself in the near future. ARIN has plenty of IPs.

Right on. I'll keep looking then. I sorta gave up after two told me the same story. Probably need to talk to someone bigger.

Are you asking for more than you can immediately use? Elsewhere you mentioned having difficulty getting more than a /28. That's pretty much the largest block you can get without some paperwork to justify your immediate usage. If you haven't already, take a look at the ARIN requirements in https://www.arin.net/policy/nrpm.html#four23 and make sure you have your ducks in a row before you go back at it.

I had absolutely no problem getting a /27 from my ISP here in Sweden the other week.

>I'm building something that needs massive amounts of public address space //

You piqued my interest, what?

Something I've been thinking about since Grub. An embarassingly distributed cloud coop, Bitcoin style using OpenStack, pools, and a compute exchange: https://github.com/StackMonkey/xovio-pool/blob/master/whitep.... I'm not the only one thinking about it: http://citeseerx.ist.psu.edu/viewdoc/download?rep=rep1&type=....

Doing it solo now, but I need help.

Then there are guys like me. I have a /24 routed to my home (pre-ARIN legacy space registered in the early 90's!)

Interested in running a micro cloud? See comment above.

AKA swamp space. I've got one of those, too.

I just went shopping for vendors at my San Francisco datacenter and had no problem replicating my current /26 + /27. Some vendors offered a /24, even.

This is because, as you may have found out already, ARIN is out of fresh IPv4. https://www.arin.net/knowledge/v4-v6.html

You may have better luck with other continents. Try AfraNIC.

How could NAT work for an entire country of people behind one IP? My understanding was that NAT allows communication over separate ports, so for example a router with ip 123.45.67.89 can run three clients by sending their data over ports 50000, 50001 and 50002. How does this work when more than 65k people are trying to connect? There don't seem to be enough ports for that to be possible.

This is a dramatic simplification, but TCP uses the quadruplet of source IP/source port/dest IP/dest port as a session identifier, so you can potentially get 2 billion people using one outgoing port to 2 billion different servers with different IPs in the absolute best case (which wouldn't happen, of course).

that limit only happens when 65k people try to use the same remote ip, otherwise the distinction can still be made for tcp streams.

Is there a minister of Port forwarding? What happens when I fire up chrome and Firefox with 80 pages each? Am I limited to a number out going connections? I assume the entire country is running off a Windows 95 box with two nics but that's just the way I imagine most cg-nat.

I've exhausted a SQL server for ports, for science. Yes you are limited to the number of outgoing to ~64000 outgoing ports. Chances are your network equipment (not enterprise grade) will run out of switching contexts before you run out of ports.

> Whenever someone from Qatar decides to vandalize Wikipedia, Wikipedia is forced (temporarily) to block the entire country from accessing Wikipedia

Can't they just block IPs from editing? Seems like that would solve the problem

That's what they do. But this still prevents everyone in Qatar (who does not have an IP ban exception) from editing.

How many of Qatar's 2 million people use the internet, and how many of them pay for a VPN service? (https://www.bestvpn.com/blog/6715/5-best-vpns-for-qatar/ indicates there are a lot of internet cafes whose owners are using VPNs and passing on the access to customers.) It sounds to me like a person from Qatar wouldn't have a problem editing wiki if they wanted to, nor a vandal from vandalizing if they wanted to...

"I can bypass it" is not a solution; it's just avoiding the problem, which remains intact.

a VPN is especially not a solution to this problem because VPN providers still need a well of IP address from which to draw and assign to customers.

They can and probably do.

What is the IP address, then?

I got lots of different answers while googling. Is it still a range (they rotate through their allocated space), or do my googling skills just stink?

This is probably the address in question: http://en.wikipedia.org/wiki/User:82.148.97.69/header

You act like Wikipedia has no agency in this matter and is simply forced to block Qatar's IP address from editing.

Wikipedia has choices, and it's choosing something well within its rights to prevent abuse of its property, but they could choose to do something different.

I think you're getting distracted by property for no real reason.

Given the type of website Wikipedia aims to be, it's hard for them to give Qataris the service they want to deliver.

I am curious. Which other criterion than IP address could they use to prevent anonymous users from Qatar from vandalizing?

(I guess one method could be to force everyone from this IP address to create an account, but that goes against their openness/ease-of-editing-for-new-or-casual-users principle.)

I mostly object to the phrasing that Wikipedia is "forced" to block all of Qatar, as if Wikipedia is a mindless force of nature or not in control of its own actions.

Finally someone sticking up for wikipedia around here. Its disgusting the way She is treated.

Why not use something else to ban users in this case? For example the user agent, browser window resolution, installed fonts, etc.

Those can all be changed. A determined spammer could make a bot that automatically changes them.

Whereas an IP can't be trivially masked?

Most free proxies are already blocked on wikipedia. Finding more once yours have been block I don't think is very easy.

Browser configurations can be easily generated by a computer and you never run out.

Does Wikipedia block editing from AWS IPs?

I assume a browser fingerprint of the right granularity is hard to change for someone who would vandalize Wikipedia without a proxy.

Because vandals never use different browsers? ;-)

You make a case why IPv6 is good for traceability of users.

On the other hand, IPv4 and NAT are a boon to privacy. We'd be exquisitely trackable if NAT didn't exist and every single device had a unique, unchangeable, life-long IP address. That's more-or-less how IP addresses were supposed to behave and IPv6 brings that back.

We need to be thankful for NAT for the privacy it brought by accident.

IPv6 only brings that back if you want it too. By default Windows, OS X and iOS have privacy extensions enabled which will generate random IPv6 addresses which change every few minutes, which makes tracking a device more or less as difficult as with NATted IPv4.

NAT is not a privacy mechanism. For IP addresses to be lifelong (and therefore portable) the routing mechanism would need to change.