Comment by simoncion
17 hours ago
> ...IPv6-only should be plug-and-play by now.
The obsession about "IPv6 only" has never made sense to me. Any decent firewall software will let you write rules that apply regardless of IP version. The "software complexity" argument is bunk... you already have v4 and v6 IP implementations in your OS, and every major OS has provided IP-version-agnostic socket interface code for much more than ten years. If you are using software that is IPv6-capable, it's very likely that it's using IP version agnostic library functions.
Unless stewardship of the Internet is wrested from the hands of the responsible, level-headed type of folks that run it now and transferred to the hands of folks who think nothing of making backwards-incompatible changes every six months, IPv4 won't stop running across the Internet within the lifetime of anyone who's currently reading HN. This delay is fine. The only thing about IPv4 that's a problem is that its address space is 32 bits wide. Had it been defined with a 128+ bit address space, we wouldn't have seen another version of IP on the Internet. Now that IPv6 is around to reduce address pressure, there's no big need to do anything about IPv4.
I believe the folks worrying about IPv6 only are just looking ahead to a possible future. Especially when they are looking at the question of do all the pieces work locally, vs do popular domains support it.
There are domains like T-mobile US that are IPv6 only already. T-mobile runs NAT in the network so that all of IPv4 is NAT'd to IPv6.
I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Once IPv6 becomes the choice to support to get new customers, it is reasonable to expect that IPv4 support will start deteriorating and will eventually fade away.
I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
> I believe the folks worrying about IPv6 only are just looking ahead to a possible future.
I'm certain that that is not what the folks who scream very loudly about how IPv6 has been and continues to be a colossal failure because it's not the only version of IP on the Internet are doing.
> I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.
Sure. That's the future I find most plausible: For "residential" connections, provide IPv6 GUAs and IPv4 via CGN... [0] for "commercial" connections, provide IPV6 GUAs and give the customer the option of one or more IPv4 GUAs.
> I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.
I do hope we get to that point within the next five years, if not ten! But notice that my claim is that IPv4 will still be crossing the Internet after everyone reading HN today is dead. [1]
[0] I'm calling the various mechanisms that only provide an IPv6 address to an end user and do fancy gyrations to provide IPv4 access "CGN", even if might not strictly be CGN.
[1] ...as long as the the responsible, level-headed type of folks that run it now aren't replaced with the "making backwards-incompatible changes to everything every six months is A-OK!" type of folks.
I can totally understand why. IP addresses are hard to get for a large chunk of the global population. There's twice as many people as there are IP addresses.
Plus dual-stack means more work, and more possibilities for misconfigurations or vulnerabilities in your network. It'd be way easier if you only had to worry about one or the other.
I live in the US and my ISP gives me one address I have to share across all the machines in my house. That's a tragedy - by all rights I should have a subnet or two. You can't directly address any of my servers from the outside on IPv4 which means I have to do hacky crap like port forwarding and can't use a lot of the older protocols that aren't NAT friendly. And I've got it good compared to most of the world!
IPv6 gives us back a large chunk of the original premise of the Internet - that all nodes are peers. IPv4 hasn't been able to do that for decades, and it's warped the way we think about networking by separating everyone into consumers and providers.
> Plus dual-stack means more work, and more possibilities for misconfigurations or vulnerabilities in your network.
Nope. Your OS vendor already did the work to make both versions of IP work. And as I mentioned, if you're using a decent firewall you can write IP-version-agnostic rules just as easily as you can ones that depend on the version.
Plus, most SOHO firewalls default to dropping unsolicited non-ICMP traffic. That's the exact same security stance that IPv4 + NAT gives you. You have to go out of your way (or be using fancy gear that is aimed at people who know what they're doing) to expose your LAN hosts.
My OS vendor didn't set up my firewall rules, lay out my subnets, or configure my routing. I did that. Twice. Because I've got a slightly more advanced network layout than your typical home user. And that's all much less complicated that what your typical corporate network would be, which is much less complicated than what an ISP or COLO provider has to deal with. And then there's the cloud...
Yeah, sure, if your requirements can be met by a cable modem, then you're basically good to go. Until DNS breaks for some machines and not others, and it's because your ISP screwed something in their IPv6 routing but it still works on IPv4. Or Microsoft's authentication servers decide they don't like your IPv6 subnet anymore and Minecraft refuses to start unless you turn IPv6 off. Or... You get the idea.
2 replies →