686

Basically the extent of my IPv6 knowledge (lemmy.world)

submitted 4 months ago by renzev@lemmy.world to c/programmerhumor@lemmy.ml

86 comments fedilink hide all child comments

Template source: https://web.archive.org/web/20210304000634/https://www.government.nl/topics/coronavirus-covid-19/visiting-the-netherlands-from-abroad/checklist

top 50 comments

sorted by: hot top controversial new old

[+] skullgiver@popplesburger.hilciferous.nl 117 points 4 months ago* (last edited 4 months ago)

[deleted]

[-] Vlyn@lemmy.zip 48 points 4 months ago

My ISP doesn't support IPv6, now what?

It's really bullshit.

[-] eclipse@lemmy.world 23 points 4 months ago

Hurricane Electric have a free tunnel broker that is super simple to set up if you really want to get on the bandwagon.

https://tunnelbroker.net/

Though honestly I'd say the benefits of setting it up aren't really worth the trouble unless you're keen.

[-] FrozenHandle@lemmy.frozeninferno.xyz 5 points 4 months ago

Yeah it's a huge source of problems. If you are outside the US your IPv6 prefix is never gonna be correct in every GeoIP database, even if you send a request to have it corrected, so you sometimes get geoblocked and other sites just block you because it sometimes gets classified as VPN.

[-] eclipse@lemmy.world 8 points 4 months ago* (last edited 4 months ago)

I agree. GeoIP was never a good idea, but here we are. Any ASN could be broken up and routed wherever (and changed) but it's still far too prevalent.

[-] hank_and_deans@lemmy.ca 3 points 4 months ago

I did it by acquiring my own AS number and prefix, allowing me to set the geofeed, and announcing it via public BGP from a box in a data center. Took a few days for most things to pick it up the geolocation.

[-] Appoxo@lemmy.dbzer0.com 5 points 4 months ago

Sounds (labor and money) expensive.

load more comments (2 replies)

load more comments (1 replies)

[-] eclipse@lemmy.world 10 points 4 months ago

It also means you no longer need the kludge that is NAT. Full E2E connectivity is really nice -- though I've found some network admins dislike this idea because they're so used to thinking about it differently or (mistakenly) think it adds to their security.

[-] ikidd@lemmy.world 16 points 4 months ago

NAT still has its place in obfuscating the internal network. Also, it's easier to think about firewall/routing when you segregate a network behind a router on its own subnet, IMO.

[-] eclipse@lemmy.world 11 points 4 months ago

Given how large the address space is, it's super easy to segregate out your networks to the nth degree and apply proper firewall rules.

There's no reason your clients can't have public, world routeable IPs as well as security.

Security via obfuscation isn't security. It's a crutch.

[-] efstajas@lemmy.world 9 points 4 months ago* (last edited 4 months ago)

There's no reason your clients can't have public, world routeable IPs as well as security.

There are a lot of valid reasons, other than security, for why you wouldn't want that though. You don't necessarily want to allow any client's activity to be traceable on an individual level, nor do you want to allow people to do things like count the number of clients at a particular location. Information like that is just unnecessary to expose, even if hiding it doesn't make anything more secure per se.

[-] r00ty@kbin.life 12 points 4 months ago

Well good news. Because ipv6 has a thing called privacy extensions which has been switched on by default on every device I've used.

That generates random ipv6 addresses (which are regularly rotated) that are used for outgoing connections. Your router should block incoming connections to those ips but the os will too. The proper permanent ip address isn't used for outgoing connections and the address space allocated to each user makes a brute force scan more prohibitive than scanning the whole Ipv4 Internet.

So I'm going to say that using routable ipv6 addresses with privacy extensions is more secure than a single Ipv4 Nat address with dnat.

[-] zurohki@aussie.zone 6 points 4 months ago

That's what temporary privacy addresses are for. Clients can just keep generating new addresses in your /64, which is it's own subnet.

[-] frezik@midwest.social 6 points 4 months ago

Obfuscation is not security, and not having IPv6 causes other issues. Including some security/privacy ones.

There is no problem having a border firewall in IPv6. NAT does not help that situation at all.

[-] ikidd@lemmy.world 6 points 4 months ago

Obfuscation is not security

Yes, of course. But saying trite things like that doesn't get around the idea that giving out a map of the internal network by default isn't the best policy.

load more comments (3 replies)

[-] umbrella@lemmy.ml 3 points 4 months ago

You don't need to give up IPV6 to have NAT though.

load more comments (1 replies)

[-] digdilem@lemmy.ml 4 points 4 months ago

I think you'll find some ISPs will be reluctant to let go of CGNAT - they're doing quite nicely by charging extra for 'commercial' services where it's not in the way.

Fortunately, many of us know about cloudflare tunnelling and other services, so NAT really isn't a problem to self hosters and even SMEs any more.

load more comments (18 replies)

[-] arin@lemmy.world 8 points 4 months ago

I had network speed issues and the solution was literally to disable ipv6... Fiber 1gbit network still had issues. https://www.reddit.com/r/youtube/comments/owbjdl/anyone_else_getting_buffering_when_using_ipv6/

[-] r00ty@kbin.life 9 points 4 months ago

Weird. Ipv6 and YouTube stats for nerds shows between 140mbit and 600mbit depending on what's being watched and the time of day.

Is it possible your isp has problems with their ipv6 setup?

IPv6 overheads should only have a marginal impact on max speeds.

load more comments (1 replies)

load more comments (3 replies)

[-] Norgur@fedia.io 83 points 4 months ago

I also know that I cannot tell the difference between two IPv6 addresses because they all merge into an indiscernible blur inside my head

[-] Hupf@feddit.de 61 points 4 months ago

Back when we had to dial ipv4 addresses from memory

rotary phone with acoustic coupler

[-] faebudo@infosec.pub 15 points 4 months ago

However I can see when any IPv6 begins with 2a02:12xx:: then it's Swisscom (biggest swiss ISP). But I can't remember any of their hundreds of IPv4 prefixes.

[-] ulterno@lemmy.kde.social 13 points 4 months ago

I have a feeling making it all CAPS would have made it just a bit easier.
That, or using monospace fonts for it everywhere.

[-] hank_and_deans@lemmy.ca 4 points 4 months ago

I recite IPv6 addresses on my company networks from memory all the time. It helps that we got a bit lucky on our allocation. There are no letters.

Plus it's really easy to number subnets in a way that makes sense.

load more comments (3 replies)

[-] Kerb@discuss.tchncs.de 43 points 4 months ago* (last edited 4 months ago)

::1 is the new 127.0.0.1
:: abbreviates empty fields
ipv6 has more addresses
there is something going on with mac addresses (asside from arp)

thats all i remember

[-] tburkhol@lemmy.world 35 points 4 months ago

fd00:: is the new 192.168

[-] twei@discuss.tchncs.de 11 points 4 months ago* (last edited 4 months ago)

~~fc00::/7 are ULA (basically what RFC1918 was for IPv4)~~ not entirely true, fc00::/8 is part of ULA, but it is not yet defined. Use fd00::/8 instead.
2001:db8::/32 is for documentation purposes

[-] eclipse@lemmy.world 3 points 4 months ago

IMO they shouldn't have allowed ULA as part of the standard. There's no good reason for it.

[-] nonentity@sh.itjust.works 7 points 4 months ago

I use ULA prefixes to ensure the management interfaces of my devices don’t leak via public routes.

It’s one of the unique parts of the standard IPv6 stack not back ported to IPv4, that an interface on any host can be configured with multiple addresses. It permits functional isolation with the default routing logic.

IPv6 is far from perfect, but the majority of the arguments I’ve seen against deploying it are a mixture of laziness, wilful ignorance, and terminal incuriosity.

load more comments (2 replies)

load more comments (4 replies)

load more comments (2 replies)

[-] feoh@lemmy.ml 27 points 4 months ago

I keep hearing this, and I KNOW it's true at the enterprise level, but I've been running my home LAN IPv6 native for the last - 6+ years? Ever since I learned Comcat would vend it to you from their stock router.

Works great. No problems. Didn't used to be that way, but these days most (more?) of the stack bugs have been shaken out.

[-] PowerCrazy@lemmy.ml 8 points 4 months ago

I'm a network engineer and I run ipv6 natively in all of our datacenters. There are even a handful of end systems that have ipv6 native networking stacks with ipv4 sockets for our non-ipv6 compatible applications. IPv6 issues are basically self-inflicted at this point by companies that see their IT systems as cost centers, or by basilisk directors who's knowledge stopped in the 90's.

load more comments (1 replies)

[-] EtzBetz@feddit.de 22 points 4 months ago

I am hosting a few services on my LAN over IPv6, except for Plex, which I am tunneling through IPv4, since Plex itself used to have issues with IPv6.

It's always funny when friends complain that one of my services is down, it was 100% IPv6 not working/enabled/willingly disabled on their site yet.

[-] sgibson5150@slrpnk.net 18 points 4 months ago

I made an effort to learn it. In 2000. Again in 2012 or whenever the last big push was. If past is prologue, I may need to learn it again soon. 😆

[-] lord_ryvan@ttrpg.network 10 points 4 months ago

Ah, Dutch directness... Nothing says clear communication louder than the Dutch

[-] Boomkop3@reddthat.com 17 points 4 months ago

It's an edited image, but you are darn right. Proper communication is great

[-] lord_ryvan@ttrpg.network 7 points 4 months ago* (last edited 4 months ago)

It is in the style of the original, where during Covid the page on “Migrating to the Netherlands” simply just started with “Do not migrate to the Netherlands”, before expanding on the Covid restrictions on place and what foreign nationals currently in the Netherlands are to do.

On one hand: Now that's loud & clear communication. On the other hand, “Just don't” really ties in to the stereotype of Dutch directness/rudeness.

load more comments (1 replies)

load more comments

this post was submitted on 24 Jun 2024

686 points (97.9% liked)

Programmer Humor

32476 readers

916 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

Posts must be relevant to programming, programmers, or computer science.
No NSFW content.
Jokes must be in good taste. No hate speech, bigotry, etc.

founded 5 years ago

MODERATORS

AgreeableLandscape@lemmy.ml

cat_programmer@lemmy.ml