Why not just expect your OS's DNS setup to actually just work?
Maybe use an OS or DNS stack that isn't terrible?
Incredible asking for a not-broken DNS and IP stack is just too far out there when it seems most of the closed source OS platforms seem to manage just fine.
Or let me guess, you've specifically configured it to not "leak" such useful information?
Admitting that ipv6 has some downsides, however minor they may seem to you, won't hurt your quest to render ipv4 obsolete.
In fact being less insufferable is how you win people to your causes, not by laughing at their genuine albeit minor issues.
> Yeah. The date notwithstanding, I do actually think we should do most of this for real.
> Maybe we don't get away with the actual deprecation and the warnings on use just yet, and maybe we won't even get away with calling the config option CONFIG_LEGACY_IP, although I would genuinely like to see us moving consistently towards saying "Legacy IP" instead of "IPv4" everywhere.
> But we should clean up the separation of CONFIG_INET and CONFIG_IPV[64] and make it possible to build with either protocol alone.
1. SLAAC means routers no longer need to keep a record of each client on the network. With DHCP, the router had to maintain a table of which addresses had been assigned and getting an address involved 2-way communication. With SLAAC the router just periodically broadcasts the prefix to the network and any device that wants an address can just listen to that broadcast and assign themselves an address within that prefix without having to inform the router and without the router needing to maintain a table of assigned addresses. (2-way communication is still possible since devices can solicit a broadcast but it is not necessary)
2. With IPv6, middleboxes are no longer allowed to fragment packets. The only device that can fragment a packet is the original sender. If any segment along the path has a lower MTU than the size of the packet, the original sender is notified and then they can fragment the packet.
Or all the Container based stuff that still falls flat with ipv6 only modes. Docker still shits the bed if you dont give it ipv4 unless you do a lot of manual overrides to things. A bunch of Envoy based gateway proxies fail on internal ipv6 resources in a k8s cluster that runs on ARM64.
There is just a bunch of nonsense you have to deal with if you choose the ipv6-only route
Dont get me started on CDNs like Bunny or Load Balancers as a service like those from Hetzner, UpCloud, etc that don't work with ipv6 origins.
Source: Trying to run a ipv6 only self-hosted box on hetzner.
Baked in advertising? Works with any network. The option to turn off the baked in advertising? That needs IPv4.
seccomp could only do this partially, in that there are other avenues (e.g. io_uring), and I want it to be the case throughout the boot process.
Want to use IPv6? Fine. But don’t try to remove v4 support from people who have built stable networks around it.
You won’t be able to force the world to switch to IPv6 with tricks like this, any more than you can force old industrial machines to stop using ancient 486es as controllers. There is a lot of old equipment in the world.
IPv6 was built to work alongside v4, and there is no reason to change that.
How does "allow building Linux to be IPv6-only" somehow "deny others their freedom" exactly? I'm willing to wager most distributions will still be dual v4+v6, but if they aren't, isn't that something for you to bring up with your distribution rather than that the kernel just allows something?
I have no problem with allowing optional IPv4 or IPv6 only builds as long as both are kept well-maintained.
But so what? It still doesn't remove v4, in any shape or form, and if that was proposed to the kernel, I'm again fairly confident it'd be rejected.
> I also see hostility towards IPv4 in the comments here and other similar discussions
Ah, yeah that might be. I just saw your comment first, with no context of what you were actually answering, so it kind of looks like you're replying "to the submission", which really isn't denying any freedoms, I guess I was confused about that, my bad. Still, wouldn't it be better to answer directly to those comments, rather than "replying" to an argument/debate that is actually happening elsewhere?
The reason that I don’t like seeing patches like this, even as a “joke”, is that there are real people who would like to see IPv4 removed (possibly by government intervention) in order to achieve their dream of an IPv6 only internet. The whole idea is preposterous, but here we are. It’s about as realistic as banning cars but that doesn’t stop the endless flame wars about it.
Someone has to step in to point out that v4 and v6 were designed to coexist, this is fine, please don’t remove common standards for your personal preferences.
- I don't want my devices to have public, discoverable IPs
- I like NAT and it works fine
- I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface)
- I don't need an entire /48 for my home network
IPv6 won't help the internet "be addressable." Almost everyone is moving towards centralized services, and almost no one is running home servers. IPv4 is not what is holding this back.
NAT may work fine for your setup, but it can be a huge headache for some users, especially users on CGNAT. How many years of human effort have gone towards unnecessary NAT workarounds? With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers.
Your ISP shouldn't be rotating your /64, although unfortunately many do since they are still IPv4-brained when it comes to prefix assignment. Best practice is to assign a static /56 per customer, although admittedly this isn't always followed.
And if you don't need a /48... don't use it? 99.99% of home customers will just automatically use the first /64 in the block, and that's totally fine. There's a ton of address space available, there's no drawback to giving every customer a /56 or even a /48.
Like, wouldn't e.g. IPv6 theoretically make "ISP's charging per device in your home" easier, if only a little bit? I know they COULD just do MAC addresses, but still.
https://www.rfc-editor.org/rfc/rfc8981.html
Again, my point isn't about what is possible, but what is likely. -- which is MUCH MORE IMPORTANT for the real world.
If we'd started out in an IPv6 world, the defaults would have been "easy to discover unique addresses" and it's reasonable to think that would have made "pay per device" or other negatives that much easier.
I'm not an IPv4 apologist though. Clearly the NAT/DHCP assignments from the ISP are essentially the same risk, with just one shallow layer of pseudo-obscurity. I'd rather have IPv6 and remind myself that my traffic is tagged with my customer ID, one way or another.
Unfortunately, I see no real hope that this will ever be mitigated. Incentives are not aligned for any ISP to actually help mask customer traffic. It seems that onion routing (i.e. Tor) is the best anyone has come up with, and I suspect that in today's world, this has become a net liability for a mundane, privacy-conscious user.
So the same as the public IPv4 on a traditional home NAT setup?
I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand; revenge DDoS is not unheard of in the gaming world.
Do you ever connect your laptop to any network other than your home network? For example, public wifi hotspots, hotel wifi, tech conferences, etc? If so, you need to be running a firewall _on your laptop_ anyway because your router is no longer there to save you from the other people on that network.
It's also a good idea even inside your home network, because one compromised device on your network could then lead to all your other firewall-less devices being exploited.
It's probably less than three clicks on most home router web UIs.
edit: typo
This feels like a strawman. If you are making the sort of change that accidentally disables your IPv6 firewall completely, you could accidentally make a change that exposed IPv4 devices as well (accidentally enabling DMZ, or setting up port forwarding incorrectly for example).
So here's the thing. My ISP does _not_ rotate my IPv4 address, but _does_ rotate IPv6. Why? I'll never know.
Anyhow. I'm not confused about NAT vs. firewalling. No one who dislikes IPv6 is confused by this.
What would be the advantage in it?
What would be the disadvantage?
I don't want VPNs between private ranges.
I don't want publically-routable IP addresses on anything.
However if I change my ISP I get a new one, and that means a renumbering.
Suddenly, your smart lightbulb is accessible by everyone. Not a great idea.
> With IPv6, if you want a peer-to-peer connection between firewalled peers, you do a quick UDP hole punch and you're done - since everything has a unique IP, you don't even need to worry about remapping port numbers.
There is no guarantee with IPv6 that hole punching works. It _usually_ does like with IPv4.
A firewall solves that issue, IPv4 or IPv6.
The answer here is kinda that Wi-Fi isn't an appropriate networking protocol for lightbulbs (or most other devices that aren't high-bandwidth) in the first place.
Smart devices that aren't high bandwidth (i.e. basically anything other than cameras) and that don't need to be internet accessible outside of a smart home controller should be using one of Z-Wave/Zigbee/Thread/LoRaWAN depending on requirements, but basically never Wi-Fi.
Big companies would abuse that beyond belief. Back around the late 90s ISPs wanted to have everyone pay per device on their local networks. NAT was part of what saved us from that.
IMO, IPv6 should have given more consideration to the notation. Sure, hex is "better in every way" except when people need to use it. If we could just send the IPv6 designers back in time, they could have made everyone use integer addresses.
It's simple, unambiguous, and scales infinitely.This is a joke right? How does it "scale infinitely"? It is clearly ambiguous in your ipv7 example.
But with IPv6 a single device may have multiple addresses, some of which it just changes randomly. So this idea that they'll then know how many devices you have and be able to pay per device isn't really feasible in IPv6.
A single /64 being assigned to your home gives you over 18 quintillion addresses to choose from.
If the ISP really wanted to limit devices they'd rely on only allowing their routers and looking at MAC addresses, but even then one can just put whatever to route through that and boom it's a single device on the ISP's lan.
We may also argue that NAT basically forces you to rely on cloud services - even doing a basic peer to peer VoIP call is a poor experience as soon as you have 2 layers of NAT. We had to move to centralised services because IPv4 made hosting your own content extremely hard, causing little interest in symmetrical DSL/fiber, leading to less interest into ensuring peer to peer connections between consumers are fast enough, which lead to the rise of cloud and so on. I truly believe that the Internet would be way different today if people could just access their computers from anywhere back in the '00s without having to know networking
Either EIM/EIF (preferably with hairpinning) where you can practically do direct connections but you have to limit users to a really low number of "connections" breaking power users.
Or EDM/EDF where users have a higher number of "connections" but it's completely impossible to do direct connections (at least not in any video/voice calling system).
I'm in favor of having society overrule you. NAT is a horrible kludge and not okay. Never was.
An "ip address show" is messy with so many addresses.
Those public IPs are randomized on most devices, so one is created and more static but goes mostly unused. The randomly generated IPs aren't useful inbound for long. I don't think you could brute force scan that kind of address space, and the address used to connect to the Internet will be different in a few hours.
Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming. Hosts have firewalls too. They also block everything. Back in the day, my PC got a real public IP too.
NAT really is nice for keeping internal/external separate mentally.
I'm lucky enough my current ISP does not rotate my IPv6 range. This, ironically, means I no longer need dynamic DNS. My IPv4 address changes daily.
A residential account usually gets a /56, what are you talking about? Nowhere near a /48! (I'm just being funny here...)
There are reasons to need direct connectivity that aren't hosting a server. Voice and video calls no longer need TURN/STUN. A bunch of workarounds required for online gaming become unnecessary. Be creative.
Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.
Some of my devices have 1, some 2, and some even more. Takes some precision out, at least.
With ipv4 it can see one ipv4 address
Now sure that 58 could all be on one device with 58 different IPs and using a different one for each connection
In reality that's not the case.
The only difference is most ISPs rotate IPv4 but not IPv6.
Heck IPv6 allows more rotation of IPs since it has larger address spaces.
There are a number of footguns for privacy with IPv6 that you need to know enough to avoid.
On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)
But from a security standpoint you can just do the same tracking for the same result. That is just technically a firewall at that point.
That addresses all of your concerns, and you have that option.
So what's the point in ipv6?
The place where it hurts is small VPSs, from AWS to mom and pop hosters, the cost of addresses is becoming significant compared to low cost VPSs.
Only because most people don't know how NAT is hurting them, and because corporations have spent incredible resources on hacking around the problem for when peer to peer is required (essentially only for VoIP latency optimization and gaming).
NAT hurts peer to peer applications much more than cloud services, which are client-server by nature and as such indeed don't care that only outgoing connections are possible.
That's good advice! But firewall hole punching is also significantly easier (and guaranteed to work) compared to NAT hole punching. Address discovery is part of it, but there are various ways to implement a NAT (some inherently un-hole-punch-able) and only really one sane way to do a firewall.
> you'd need the average person to mess with their router configuration,
At least with IPv6, that firewall is likely to exist in the CPE, which sophisticated users can then ideally open ports in (or which can implement UPnP/NAT-PMP or whatever the current name for the "open this port now!!" protocol of the decade is); for CG-NAT, it's often outright impossible.
It does, and big tech has largely adopted IPv6.
For users with IPv6, the v6 path is often less constrained than then v4 path. Serving data faster/more consistently is of benefit to big tech. For a lot of users, v4 and v6 routing are different, which is also helpful for big tech. If you have two paths to the server (and happy eyeballs or something), you have more resiliance to routing issues.
Clouds are slow on v6, but CDNs are not. Adoption on eyeball networks has been very slow, and it's unlikely to speed up much, IMHO. The benefits of v6 for ISPs are not that big for established serviced with large v4 pools. For ISPs running CGNAT, more v6 means less CGNAT and CGNAT is a lot more expensive than plain ip routing. (Doesn't mean all CGNAT providers run v6, but it's an incentive).
That sounds so bad, it probably will be a windows feature.
Some things really can only be solved via central coordination, as there is no natural game-theoretic/purely economic path from one local minimum to another. Being able to dig a small trench and letting gravity and water do the rest is great, but sometimes you do need a pump.
I'm not convinced that IPv6 is such a case, but if it is, that's exactly the type of thing governments are much better at than markets.
Perhaps implementing an Odido tax might actually make Odido care enough to throw the switch on IPv6. They bought 2a02:4240::/32, they just refuse to make use of it.
This describes a lot of businesses ngl.
Bell in Canada is one huge head scratcher. They are one of the largest ISPs here and I can even buy 8 gig internet to my house if I want but they don't support IPv6.
He mentioned this because marking my connection as a "business" one without changing anything else would allow it to get IPv6 (a /64, bah).