Hacker News Reader

Comment by kuschku | Hacker News Reader

Amazon added it only recently for some properties – CloudFront was the latest, last September [1]

And Google has had it since forever [2]

That said, while HTTP/2 is now out, IPv6 is still a sad story, especially with AWS.

    ________

[1] "New – HTTP/2 Support for Amazon CloudFront" https://aws.amazon.com/blogs/aws/new-http2-support-for-cloud...

[2] "Full Speed Ahead with HTTP/2 on Google Cloud Platform", https://cloudplatform.googleblog.com/2015/10/Full-Speed-Ahea...

We’re not breaking any news here, because Google Cloud Platform support for SPDY has been enabled for many years, and support for its successor (HTTP/2) was enabled earlier this year.

View on HN

Could you explain what you don't like about IPv6 on aws? At the very least it seems to me it'd be the least "sad" on AWS.

Apparently I missed the news, I hadn’t heard about https://aws.amazon.com/blogs/aws/new-ipv6-support-for-ec2-in... yet. But it’s only in one region still.

Full IPv6 support, for everything, in all regions, is the plain minimum.

Sadly, OVH recently removed their IPv6 support, for whatever reason.

Still not IPv6 everywhere.

Its supported in all regions as of January 25: https://aws.amazon.com/blogs/aws/aws-ipv6-update-global-supp...

Yeah, I thought they knew. Here's what I thought might've been on their list

1. You get a single IPv6 per instance (as opposed to a CIDR range).

2. You still have to deal with IPv4 CIDR ranges

3. ...which means you have to deal with all the overlaps still :(

IMO I would love it if my ec2 instances were IPv6 only, and then use public IPv4 addresses or dual stack loadbalancers as necessary for public ingress.

> That said, while HTTP/2 is now out, IPv6 is still a sad story, especially with AWS.

The problem I see with IPv6 is that it very much encourages a unique, even static address for each device on your network, which is a privacy and security hole that NAT addresses for IPv4. So I'm not exactly dying to use it if I can avoid it.

That, and firewall support for IPv6 sucks.

???

On what devices? Home routers, probably. Things with an extensible stack based on bsd or linux, no, they have very good firewalls. Better I would say, since you don't have to deal with NAT crap.

> The problem I see with IPv6 is that it very much encourages a unique, even static address for each device on your network

this is what ipv6 privacy addresses[1] are for! they are on by default on Windows, for Linux you need change a sysctl

[1]: https://en.wikipedia.org/wiki/IPv6#Privacy

They're the default on OS X as well for recent versions

With a /64 (which is the standard given to residential connections) you could have a new ip address every second for your computer's entire lifetime if you wanted to and still have the majority of the address space on the internal network available.

If you have a properly configured firewall why is it problem? Especially given the massive address space.

> If you have a properly configured firewall why is it problem? Especially given the massive address space.

Privacy? Security? Do you really need the whole outside world to know how many computers are on your network, and which one is browsing which sites or doing what exactly at which time? Most people don't, for privacy reasons... and if an attacker can single out a particularly sensitive computer to target, then that becomes a security risk too. If it's avoidable then you avoid it, it's as simple as that.

EDIT: I don't understand these random downvotes. The concern actually exists, that's why (as one comment pointed out) people have been proposing privacy extensions to IPv6. What in the world are people downvoting? You don't like reading facts?

You're likely being down voted due to your attitude. It's one thing to politely argue a position, quite another to ask rhetorical questions as though everyone else is stupid for not knowing the obvious.

Thanks for explaining, but what attitude are you seeing in the first [1] post? In this one I was annoyed at the downvotes on the first one and (later) this one, but what was wrong with the first one? People downvoted it for no reason... this seemed just a continuation of that.

[1] https://news.ycombinator.com/item?id=14054811

That post seems fine. I'm not sure why it was downvoted.

If it makes you feel any better, some of my comments get downvoted too, especially in the first hour or so. Then over the next 24-48 hours the scores will go up again.

The worst thing to do is complain about the downvoting, though, because that pretty much forecloses any chance of recovery.

People aren't proposing privacy extensions, it's a finished standard that's been enabled by default in most major operating systems for many years now.

> People aren't proposing privacy extensions, it's a finished standard that's been enabled by default in most major operating systems for many years now.

Apparently [1] it's not that simple, and apparently [2] stuff came after that standard in as late as 2014 (and I can't really say I've been keeping up with IPv6 news enough in the past 3 years to know how things look different right now compared to 2014).

I also see a related Defcon article from 2015 [3] which claims "IPv6 is bad for your privacy" though I haven't read it yet.

[1] http://www.internetsociety.org/deploy360/blog/2015/02/ipv6-s...

[2] https://tools.ietf.org/html/rfc7217

[3] https://www.defcon.org/images/defcon-15/dc15-presentations/L...

Reply on news.ycombinator.com