Hacker News Reader

Comment by wfunction | Hacker News Reader

> That said, while HTTP/2 is now out, IPv6 is still a sad story, especially with AWS.

The problem I see with IPv6 is that it very much encourages a unique, even static address for each device on your network, which is a privacy and security hole that NAT addresses for IPv4. So I'm not exactly dying to use it if I can avoid it.

View on HN

> The problem I see with IPv6 is that it very much encourages a unique, even static address for each device on your network

this is what ipv6 privacy addresses[1] are for! they are on by default on Windows, for Linux you need change a sysctl

[1]: https://en.wikipedia.org/wiki/IPv6#Privacy

They're the default on OS X as well for recent versions

With a /64 (which is the standard given to residential connections) you could have a new ip address every second for your computer's entire lifetime if you wanted to and still have the majority of the address space on the internal network available.

If you have a properly configured firewall why is it problem? Especially given the massive address space.

> If you have a properly configured firewall why is it problem? Especially given the massive address space.

Privacy? Security? Do you really need the whole outside world to know how many computers are on your network, and which one is browsing which sites or doing what exactly at which time? Most people don't, for privacy reasons... and if an attacker can single out a particularly sensitive computer to target, then that becomes a security risk too. If it's avoidable then you avoid it, it's as simple as that.

EDIT: I don't understand these random downvotes. The concern actually exists, that's why (as one comment pointed out) people have been proposing privacy extensions to IPv6. What in the world are people downvoting? You don't like reading facts?

You're likely being down voted due to your attitude. It's one thing to politely argue a position, quite another to ask rhetorical questions as though everyone else is stupid for not knowing the obvious.

Thanks for explaining, but what attitude are you seeing in the first [1] post? In this one I was annoyed at the downvotes on the first one and (later) this one, but what was wrong with the first one? People downvoted it for no reason... this seemed just a continuation of that.

[1] https://news.ycombinator.com/item?id=14054811

That post seems fine. I'm not sure why it was downvoted.

If it makes you feel any better, some of my comments get downvoted too, especially in the first hour or so. Then over the next 24-48 hours the scores will go up again.

The worst thing to do is complain about the downvoting, though, because that pretty much forecloses any chance of recovery.

People aren't proposing privacy extensions, it's a finished standard that's been enabled by default in most major operating systems for many years now.

> People aren't proposing privacy extensions, it's a finished standard that's been enabled by default in most major operating systems for many years now.

Apparently [1] it's not that simple, and apparently [2] stuff came after that standard in as late as 2014 (and I can't really say I've been keeping up with IPv6 news enough in the past 3 years to know how things look different right now compared to 2014).

I also see a related Defcon article from 2015 [3] which claims "IPv6 is bad for your privacy" though I haven't read it yet.

[1] http://www.internetsociety.org/deploy360/blog/2015/02/ipv6-s...

[2] https://tools.ietf.org/html/rfc7217

[3] https://www.defcon.org/images/defcon-15/dc15-presentations/L...

That, and firewall support for IPv6 sucks.

???

On what devices? Home routers, probably. Things with an extensible stack based on bsd or linux, no, they have very good firewalls. Better I would say, since you don't have to deal with NAT crap.

Reply on news.ycombinator.com