Hacker News Reader

Comment by barkingcat | Hacker News Reader

Sad that even for experts ipv6 is still a no go filled with landmines.

When I was a network engineer I frequently experienced IPv6 skill rot. I'd go long periods of time not encountering it in the wild. It's hard to be confident with a thing you're not working with on a regular basis. I guarantee you I made mistakes because of it. There was only one maybe 2 year period where I would have considered myself an IPv6 expert.

Any tool can be used incorrectly. IPv4 mapped addresses are a part of the protocol as any "expert" would know.

How many bugs occur due to misconfigured HTTP servers every day? Do you conclude that HTTP is also a "no go"?

Which http are we talking about? HTTP3 that people wanted to use before the security portion of the spec. was even done? HTTP2 that had an entire section dedicated to possible exploits that where later found on major sites? Or HTTP 1 which enabled some of the exploits seen with 2 since implementations are neither consistent nor strict when parsing parameters?

Sometimes it feels as if the Internets security was supported by paper walls with a "please punch here to exploit" written all over the place.

Was gonna say, if this is about ipv4 vs ipv6, better also specify which version of HTTP we're talking about.

Does it matter? Every HTTP version from HTTP/1 to HTTP/3 has each experienced its own set of vulnerabilities.

Never stopped us from using HTTP.

IPv4 has had multiple vulnerabilities in its stack as well, never stopped the internet from growing. (But the exhaustion of IPv4 _is_ hindering further expansion of the internet!)

I mean it's not a good comparison. IPv4->6 is a migration, with a lot of difficulty having to do with the fact that v4 is already in use. HTTP wasn't a replacement for something, but there is HTTP1->2.

Reply on news.ycombinator.com