Hacker News Reader

Comment by mikl | Hacker News Reader

The absurd lengths this industry goes to, only to avoid the switch to IPv6. Wish the FCC would step in with a mandate or something, it’s just long overdue.

View on HN

American here, I've had IPv6 on literally every device I've had for almost a decade now. Every mobile provider has been v6 since LTE. Comcast migrated to v6 over a decade ago because they exhausted 10.0.0.0/8 in their control plane network (they have a lot of cable modems). And I'm on Google Fiber now which is all v6.

There's probably a few other ISPs that need a good kick to the groin in the US, but the general feeling I get here is that the real stragglers in v6 deployment are other countries. Indeed, looking at Google's IPv6 map[0] it's all countries in Africa and the Middle East that have the worst v6 adoption. It's places where there isn't enough demand for addressing to make CGNAT unviable and IPv6 necessary.

[0] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

The industry is switching to IPv6, just slowly. Google's report of the fraction of users accessing its services on IPv6 steadily rises by a few percent a year. Right now it's at about 45%, so it'll be the majority in about two years.

Such a mandate would still be useful. Even of 80% of users can view things on ipv6, very few people will sacrafice the 20%.

I'd like to see rules that force ipv6 support, and then to prevent idiot network admins from disabling ipv6 locally because they're too lazy to learn how it works, make some websites v6 only. Start with essential government websites and move on to laws forcing more and more private websites to be v6 only to force people to maintain its functionality in their networks.

See: https://konecipv4.cz/en/

The market has been given its chance to move for DECADES and we're not NEARLY at the approximately 100% deployment that we need. It's time that we fix this mess.

Here's Google's graph: https://www.google.com/intl/en/ipv6/statistics.html

Adoption rate is currently increasing roughly linearly at a rate of about 5 percentage points every 12-18 months. Also note that there is a clear weekday/weekend pattern, with weekdays about 3-4 percentage points lower than weekends.

I wonder what happened in March.

Probably their data collection was just broken for whatever reason.

It means 100% adoption will be in 2040 using linear regression model.

IPv6 "adoption" is happening at roughly the same rate as the move to handheld devices becoming the primary browsing platform. The weekday split you see is people being on their work computers during the day and personal tablets/phones on weekends.

Very little progress has actually been made to move the bulk of stuff using v4 addresses over to v6. AWS v6 only instances have only been around for 20 months or so?

FWIW the weekday numbers are increasing too, they just lag the weekend ones a bit.

I don't know how to quantify "very little progress", but my home ISP (Verizon FiOS in NYC) got IPv6 relatively recently (maybe a year or two ago).

Anyway, don't most people connect to WiFi while using their handheld devices at home anyway?

> AWS v6 only instances have only been around for 20 months or so?

a) According to [0], AWS has provided IPv6 addressing to EC2 instances since 2016.

> IPv6 support for Amazon Elastic Compute Cloud (Amazon EC2) has been available along with IPv6 support for several other services since 2016.

Refer to the 2016 blog post at [1], which says (among other things)

> By default, every IPv6 address is public and internet-routable. For customers requiring a private subnet on their IPv6-enabled VPCs, we are introducing a new resource within the VPC called the Egress-only Internet Gateway, which can be setup to allow one-way access to Internet resources.

b) I don't get the "This migration only counts if we can support only IPv6 and shut off IPv4" obsession. I see no reason to shut off IPv4 within our lifetimes. I expect the distant future will be providing end-users with a globally-routable IPv6 prefix and a CGNATted-to-hell-and-back IPv4 address for reaching out to those sites that may still be using v4 only.

[0] <https://aws.amazon.com/blogs/publicsector/aws-enables-us-fed...>

[1] <https://aws.amazon.com/about-aws/whats-new/2016/12/announcin...>

> a) According to [0], AWS has provided IPv6 addressing to EC2 instances since 2016.

Yes, but that isn't what we are talking about. 2022 is when they added native IPv6 support, prior to that it was just a fancy NAT like translation.

> 2022 is when they added native IPv6 support, prior to that it was just a fancy NAT like translation.

Are you sure about that? The relevant docs from 2019 (the Wayback Machine doesn't have anything earlier) sure make it seem like you're getting globally-reachable IPv6 addresses:

From [0]:

> To complete this exercise, do the following: ...

> * Launch an Amazon EC2 instance into your subnet, and associate an IPv6 address with your instance during launch. An IPv6 address is globally unique, and allows your instance to communicate with the Internet.

Yes, the last bit of that doesn't automatically mean that your instance is globally-reachable. Read on.

From [1]:

> IPv6 addresses are globally unique, and therefore reachable over the Internet. You can control whether instances are reachable via their IPv6 addresses by controlling the routing for your subnet, or by using security group and network ACL rules. For more information, see Security.

From the "Inbound" table of the "Recommended Rules for Scenario 1" section of [2]:

> | 170 | IPv6 address range of your home network | TCP | 22 | ALLOW | Allows inbound SSH traffic from your home network (over the Internet gateway). |

Am I missing some part of the docs where they talk about how there was some fancy NAT-like translation box that made it so that these weren't globally-reachable IP addresses? Was AWS just lying in their docs?

[0] <https://web.archive.org/web/20190131164146/https://docs.aws....>

[1] <https://web.archive.org/web/20190801182729/https://docs.aws....>

[2] <https://web.archive.org/web/20191021190354/https://docs.aws....>

You seem to be confusing being able to reach IPv6 with native IPv6. With rare exceptions AWS does not document how their internal network functions because it is a trade secret. However for the longest time it was fairly easy to test: if you removed the IPv4 address from an instance it was no longer reachable via IPv6.

AWS was never built with IPv6 in mind and it is mostly glued on. As of right now 88% of AWS services are IPv4 only: https://awsipv6.neveragain.de/ (uncheck the Hide IPv4 only box)

> You seem to be confusing being able to reach IPv6 with native IPv6.

I mean, on the one hand, I'm taking AWS at their word. If they wrote subtle lies into their docs, one can hardly be blamed for failing to understand the truth of the situation.

But on the other hand, if

* My VM has its globally-reachable IPv6 address assigned to it

* Can transmit packets to globally-reachable IPv6 hosts using that address

* Can receive unsolicited packets from globally-reachable IPv6 hosts on that address

whatever hairs you're splitting seem to be a distinction without a difference? Based on my professional experience, "wacky SDN stuff" is par for the course in the Public Clown.

Or, to put it another way, the customer of an ISP couldn't care less about how exactly that ISP delivers them globally-reachable IPv6 service, just so long as it behaves exactly like you'd expect globally-reachable IPv6 service to behave. Maybe between the customer's edge router and the Internet the ISP has some wacky tunnel that runs only over IPv4, and breaks IPv6 service if you turn it off... the customer doesn't give any shits, just so long as the IPv6 service works correctly and reliably.

> As of right now 88% of AWS services are IPv4 only...

This to me is an entirely irrelevant statistic. My expectation is that end-user systems aren't going to be IPv6-only for a very, very long time, but are going to nearly all have globally-reachable IPv6 addresses relatively soon.

So, one should (for the foreseeable future) expect global bidirectional reachability for end-user systems on IPv6, and typical NAT "initiated by end-user request" reachability for end-user systems on IPv4.

IPv6 is still second-class for a lot of AWS's other services, so unless you treat AWS as just an overpriced VPS/colo it's not going to work all the way through.

my ISP has no plans for it.. and even escalating it to the highest levels the best answer was something like they're focused on upgrading physical infrastructure and aren't bothering with IPv6 at this time (despite me casually asking for 10+ years)

We need the FCC to say its a requirement for 2028 or some such year

You do realize that the FCC doesn't have jurisdiction over pretty big parts of the Internet?

Sure, but what happens in the U.S. part of the Internet tends to set the tone for the rest. A U.S. mandate would do a lot to swing things in the right direction, and many other countries would likely follow along and pass similar mandates.

Even if its just “all US residential services have ipv6 by 2028” fixes a lot of the chicken and egg

Yeah, problem is that we’re competing with ~99.99% for IPv4. So until IPv6 gets in that ballpark, most Internet servers (HTTP and friends) will still need to IPv4 addresses. And as long as that is true, many companies won’t bother and their service will be IPv4 only. Meaning ISPs must continue to offer IPv4 connectivity to their customers.

A true chicken and egg problem.

At this rate, we’ll be struggling with IP-shortages, CGNAT and other fun things for decades to come. And it’s all so unnecessary.

Just drop all ipv4 traffic for one minute at noon UTC every day. Next month, extend it to two minutes. The stragglers will switch.

This is how you end up with a nationwide ban on IPv6. When traffic lights start flashing red, flow control valves in the water distribution system fail safe closed, and ATMs don't work people will quickly discover the correlation with your silly plan.

If any of those things happen because of a one-minute interruption in internet connectivity, the people who implemented them that way should be pilloried. What an absurd strawman.

The government should start by rolling out IPv6 for its own stuff before telling others what to do. I say this because they need to learn how to do it too/first.

USA is has to much legacy interim to do this. I think India has the best leverage having being one the highest IPv6 adoption and shear number of internet users, so it easier get all main blockers of IPv6 only internet usuable.

Networking software and routers without ipv6 should be considered a security issue at this point and should have CVEs assigned against them. It's amazing how we deprecated unencrypted http across the internet but still use the equivalent for ip addresses.

Ipv4 is deeply flawed and needs to be replaced, but how is it insecure? CVEs are specifically for security issues.

This is NOT how the CVE system is used.

> It's amazing how we deprecated unencrypted http across the internet but still use the equivalent for ip addresses.

This makes no sense, http is flawed because its unencrypted and allows MITMing information.

IPv4 is flawed merely because it doesn't have enough addresses.

How are these two comparable? Your proposed "solution" is overkill and is completely ridiculous.

It’s not a logical argument, but if we only take the part about the transition to https, the difference was that https and http coexisted with mostly full compatibility to go between the 2 for its whole life. And it lives at layer 4.

A more cogent argument is that IPv4 and IPv6 have not fully coexisted like http/https, where you can pull the ipv4 rug out and every packet has an ipv6 path like http to https did.

Also more profoundly, https conversion had the benefit of every operator being able to transition on their own time frame. And people can still opt to use http if they so choose. IP not having that luxury is a profound problem.

> ...https conversion had the benefit of every operator being able to transition on their own time frame. ... IP not having that luxury is a profound problem.

This I don't get. I expect that Google will be far more likely to make it extremely difficult (or perhaps impossible) to use Chrome to visit non-TLS-wrapped HTTP sites on the Internet in the next five years than the operators of the various networks that make up the Internet are to just shut off IPv4 on their network.

I expect IPv4 will not be shut off within the lifetime of anyone posting on this forum today... and why would it be? Once just about everyone has well-functioning IPv6 access, release a recommendation to ISPs that unless a customer has an even vaguely-reasonable need for a globally-routable IPv4 address, that ISPs substantially reduce their IPv4 usage by providing IPv4 service to their customers through some CGNAT.

This would ensure that the few remaining hosts with IPv4-only service will remain reachable, that any customers who can bother to write a letter to their ISP asking for a globally-routable IPv4 address can get one, and a ton of IPv4 space gets opened up for whatever we might need to do with it in the future... just in case.

Ah yes, more abuse of the CVE system. Real Linux foundation vibes off this.

IPv4 is exactly as secure as IPv6.

So surprised that hacker news is stuck in ipv4 land. Even if you disagree with the method, I do not consider a device not capable of IPv6 to be using the real internet anymore. It's the same with the housing market where people would rather speculate on IPV4 houses instead of building plentiful IPv6 apartments.

Reply on news.ycombinator.com