Hacker News Reader

Comment by lelandbatey | Hacker News Reader

I will say just from a user standpoint, ipv6 is amazing. I recently made the switch to ipv6 on as many of my devices as possible purely because I can then access all of them directly, no network finangling.

Since all my devices have publicly visible ipv6 addresses, I can access them e.g.

    laptop.lelandbatey.com
    homedesktop.lelandbatey.com
    phone.lelandbatey.com

because I use tunnel brokers, sometimes the speeds not amazing, but the fact that I can connect at all makes it awesome. Also, those example hostnames are fake : )

View on HN

I do have to ask - what's a tunnel broker, aren't you worried about security of those devices and - is it really that useful?

Edit - if it is really that useful, is it not instead the death of cloud storage?

Yes, it really is that useful. The ability to directly connect to machines on my home network without mucking with VPNs, port forwarding, etc is fantastic. The key thing it does is reduces friction when creating or using anything that could be accessed from off the local network. The ability to assign static addresses to custom DNS entries makes it even better. The more services that throw up IPv6 support the more useful it gets. If I could pull from Github over IPv6... or run SSL Labs TLS tests against an IPv6 VM...

In particular, it is better than other VPN/port forwarding type solutions because it works transparently and universally. It works on your phone (where VPN can be more tricky). It works in environments where you aren't allowed to install special relay software. It works when you are a guest somewhere else without them having to change their network setup.

As for cloud services... yes and no. In a world with direct addressing you open up many opportunities for innovation in the home cloud appliance market. However, many cloud services are made affordable because they can leverage shared infrastructure, sell usage metadata, or add and remove capacity instantly. Whether home based solutions could be competitive in price and reliability without those abilities. I see some categories of service that it makes sense for, others, less so.

Security is a concern, yes, but one that can and should be addressed by good security tools and practices (firewalls, automatic security updates, good backups, not running services you don't use, etc) not by crippling your network with NAT.

I guess I had become so used to NAT it just seemed the natural order of things. I do think the security is still a major issue but then I like building my servers as if they are alone on the Internet so it makes sense

And yes, a good point about the reliability of cloud services - but still at 50 bucks for 2 TB and iCloud costing me 20 bucks a month I think Shared infrastructure savings have a long way to go !

Large capacity media servers are something I think makes sense as a home appliance. I also think that if people end up willing to put their money where their mouths are that there will be a market for devices that provide cloud like services with the privacy of local hardware.

Re: security. Cloud services aren't doing a lot better. They are repeatedly broken into and have huge password lists stolen, many have governments have direct programs for extracting datas from them, and someone else can call up their customer support reps and practically ask for your password. Many effective security best practices amount to obscurity (change ssh port number). Large central services are very attractive and lucrative to hack.

If I don't care about direct addressing of devices at home, is there any reason for casual internet users to use IPv6?

yes and no. As long as you are able to get a globally routeable ipv4 address for your home at a reasonable price, no. Once you start being subjected to CGN (either or your end or on the remote end) or the price pressure of IPv4 in your region then you will have a reason. Namely cost and performance.

Because of this I would suggest that if you go router shopping that you should choose a model that supports IPv6 rather than not, even if you don't necessary care which you will end up using. Get a model with a good IPv6 firewall that you can tell to block all incoming connections.

Lastly, I think it is dangerous for "casual users" to say things like "I don't care about direct addressing of devices at home". I firmly believe that universal direct addressing will result in new innovation that might change your mind. :)

The TL;DR of "what a tunnel broker is" is not something that I'm totally qualified to explain, but how I approach it is:

A tunnel broker is like VPN/proxy that allows you to connect to the IPv6 web over IPv4.

It adds latency to my connection (because all my IPv6 data goes from me, over IPv4 to the tunnel broker who then routes my data the rest of the way to where it's going), but for me it's worth it.

In terms of security, my machines are run largely the same as any server: locked down, except when for the things I need. It helps that I only do this for *nix devices as well.

I do a similar thing, work ISP provides native IPv6, home ISP doesn't but I'm using a tunnel broker with my router. It has a nice IPv6 firewall built in that lets me manually allow ports through which is nice. It's fantastic having multiple computers at home listening on port 80. :)

> aren't you worried about security of those devices

Assuming he is having a firewall configured on his gateway then it is not any different from security standpoint than being behind a NAT.

For example in my university, all computers have a public IPv4 address, it still does not mean you can connect to them from outside, but if you need to open a port to the world you don't need to deal with all that NAT crap.

What would be the security issue? NAT does not add any security - the firewall does. Just because you have publicly routable addresses doesn't mean they're publicly accessible.

NAT is a good "disallow everything by default" firewall. If my router's firewall had a "disallow all incoming connections by default, it would be great, although I guess I should manage it with iptables, which is machine-specific.

Most ipv6 enabled home routers have firewalls with a "block all incoming connections except for listed exceptions" feature. This effectively gives you the same security as NAT but without the port mangling (can run multiple machines on the same port).

6to4, SixXS, 6RD, and 6in4 are tunnels that are usable by pretty much anyone anywhere right now, as opposed to native IPv6. It helps if your router supports them, of course.

Cloud storage is really nice when your home PC is switched off, or a hard drive crashes, or your computer catches on fire. Other than those sorts of problems, BitTorrent Sync can already do pretty much everything you want over IPv4.

I deploy tinc[1] automatically in my base puppet config to give me direct connection over normal ipv4. It's a private network though so it won't work from a device I don't control as yours probably do.

[1] http://tinc-vpn.org/

Reply on news.ycombinator.com