IPv6 Still Hotly Debated

Me too by Phroggy · 2005-11-10 05:53 · Score: 4, Insightful

To be honest, IPv6 never really made sense to me either. I mean, OK, so we're running out of IP addresses and we need more... but as more and more companies are turning to NAT instead of using public IPs behind a firewall for internal services, some IP blocks are being freed up, and it looks to me like there are still a HUGE number of reserved subnets out there.

But assuming we really do need more IPs, why IPv6? Why 128 bits instead of, say, 64? Why build the functionality of DHCP, which (mostly) works perfectly well* and is extensible enough to support cool stuff that hadn't been thought of when IPv4 and DHCP were invented (e.g. WPAD, netbooting), into IP? What's the deal with including your MAC address as part of your IP address?

Going with the assumption that the problem really is as bad as people say it is (China has a gazillion people and more of them are getting online, and it'd be great if my refrigerator had a web-based interface I could access remotely without setting up port forwarding or a VPN, etc.)... I'm not convinced that IPv6 is the right solution to the problem. It just seems to be the only solution anyone has offered, and a lot of money has been spent bringing it closer to reality.

So, convince me: why is IPv6 the right answer to the problem?

* Off-topic, but can someone explain to me why (at least with ISC dhcpd) I can't assign IPs on two different subnets on the same physical LAN? Can this be done with a different DHCP server? Is there any kind of limitation to the protocol that makes this impossible, or is it just an implementation problem?

--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;

Re:Me too by MightyMartian · 2005-11-10 06:03 · Score: 4, Insightful

NAT really isn't anything more than a kludge, and despite a lot of work done to make some of the finickier protocols work through it, the point behind IPv6 is to create an address space sufficiently large that we don't have the provisioning problems that are evolving now. Is it overkill? Well, for 2005 there's no doubt. But IP4 was probably massive overkill in 1980. The point here is that these artificial limits we've set (640k, IP4, two-digit years) eventually lead to very big hastles, and if we're going to have to find some new way to enlarge the address space, why not do it right?

--
The world's burning. Moped Jesus spotted on I50. Details at 11.
Re:Me too by cnlohfin3109 · 2005-11-10 06:06 · Score: 5, Insightful

IPv6 gives us more then just more address space. The ip is designed heirarchally(sp) which will help _significantly_ with routing, decreasing tables etc. Not to mention not wasting time havening to check checksums all the time... cause there is none! Its silly if we get into the terabit speeds and still wasting so much time just tring to route the ethernet frames, not to mention the sheer processing power required by a router for those speeds.
Re:Me too by exaviger · 2005-11-10 06:21 · Score: 4, Insightful

Nicely put, just to stengthen your point - a little historical snippet "In the early days of mainframe computing, resources were at a premium. Memory was expensive, disk storage was limited and input devices constrained. Every programming method was used that made efficient use of each component. One of the methods used was to truncate the year value to a two digit number for entry, storage and processing. This saved space and saved on the associated cost of storage and processing. After all, why enter and store the century portion of the date when it will always be 19? Right? It would be decades before the year 2000. By then, all the programs and hardware being used would be obsolete and replaced with newer equipment and programs." Do we not learn from our mistakes? Calling IPv6 overkill is silly, why should we not overkill? Why not make sure that for the next century every electronic device will be able to have its own unique IP address. NAT is all good and well but what about the growing number of mobile devices, what about some services that dont work behind NAT? Who knows what will happen in 5,10,50 years. Soon every single vehicle, vending machine, traffic light and any other electronic device will require and IP address be it public or local. I am all for IPv6!
Re:Me too by Anonymous Coward · 2005-11-10 06:22 · Score: 1, Insightful

The firewall's what is providing the security there. The NAT portion is doing the opposite, as it's opening up a route through the firewall.
Re:Me too by Kadin2048 · 2005-11-10 06:52 · Score: 5, Insightful

This is a misunderstanding, and has been debated elsewhere: NAT offers no security by itself, it's because normally NATs have a firewall effect at the same time that they create the illusion (and in some cases reality) of security.

There's no reason why using IPv6 with a firewall wouldn't be just as -- and probably more -- secure. Especially because you wouldn't have to spend time configuring the NAT functionality and could instead configure it as a single-purpose stateful firewall.

It is possible -- although you probably wouldn't want to -- to create a situation using static NAT without any firewalling effect that leaves your computer just as open to attack as it would sitting on the public net. Likewise it's possible to assign every computer on a LAN a globally routable IP address and secure them using a properly designed firewall (that's actually how my company is set up).

If your comment had just said you didn't want your fridge and toaster exposed to the internet without your trusty Linux firewall between it and the internet, I would heartily agree. Although I don't doubt some would argue for you about choosing Linux over BSD. :)

--
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Re:Me too by Jonathan+the+Nerd · 2005-11-10 07:13 · Score: 2, Insightful

...it lacks the ability to personally manage your host network address space with a memorizable number.
You can still use DHCP with IPv6, and you can still assign specific addresses manually if you want to. It's just that, with IPv6, you can choose to do neither of these and all your computers will give themselves non-conflicting IP addresses automatically. The sheer size of the host portion of the address means that the chances that two different hosts will assign themselves the same IP address is essentially zero.

--
Disclaimer: The opinions expressed are not necessarily my own, as I've not yet had my medication today.
Re:Me too by MicahStevens · 2005-11-10 07:14 · Score: 3, Insightful

You can hack through a NAT, not being l33t, I'm unfamiliar with the exact practice, but I've seen security reports about this.

My real point is though, If you have a device like your toaster on the internet, and it's vulnerable to an attack that a firewall fixes, the problem is with your toaster, not the internet. That whole example is totally weak.

Why do you want to connect your toaster to the internet, so that you can connect to it, right? Or make connections out from the toaster. Either way, you need ports open. If someone can connect to ports that you don't want open, the software/hardware in the toaster is to blame. Not the absense of a firewall, or NAT. If your toaster can be hacked through the toaster port, then a firewall ain't going to help you.

This overreliance on the firewall is disturbing to me, it makes people not fix the real issues. Granted with certain general purpose machines (i.e. your Desktop workstation) this is more difficult than others, but there's no reason why an embedded internet-aware processor can't be very secure with no firewall or NAT fo that matter. If it's not, fix the problem, don't mask it with a firewall.
Re:Me too by gclef · 2005-11-10 07:21 · Score: 2, Insightful

You know, every time I hear that argument, I want to ask this: yeah, but can your switch/router store that many incomplete arp entries for all the hosts that got scanned but aren't there? I suspect the first time someone really does a big sequential scan of IPv6 space (non-firewalled, like customer DSL or Cable space), you'll see some very unhappy network engineers trying to figure out why their big 6500's are running out of RAM.
Re:Me too by Denis+Lemire · 2005-11-10 07:23 · Score: 2, Insightful

The reason IPv6 uses such a large address space is to allow for the wasted IP addresses caused by the hierarchy based routing approach now in popular use to minimize the number of routes needed on the Internet's core routers.

ie) Class C sized /24 netblocks are no longer individually routeable on the core internet routers. Instead larger blocks are delegated to large providers who then subdivide them down to the smaller providers and so forth.

Subnetting in this fashion introduces overhead and wasted IP addresses. The huge address space of IPv6 makes this overhead and wasted IP addresses a non-issue.
Re:Me too by eric76 · 2005-11-10 07:49 · Score: 4, Insightful

Security by obscurity is not the answer

I hate that phrase. While true, it is very misleading since obscurity does contribute to security.
It should be "Security by obscurity is not the TOTAL answer.
Security by obscurity is a necessary and vital part of security. By reducing the likelihood of computers being randomly attacked over the Internet, there would be an increase in security. It would not provide absolute security, but it would help.
If you think about it, when you use passwords, you are using security by obscurity.
For that matter, when you use a public key that is the product of two very large primes, you are using security by obscurity. With increases in techniques and hardware, that obscurity is greatly reduced overtime and the security suffers.
Re:Me too by Cramer · 2005-11-10 08:05 · Score: 2, Insightful

[see also: my recent comment]

I do see that I said worst case. We don't have 2^20 route entries right now (and actually cannot with reserved space, multicast, etc.) Nor will we actually ever see 2^64 IPv6 prefixes. (certainly not within my lifetime, I hope.) The original commenter has missed the point of "more address space": more people will have globally routed networks. That means more prefixes, not less. Route aggregation will only go so far; depending on it is more of a "kludge" than IPv4 NAT.

And routers will have to handle all 128bits in their tables -- there could be network tables and more detailed sub-network tables, but as the wizard says "that's another story" -- otherwise you've hardcoded the IPv6 landscape into a classful corner (and thus doomed yourself to repeating the lessons (not) learned from IPv4.)

HAH! Planning a global routing hierarchy. Excuse me while I get the Dr. Pepper out of my nose. First off, you'll never get the entire world to agree on a numbering plan. And second, you'll never be able to enforce it. Besides, the IPv6 design already poopoo's on such things... address assignments are portable -- to avoid the issues of renumbering when changing ISPs.

"IPv4 loyalists" by FirienFirien · 2005-11-10 05:57 · Score: 4, Insightful

What are the chances that the term "IPv4 loyalists" includes those who just have no reason to make the effort to shift to the new system? Considering the number of [people, admins, even that amusing case where MS didn't patch its own servers] who don't even download security patches - the shift to a parallel system while the old system still works fine just isn't going to happen in droves.

--
Browsing with +2 to insightful posts and a higher threshold makes the average post seen seem a lot more ingenious

Re:"IPv4 loyalists" by Phisbut · 2005-11-10 07:07 · Score: 4, Insightful

the shift to a parallel system while the old system still works fine just isn't going to happen in droves.
The real question though is "Do we really want to wait until the old system finally breaks and nothing works anymore before making the change?". The old system still works, but we know it won't work forever, and we know we need to change it. Why wait till it breaks?
(Obligatory car analogy) When you put gas in your car, there's still gas left in it, so it can still work. Yet you don't wait till you go dry to put some more gas in.

--
After 3 days without programming, life becomes meaningless
- The Tao of Programming

Re:Something I don't get... by Daedala · 2005-11-10 05:57 · Score: 3, Insightful

Sometimes, it's good that NAT impedes some forms of communication. Like, say, exploits.

--
What I say does not represent the views of my employers, my friends, my cats, or myself.

One Reason Alone is Enough by Nom+du+Keyboard · 2005-11-10 06:00 · Score: 5, Insightful

One reason alone is enough to make IPv6 a "good idea." Permanent static IP addresses for everything.

I, for one, will welcome the end of the NAT kludge.

--
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."

Re:One Reason Alone is Enough by denis-The-menace · 2005-11-10 06:06 · Score: 2, Insightful

One reason alone is enough to make IPv6 a "good idea." Permanent static IP addresses for everything.
I, for one, will welcome the end of the NAT kludge.

And your ISP will charge you for each Address you use!
NAT let's you use ONE IP from you ISP and have as many Internal IPs as you which without being gouged.

--
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Re:One Reason Alone is Enough by ebrandsberg · 2005-11-10 06:09 · Score: 1, Insightful

As a network engineer, I see your statement and laugh. NAT is the only thing keeping the internet together. Without NAT, the impact of worms and vulnerabilities would be so much worse than it is now the results would be unspeakable. NAT is the best way in general for networks to attach to the internet because it creates a "protected" zone where inbound transactions can't get to--and this is GOOD.
Re:One Reason Alone is Enough by hey · 2005-11-10 06:18 · Score: 2, Insightful

That's what firewalls are for. Not NAT.
Re:One Reason Alone is Enough by David+Greene · 2005-11-10 06:33 · Score: 2, Insightful

the laws of supply and demand suggest that the value of each IP address will approach zero.
Except that the "laws" aren't laws at all and are in fact closer to myth. The supply of an item does not determine its price. The price people are willing to pay determines its price.

--
Re:One Reason Alone is Enough by jafiwam · 2005-11-10 06:57 · Score: 2, Insightful

As far as repelling random unsolicited traffic is concerned, NAT is the equivalent of a firewall already.

NAT and simple port forwarding for those rare hosted services are all that 99.5% of the population needs. ISPs and businesses are all different. But even probably 80% of the businesses I deal with, NAT with NO port forwarding works just fine.

Of course if you are allowed and able, running a mail server at home is fun.

But get serious, NAT is an effective firewall for most people. Just like the random Chevy is good enough for most people. Saying "but but but it's not a porsche!" all the time just makes you look like an elitist geek.
Re:One Reason Alone is Enough by diamondsw · 2005-11-10 09:35 · Score: 2, Insightful

Yup, I got a bit pissed an deserve the flamebait moniker on that. I'll chill next time. However, after reading the same reason over and over from people who haven't set up "real" networks (enterprises, hosting, datacenters) it gets VERY tiresome. Maybe I'll just write up a decent reply and save a copy for the next time this comes up...

The ISP problem is one of artificial scarcity, which is exactly what IPv6 relieves. The only reason they charge in the first place is that IP's really are a limited commodity, and they can't give them out to every device. With IPv6, this is no longer an issue, and static addressing would be the norm (probably still managed by DHCP, but it would never change). Every piece of equipment worth anything has supported IPv6 for a long time now. Anything that doesn't (in 2005!) deserves not to work, home networking equipment included.

The amount of pure pain that NAT causes for network administration is incredible. I went into all of the routing problems in another post (asynchronous routing, excessive static routing, firewall problems, etc). Don't keep saying "we don't need to do things right, my kludge works fine (mostly)", just do it right already!

It *mostly* works for home networks, but still causes problems even there. It is still responsible for software having things like "this won't work unless you configure your router to forward these ports here", which also results in your being able to only use one of a given service "normally" on your network. Try to set up two web servers on your home network, both on port 80. With IPv6 and static addresses, you can; with NAT, you can't. P2P would be even easier (and probably more commercialized) if you could install the app and have it just work, but no, you have to forward a different range of ports for each protocol. None of this would be necessary if you had IPv6.

The only reason I've seen on this whole discussion to keep NAT is that it does allow your network to be completely abstracted from your ISP's address space. Agreed, that is certainly a benefit. However (you knew this was coming), it would be better still if instead of doing a one-to-many NAT, you did a one-to-one NAT. Keep your addresses abstracted, but avoid all of the problems and messiness of NAT (or PAT, as I probably should be calling it).

--
I don't know what kind of crack I was on, but I suspect it was decaf.

Moving Day at IPv4 by Anonymous Coward · 2005-11-10 06:01 · Score: 1, Insightful

"No one is running IPv6, because there is no business case for it ... if we really wanted to leave a legacy to our children we'd review the crap we have today which is pretty ghastly ...""

More like there's no easy upgrade path. The x86 survived and grew exactly because one could move from one generation to another. IPv6 doesn't have that advantage.

Market Forces by bizitch · 2005-11-10 06:01 · Score: 5, Insightful

Just like anything else, market forces will dictate when this gets adopted.

Are we really running out of IPv4 numbers? The market will tell us.

Is there a killer app for IPv6? The market will tell us.

Can we ram IPv6 down everyone's throat? The market will retailiate and hit back.

BTW - what's with this "wont somebody please think of the children" bullshit about? If we need to get to IPv6 - we'll get to it - relax already!

--
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano

IPv6 - too little, too late by hpa · 2005-11-10 06:04 · Score: 1, Insightful

Cisco is probably one of the companies responsible for IPv6 being such a mess it is. The IP router vendors, led by Cisco, pushed for as few changes as possible over IPv4 in order to leverage expertise and be ready for deployment quickly. So far, so good. It's lifespan (until another switchover would be needed) was estimated at 30 years; this is roughly how long IPv4 has lasted since it's predecessor, NCP, was retired.

However, everyone involved completely underestimated the cost of switchover and overestimated its rate of adoption. This ultimately means that IPv6 is not enough of an advancement to justify its deployment costs. The end result is that IPv6 is already one-quarter through its estimated 30-year lifespan and it isn't even widely deployed yet.

I suspect that what we need is an IPv7 that would include:

No fixed size address space limit.
Removal of the arbitrary distinction of hosts and ports in favour of a unified end point specifier.
Routing assistance built into the transport protocols, to augment the current AS system.

If we start now, this might be deployable by 2020 or so... :-/

Two reasons. by khasim · 2005-11-10 06:05 · Score: 3, Insightful

#1. It allows you to run multiple boxes at home WITHOUT having to pay extra for a "family" connection plan.

#2. Cheap and easy way to block worms and such.

Re:Two reasons. by Kadin2048 · 2005-11-10 07:26 · Score: 3, Insightful

Neither of these points are really arguments for the current system, if anything they're good arguments against it, and in favor of IPv6.

#1 is nothing but a direct consecquence of the current shortage of IPv4 addresses. Under IPv6, there'd be no reason why every device on your network couldn't get a separate "real" address. The way they're handed out -- using a hierarchy instead of finite blocks -- would allow your ISP to let your home DHCP router hand out globally addressable IPs if it was set up correctly. Assuming your ISP doesn't suck, that is, and that's really not the fault of the IP system, one way or the other.

#2 is pretty frightening, because it shows a misunderstanding of what NAT is and a certain amount of laziness about security in general. That said, there's no reason why you couldn't get a 'firewall in a box' that would provide just as much (or as little) security without the NAT facility. It's just that right now when you go and buy a "home firewall" from Linksys, it almost always includes NAT by default (because of point #1, the pressure by ISPs on home users to only have one IP address due to limited supply). There's no reason why this needs to be true, however, and the security comes from the firewall effect and not the address translation itself.

--
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."

Re:Something I don't get... by MightyMartian · 2005-11-10 06:05 · Score: 4, Insightful

One does not need NAT to lock up vulnerable ports. I have a Linux-based firewall that covers my public IP Windows boxes, and it works fine.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.

NAT is not the answer! by kasparov · 2005-11-10 06:17 · Score: 4, Insightful

Anyone who has to deal with SIP absolutely hates NAT. SIP is a VoIP protocol that is pretty much where everything is headed. Some instant messenger clients/servers even use it. And it is most definitely not NAT-friendly. In SIP, the call setup information and the media can travel differnt paths. This means that endpoints can comunicate directly without having to send media through a central location. Since the SIP message contains a description of what ports to expect the audio to arrive on in the body of the packet, NAT boxes will generally block the media coming from the other device. 90% of the problems that VoIP providers end up having to deal with is NAT-related.

You have to go to all kinds of lengths (using special session border controllers, media proxies, etc.) to be able to support SIP calls where one or both parties are behind a NAT. It is awful. NAT is a hack--a useful one in certain situations, but still a hack.

--
There's no place I can be, since I found Serenity.

Re:NAT is not the answer! by Cramer · 2005-11-10 09:11 · Score: 2, Insightful

I've said it before, and I'm saying it again. EVERY problem that has cropped up with protocols not working through NAT has been attributable to the protocol being designed as though it authoritatively know things that it cannot authoritatively assess.

I see the problem with SIP after 30s of reviewing the RFC. Right there in Fig. 1... it tells the remote end how to connect back. That will not work reliably - period. NAT or not. The SIP client is picking an interface/hostname (at random) and feeding it to the remote client. For any machine that has more than one NIC, there exists the possibility the client will pick the wrong interface.

I have never seen an application with the necessary logic to correctly determine what INADDR_ANY should be for a remote client. Most simply pluck the hostname from the system (and to my surprise, not always with gethostname()!) and either send that or lookup the address and send that. Those that try (and fail) to be smart and fetch a list of interfaces, never bother to look at the route table to use the correct interface. (on linux they'd have to look through any rules as well.)

NAT is not the evil here. The protocol itself demands clear, unobstructed communications between peers. This is extremely unlikely on the internet. And that's not going to change. If your NAT and/or FW device is not SIP aware, you will have problems. It's not NAT or the firewall's fault the protocol was designed this way. The designers of the protocol are to blame for not concidering the existing medium through which it would have to work -- NAT and firewalls have been around much longer than SIP. (the truth is, SIP was never intended to cross these network boundries.)

Two big issues by augustz · 2005-11-10 06:17 · Score: 2, Insightful

One is, despite the claims that IPv4 will run out in the next "x" years and companies will be screwed, that never happens.

Worst case, folks will figure out how to get by on 1-2 ip addresses, or pay more than the $1/month or so to get an extra. There are TONS of unused, unrouted addresses out there through the entire hierarchy, from subnets, class b's etc.

Second, IPv6 and you can what? If I run IPv6 only, I need to at some point tunnel to IPv4 (and often get an IPv4 address anyways) to connect to the rest of the net. If I run just IPv4, I can connect to everything, and the first person who develops google that is IPv6 ONLY is going to have very few users.

In other words, the business case is flat out not there.

Also, I never understood why IPv4 wasn't just a subset of IPv6? Why can't my existing IPv4 addresses also be IPv6 addresses with a standard prefix? Maybe this has changed, but when IPv6 came out it looked like that wasn't part of it.

If my address was a subset, my ISP could create IPv6 endpoints for my address along with the IPv4 routing, even if I hadn't upgraded. They'd just strip the prefix and forward to me.

Market? Or cynical manipulation? by DoctorNathaniel · 2005-11-10 06:27 · Score: 5, Insightful

"The death of IPv4 has not really killed the Internet. In fact, far from it, we've managed to make an industry around it."

In other words, by keeping IPv4, we can sell NAT boxes (which we're already selling in huge numbers.. the wireless network hub in my den is a prime example.) Cisco has a big investment in building hardware to take care of IP space limitiations.

"You will still be able to get addresses, if you pay for them, because a market will appear."

In other words, this damned internet isn't making us enough money, because IP addresses are free. We want people to start trading them, so we can get commissions on the sales.

It's clear that this is "good buisiness" for the big internet companies: why invest in a new system that will make users's lives cheaper and easier when we can continue to sell patches on the old stuff, and make a market so that we can start charging the freeloaders?

It's also clear to me that the only way IPv6 will get adopted is if public bodies start using them and demanding their use. For instance, if Internet2, the US military, or all of .gov start adopting, then it will get off the ground. Of course, this is unlikely to happen because Cisco doesn't sell IPv6 switches.

I'm no expert, but to my cynical eye it looks not like market forces, but like the usual problems with capitalism exploiting a local maximum and avoiding short-term risk.

----Nathaniel

Reasons to use NAT by jhines · 2005-11-10 06:31 · Score: 1, Insightful

As this was discussed on /. a bit ago, the best reason for NAT is to create islands of IP addresses for your network, otherwise you have to renumber everything when you change service providers. Multiple service providers is another problem.

Even if the cable and dsl companies all switched over to IP6, and there were $50 routers and switches available, there is still reason to use NAT.

Re:Anti-IPv6 people don't realize something import by Oid.Surin · 2005-11-10 07:07 · Score: 2, Insightful

In the past I was very pro IPv6, until I gave it some serious thought. True, IPv4 probaby will not hold up forever, even with CIDR and NAT/PAT, but those definately do extend it's life span signifigantly. If all the organizations with unused address space would turn in unused addresses, we would be in an even better position. If organazations not yet using NAT/PAT would do so, we would be even better yet. I am a big supporter of NAT anyways though, I do not feel that every machine in the world needs a live IP address. How many windows boxes are protected from worms simply because they are not on a live IP? Yes, there are some issues with NAT, but there will be issues with the conversion (and use) of IPv6 as well. My current distaste of IPv6 may partially be due to a lack of knowledge on it, but in a lot of ways it seems illogical, and unnecessary. 128 bit address space, when we are limited to 48 bits of MAC addresses. Illogical in that, with IPv4, it is fairly simple to know that a block of addresses belongs to Company X. But that is just my 2 cents, please, correct me if I am wrong on anything...

--
~oid

Re:IPv6 Solving Yesterday's Problem by Anonymous Coward · 2005-11-10 07:16 · Score: 1, Insightful

The problem is that now the game is security and privacy. We don't want all our hosts on the Internet. We want NAT and firewall and virus scanning. We don't want a firehose to the Internet we want a spyhole... with everything carefully controlled and protected.

All hosts having a global address does not mean that all hosts will have a seperate cable going to their ISP. People will still use ethernet routers/hubs/switches to which all hosts on a network (companies, schools, homes) are connected. Those devices can still perform tasks such as blocking incoming connections from the rest of the world.

Are we ready to surrender anonymity on the net? by schwaang · 2005-11-10 07:23 · Score: 4, Insightful

What's the deal with including your MAC address as part of your IP address?

Yeah this looks like a serious privacy issue that most people haven't woken up to yet.

A MAC address is (usually) a globally unique identifier. How long before someone big builds a database relating MAC to user identity (Microsoft, your ISP, law enforcement, whoever).

At that point, no matter where you connect your laptop from, your traffic can be identified as yours. Be it for the purpose of advertising, tracing communication, or other data mining.

So the question is, are we ready and willing to surrender anonymity on the net?

Re:Are we ready to surrender anonymity on the net? by Halo- · 2005-11-10 08:29 · Score: 3, Insightful

A couple of points:
1) With a static IP, especially if you have a DNS name to go along with it, you leave just as big of a footprint, if not more. (Since I've only got the one directly addressable IP, I might as well get a name to go with it, right? And then use something like DynDNS? Well, unless I register by proxy, I have to give my name, address, phone, etc...)
2) MAC address, while theoretically static, can easily be changed in most OSes and hardware. For example, my LinkSys router has an option to "clone MAC address" in the setup. The problem with changing your MAC address is that the prefixes indicate the vendor, and that might get you in trouble with someone who "owns" that prefix. (I doubt it though)
3) There is nothing preventing you from NAT'ing IPv6, and I suspect some people probably will simply for the quasi-deny-all-in firewall effect. Moreover, if you really want to be anonymous, IPv6 makes it much easier to implement things like "onion routing" because it's a lot easier for individuals to set up persistant servers.
The point is, you can control the "MAC" portion of the address, and the "public" portion is just as visible (or not) as with IPv4. Hell, you could change your MAC address every coupla minutes for a REALLY long time without ever repeating one if that's what you wanted. (Persistant connections be damned...)

Hope you're not an aircraft mechanic. by Kadin2048 · 2005-11-10 07:32 · Score: 2, Insightful

But the more appropriate analogy is: You don't take
your car in for complete engine rebuild if the engine
is running fine.

While this may be true for your car, it's definitely not true of a helicopter, or a generator at a power plant, or any other important piece of machinery.

Would you still fly on an airline if that was their attitude towards maintenance? "Nah, we're not going to tear down that turbine...it hasn't failed yet!"

I think perhaps you should reevaluate the importance of the Internet to our society today. I think we've well surpassed the relative importance of a car to an average driver.

--
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."

It's supposed to be Overkill by Pii · 2005-11-10 07:49 · Score: 4, Insightful

Overkill is exactly the point.

The previous poster asked Why 128 bits instead of, say, 64?

The amount of work required to jump to 64 bit addressing or 128 bit addressing is identical. Since you're going to have to re-write everything anyway, you may as well figure in a ridiculously large address space, because not doing so saves you nothing.

Additionally, the routing table saving offered cannot be understated. With huge swaths of continguous address space, you can (hypothetically) represent an entire continent as a single aggregated routing entry (The more granular routing information would only be seen locally.), and the number of unique addresses within that range would be virtually inexhaustable.

Overkill is a good thing when it doesn't cost you anything.

--
For those that would die defending it, Freedom
has a sweet taste that the protected will never know.

Not me too by mwood · 2005-11-10 08:16 · Score: 3, Insightful

Is there an echo in here? "We'll never run out of [2^N for any value of N] addresses". Yes we will. There are people who are scheming to put every bloody light switch and kitchen appliance on the Internet. There are people designing applications to run on microscopic hosts that will be scattered like seeds, by the thousands or millions.

It's 128 bits instead of 64 so we don't have to go through this again in five years.

Remember, the Internet *core* used to run over 56kb/s lines -- the same speed as those $20 modems that individuals are throwing away by the basketful today because they're unbearably slow for *personal* use. It's *hard* to plan well for that kind of growth. Better to waste a couple of bits than have to waste the whole thing and do it over.

Re:IPv6 is good, but so is NAT by rpresser · 2005-11-10 09:02 · Score: 3, Insightful

NAT is actually solves a secondary problem: allowing individuals to have their own home network without having to register each of their computers with some sort of central authority. Almost all IPv6 advocates say that NAT won't be supported as part of the protocol, which is not such a bad thing if you see NAT simplay as a solution to solves address space issue, but it isn't if you see it as a solution allowing individuals to allocate their own addresses, without having to go through the bureaucratic process of registering each one. I feel that in missing this fact is actually a real issue and one that needs to be dealt with - if there already is a solution to this, then no one I have asked has yet provided me with one.

**You have missed the point entirely**

Forcing everyone back into the bureaucratic process is exactly what the designers want to do. Imagine how much less money would be made by cell phone companies if you could pick up any phone and it would automatically choose a phone number, then register your name with a decentralized directory so anyone who wanted to reach you could. Instead, you have to pay that $50 activation fee, plus a sizable portion of every month's cell phone bill, just for the privilege of being told when and where you can make telephone calls. That is the ideal that our IPv6 overlords are shooting for. I for one welcome them.

41 of 639 comments (clear)