IPv6 Flaw Could Greatly Amplify DDoS Attacks

tygerstripes writes "The Register has a story about the discovery of a flaw in part of the IPv6 specification which has experts scrambling to have the feature removed, or at least disabled by default. From the article: 'The specification, known as the Type 0 Routing Header (RH0), allows computers to tell IPv6 routers to send data by a specific route. Originally envisioned as a way to let mobile users to retain a single IP for their devices... RH0 support allows attackers to amplify denial-of-service attacks on IPv6 infrastructure by a factor of at least 80.' Paul Vixie, president of the Internet Systems Consortium, described the fault bluntly. 'It can be exploited by any greedy Estonian teenager with a $300 Linux machine.'"

Comments

Greedy Estonian teenage overlords!

[alienmole]

n/t

Re:Greedy Estonian teenage overlords!

[HomelessInLaJolla]

I for one welcome our greedy teenage northern European Baltic overlords!

They make awesome glaag.

Re:Greedy Estonian teenage overlords!

[mobby_6kl]

Ah, so now we know it's actually the Russians behind this whole thing again. Oh well, they probably feel threatened by the new western IPv6 ideology, so it's understandable.

Re:Greedy Estonian teenage overlords!

[Torvaun]

Or a Bratislavian.

"A nickle! Now I'll start my own hotel chain!"

Re:Greedy Estonian teenage overlords!

[Sillygates]

who needs IPv6 anyway, the telcos make us nodes on their own private shopping channels there will be plenty of IPs to go around!

Re:Greedy Estonian teenage overlords!

[matushorvath]

Nice things about Slashdot #54: Whatever location you mention in your comment, you'll get an immediate reply from someone living there.

Greetings from Bratislava ;)

Re:Greedy Estonian teenage overlords!

[THEbwana]

Howabout a Zambian ? .. used to be the same country.. close enough? ;-)

s anybody surprised that Paul Vixie

[Anonymous Coward]

was involved? If it weren't for those guys at sendmail, he'd be the number one source of Unix(tm) root exploits.

Re:s anybody surprised that Paul Vixie

[Anonymous Coward]

Trivia: Vixie (of BIND fame as indicated in parent) co wrote a book on sendmail. He sure knows how to pick em.

Re:s anybody surprised that Paul Vixie

[MadMidnightBomber]

On the other hand, BIND makes the Internet work, where as sendmail is a pain in the arse.

Re:s anybody surprised that Paul Vixie

[MROD]

Sendmail was the right tool for its time.

This was a time when there were huge numbers of different network address formats which had to have mail routed to/from/between. That's why it's all about rewriting addresses and not about processing the message. It is also why it's so complex as it had to be flexible enough to handle IP, Usenet (i.e. bang paths), reversed domain-type addressing so you needed a complex language to deal with it.)

Remember also, this was an age before the virus and when the most malicious thing was the war dialler or phone phreaker with his trusty 300baud accoustic coupler modem. Built in security and thinking about buffer overflows weren't really even in the background of the programmers minds back then.

Times have changed, hence Sendmail just isn't an appropriate tool anymore, just like the stage coach. It doesn't mean that it's bad software.

Re:s anybody surprised that Paul Vixie

[MadMidnightBomber]

Oh yeah, definitely. I appreciate the history and I didn't get into MTAs until later on. But as it stands now, postfix or exim are far easier for me to work with. If I'd been doing email ten years ago, doubtless I would have been using sendmail.

Re:s anybody surprised that Paul Vixie

[ArsenneLupin]

where as sendmail is a pain in the arse. But the BSD daemon doesn't mind ;-)

Re:s anybody surprised that Paul Vixie

[westyx]

It means that now, sendmail is bad software, whereas before it was good software.

$300 Linux box... as if

[Ice Wewe]

Please, if he were really that smart, he'd use an OLPC!

Re:$300 Linux box... as if

[piranha(jpl)]

Of course, since Estonia is such a backwards, impoverished country.

Estonia?

[Anonymous Coward]

Clearly the problem here lies with Estonia, not IPv6.

Re:Estonia?

[McGiraf]

no, with Linux, and Estonians who have more money than they should... :P

NOT COOL.

[game kid]

Paul Vixie, president of the Internet Systems Consortium, described the fault bluntly. 'It can be exploited by any greedy Estonian teenager with a $300 Linux machine.'

That roughly translates to "It's so easy, an Estonian can do it".

Someone is gonna be buying them roast duck (with the mango salsa) soon.

Re:NOT COOL.

[Jarjarthejedi]

He forgot Estonia!...wait, no he didn't...okay then...

Seriously though, estonia? Raise your hand if you know where that is. The only reason I ever recognize that is because I just finished a European History class where we had to memorize the current map of Europe, I'm sure if you asked me last year (or next year :P) I wouldn't know. Why not say just greedy teenager with a $300 Linux machine or, better yet, Greedy Nigerian Royalty with a $300 Linux machine.

And why a $300 machine? If it can be done with Linux couldn't a greedy Estonian purchase some really cheap parts and build a $100 machine then install Linux on it? Or do all computers in Estonia cost $300 min?

Re:NOT COOL.

[Tancred]

Seriously...some of us have been to Estonia. Get out and see the world sometime! Food was cheap there, but I don't know about computer costs. Tallinn is a modern city and I hear the tech sector is quite advanced. Not sure if Paul's got some connection to Estonia or he just meant some place that might lack the criminal investigation resources to follow up on that sort of thing.

Re:NOT COOL.

[Professor_UNIX]

Seriously though, estonia? Raise your hand if you know where that is.

Maybe he meant to say Elbonia.

Re:NOT COOL.

[MrNonchalant]

Someone is gonna be buying them roast duck (with the mango salsa) soon. Either that or he can expect his server infrastructure to be down right quick.

Re:NOT COOL.

[ObjetDart]

I'm an American.

I know where Estonia is.

I, like a significant percentage of my fellow citizens, do not support Bush, his administration, nor the neo-con obsession with war-as-a-solution-to-everything.

You sound like a bigot and I resent your smug stereotyping of Americans.

Re:NOT COOL.

[dch24]

I'm an American.

I know where Estonia is. You insensitive clod.

There. Fixed that for ya.

Re:NOT COOL.

[QuickFox]

You're right. I'm sorry. Sometimes frustration makes me overreact. My reaction was stupid. It's not the American people I'm frustrated with, it's the Bush administration. It does irk me that the American people re-elected such a destructive administration, but they were swayed by very skillful propaganda. It's no excuse for my stupidly generalizing outburst.

You're right. I'm sorry.

Re:NOT COOL.

[hardburn]

Quick! Find Liechtenstein on a map. How about San Marino? No cheating with Google Maps.

There are a lot of countries and even more cultures within countries. Nobody can be expected to know all of them. While many Americans should be ashamed of not being able to find Iraq on a map, plenty of other countries play a much smaller role in world politics and nobody should blame anyone for not knowing about them.

Re:NOT COOL.

[QuickFox]

I spoke foolishly. Sorry.

Re:NOT COOL.

[Echnin]

I was there for a couple of days in June last year. I was surprised to see that Linux is actually quite popular; they were selling Linux machines in the mall. The people were also very nice, and I enjoyed myself there. A half-litre of Staropramen was about an euro fifty, which added to the enjoyment. We were staying in a school there, and they had a very well-maintained computer lab (the machines weren't the fastest in the world admittedly, but more than adequate) which dual-booted XP and... I think Fedora or something. Now, Estonia is geographically a Baltic state, but culturally and linguistically they are very close to Finland, a Nordic state which as I expect most of you would know is the home of Linus Torvalds. Perhaps they feel a connection to Linus? Any Estonians here who want to shed some light on this?

Re:NOT COOL.

[Opportunist]

Don't dis the Estonians! They write mighty good trojans.

Re:NOT COOL.

[QuickFox]

You're right. Sorry.

Re:NOT COOL.

[bendodge]

He said that because Estonia has 100Mbs internet connections.

Re:NOT COOL.

[mcrbids]

Seriously though, estonia? Raise your hand if you know where that is. The only reason I ever recognize that is because I just finished a European History class where we had to memorize the current map of Europe, I'm sure if you asked me last year (or next year :P) I wouldn't know.

Estonia... Estonia... Eh.....

Isn't that somewhere in Asia? North of Elbonia, by Kamchatka?

Re:NOT COOL.

[bheer]

Estonia's also home of the guys who created Kazaa (before it sold out and became adware). They then went on to create Skype (whose technicians still work out of Estonia IIRC), and now Joost.

Estonia's one of the more happening places in the European VC scene due in no small part to their activities.

Re:NOT COOL.

[t_ban]

That roughly translates to "It's so easy, an Estonian can do it".

and "so cheap/trivial that he can do it with linux". really, will any degree of technical superiority ever hammer it into the heads of these PHB types that FLOSS!=cheap/trivial?

Re:NOT COOL.

[Skapare]

You can find out where Estonia is here.

Re:NOT COOL.

[bheer]

I know several people from Estonia. Estonia is also a very small country, and they'd be the first to admit that in a large general readership like Slashdot, saying "raise your right hand if you know where Estonia is", makes a lot of sense. Hell, one could say "raise your right hand if you can spot Chengdu on a map" and get mystified glances, and Chengdu (one of China's top 5 cities) has 10X more people than Estonia does!

Hell, I'll go out on a limb and say people in Europe wouldn't be able to place Estonia on a map, unless they paid attention in History class.

> It's not the American people I'm frustrated with, it's the Bush administration ... It's no excuse for my stupidly generalizing outburst.

It's good you get that, but if your frustration with another country's politics causes you to vent randomly over Estonia's geographical smallness, you need professional help in managing your anger issues. Seriously.

Re:NOT COOL.

[ivothamdrup]

He may have chosen Estonia in particular because there's recently (in the last week) been DDoS attacks targeting Estonia's government websites.

Those attacks were (still are, actually) carried out not by local "greedy teenagers", but top-level Russian authorities. The large-scale attacks were traced to IP addresses in Moscow owned by the Russian presidential administration and government.

Re:NOT COOL.

[pipingguy]

Bravo, dch24. Your comment deserves a +1 Insightful, not +1 Funny. No, wait, maybe the +1 Funny is more appropriate.

Re:NOT COOL.

[QuickFox]

Wow. Ufff. I've already eaten my words, and twice more I've said I'm sorry, linking to that comment. This is the third time.

I spoke foolishly, out of extreme frustration and irritation with a country (or perhaps I should say a government) that starts a war that is supposed to be against terrorism but has the effect of fueling terrorism, bolstering recruitment to terrorist networks, strengthening the local influence of terrorist leaders, and so on. This needlessly growing terrorism creates a feeling of powerless horror, and I reacted emotionally and struck out blindly.

My reaction is all the more stupid considering that I feel, quite strongly, that the US and Europe should be strong allies, and definitely not rivals. We have lots of common goals, and there are lots of areas where we agree. I won't go into details here but I've discussed this here and here and elsewhere. My lashing out goes against that idea.

If someone gave you that test [...] would you take it?

Whew. There is only one possible answer. First, I seldom decline a challenge. This is definitely the kind of challenge I should accept. Second, honesty requires that I accept your challenge.

However, on the other hand, if you make it a quiz about capitals and similar geographic trivia, you'll be wasting your time. Then the outcome is more or less guaranteed. I know very little about that kind of geographic detail.

But the frustration that made me lash out was not about the US lacking knowledge about capitals, obviously. It was frustration about the US lacking knowledge about human reactions, motivations and backgrounds in the places where the US intervenes. It was frustration with the US counteracting its own goals by ignoring readily available information and elementary game theory.

For example, are you aware that when you attack people they will unite and their leaders will be strengthened, just like you yourselves unite rallying around the flag? Extremely trivial game theory.

For another example, are you aware of how immediately after 9/11 countries all over the world offered to send help to the US? Are you aware that Pakistan, a third-world, muslim country, immediately offered foreign aid to the US?

The way I understood it, what the US media reported about Pakistan was people dancing in the streets to celebrate the attack on the US. But if you watched that footage critically you would notice that the dancing mob seemed quite small, and that regular people in the background seemed annoyed by their antics and certainly didn't seem to agree with them. Yet unless I'm mistaken this small mob was blown up to make it seem like the whole country celebrating, and the real reaction of the country was rudely ignored.

I get the impression that this kind of blatant falseness is extremely prevalent in US media. For example, amazingly often I encounter Americans who believe that the US foreign aid per capita is generous compared to that of other countries, or that the US pollution per capita is modest compared to other countries, and many other ridiculously off-the-mark assumptions.

Of course our media is slanted too. But our media predicted quite accurately what would happen in Iraq. This makes it seem to be far closer to the truth than yours.

As I see it, while we are eying events critically, you are busy rallying around the flag.

What scares me so much, and not only me, is that US decisions about foreign policy, war, and other really important and serious matters, horribly often seem to be based upon this kind of wildly incorrect assumptions, which have often been created in a rally-around-the-flag frenzy. It's no wonder you couldn't predict wha

Re:NOT COOL.

[smoker2]

Much of the current population of the US are descendants of people who came here to get AWAY from all that - and figure out how to live together in peace ...

Ha ha ha ha ha ha ha !

Is that why they all but wiped out many of those tribes you just mentioned ?

... without tyrannical rulers and enforced, draconian, social homogenization.

Well how's that working out for ya ?

BTW, if you can show me a link to a world map showing the locations of all those tribes you mentioned I'd appreciate it - but in the meantime, the subject was COUNTRIES

As for the rest of it, most of the rest of the world learn things about other countries and call it general knowledge. We don't regard our own particular neck of the woods as the be all and end all of everything that's important.

There was a reason Team America always showed the distance from each foreign place to the US ...

Re:NOT COOL.

[Trogre]

Much of the current population of the US are descendants of people who came here to get AWAY from all that - and figure out how to live together in peace without tyrannical rulers and enforced, draconian, social homogenization.

And just look at you now!

(I kid, I kid)

Re:NOT COOL.

[bheer]

My bad. The guy who created Kazaa and Skype was Estonian, but he doesn't have anything to do with Joost (and as someone else mentioned, Joost works out of the US, UK and Netherlands).

Sorry about that.

Re:NOT COOL.

[asninn]

I'll raise my hand.

Seriously, though, that comment from Vixie was entirely stupid. Estonia's being put under pressure by Russia, the FSB (one of Russia's intelligence agencies and successor of the KGB) is stirring the flames, the Estonian embassy in Moscow is being attacked (literally), the Estonian ambassador is threatened with violence and there's a huge ddos attack against a number of Estonian websites, all because a statue is being moved to a different location (it's not even as if it's being taken down or anything), and Vixie rags on the Estonians?

He's an idiot for bringing politics into this at all, but if he absolutely has to, he should've talked about Russian teenagers, not Estonian ones. Not that it'd be fair to judge Russia, Russians *or* Russian teenagers by the actions of a few idiots, but blaming the victims is even more unfair.

Re:NOT COOL.

[Heir Of The Mess]

Elbonia is a whole country, not local tribal information, but I guess you were making a point.

Here's all you need to know to get up to speed on Estonia https://www.cia.gov/cia/publications/factbook/geos /en.html

Now where can I bone up on the info you mentioned?

Re:NOT COOL.

[Prune]

I don't get the duck/mango reference.

Re:NOT COOL.

[macshit]

I did make one such test on (ahem) some dating site I'm on ... If the word Aryan is in the nick and isn't a first name, the average score is a hair over 30% lower. If the word Nazi is there, nearly 38%. KKK, 27%. Gang members are around 20-25% down,

My god, what kind of dating site is this?!?

Re:NOT COOL.

[tokul]

Paul Vixie, president of the Internet Systems Consortium, described the fault bluntly. 'It can be exploited by any greedy Estonian teenager with a $300 Linux machine.'

That roughly translates to "It's so easy, an Estonian can do it".

If you compare Estonia with California, Californians like Paul Vixie have more chances to exploit it.

Re:NOT COOL.

[maxwell demon]

But he assumed the Estonian would use a Linux machine, so he at least attributed some intelligence to them!

Re:NOT COOL.

[db32]

I'm an American.

I'm happy you know where Estonia is, do you know where your local government is? (city, county, state?)

I'm ashamed at our poor math and reasoning skills as evident here. "Significant percentage" unfortunately was meant to be "Insignificant percentage" because if all you do is pay lip service to the anti-shrub and don't DO anything you might as well be supporting him. He has proven quite clearly that he doesn't listen to much of anything. The neo-con's don't thing war is a solution, they think fear is a solution, they want you to FEAR everything so they can do anything they want to "keep you safe" be it war, wiretaps, etc.

You sound like your upset and I understand your resentment of the smug stereotyping of Americans. Unfortunately these days saying Americans are dumb is almost on par with Africans are black. I mean sure there are a handful of exceptions, but its not really stereotyping when its overwhelmingly true.

I keep hoping and waiting for the light at the end of the tunnel. When its no longer cool to be stupid. When we will have a progressive government that isn't a bunch of asshats writing for lobbyists. In the mean time we are looking like having yet another neo-con president after this one. Not that I have specific dislike for Obama, I absolutely loathe Hillary, but the Dems are given the opportunity of "The election you cannot lose!" after 8 years of Bush with an approval rating in the 20-30% range. What do they do...they run a black candidate (again, I don't care, but watch America carefully, they say ooh its no big deal but as soon as it looks like 'that nigger is gunna win' things will change) and they run a worthless cutthroat insane sellout bitch of a woman candidate who is likely to be the one who destroys the Obama campaign for the R camp. Now on the R side we have Ghouliani and the Newt. Remember folks the Dems were the runs that ran Kerry vs Bush on the "I'm not Bush" campaign AND LOST. A turnip could have beaten Bush and they ran Kerry in another "The election we have to try to lose".

Re:NOT COOL.

[freaker_TuC]

In Estonia clods insensitate or lactate or euh .. you .... or .. euh .. something ? ..

Ok, I'll crawl back under a rock now ..

Re:NOT COOL.

[Chris Mattern]

Quick! Find Liechtenstein on a map. How about San Marino? No cheating with Google Maps.

Without referencing anything, I know San Marino is in north-central Italy, and Liechtenstein is on the Swiss border, with Austria, I think, but it might be Germany.

Chris Mattern

Re:NOT COOL.

[stonecypher]

A big one that encourages open communication so that people don't have to find these things out in person. Honestly, it's better that way; there's someone in my area to whom I would have spoken if she hadn't mentioned a particular opinion with which I disagree strongly (at the level that some people feel about abortion or gay marriage or whatever.) It would have been very disappointing and probably quite uncomfortable to find that out a ways in.

I've had a little over 12,000 people take the test, and I wrote a little scraper after pulling the entire keyword list. Lo and behold, you see some words like "crip" and "piru" show up. It's unfortunate, but at an open site, the crazies get to play too.

Re:NOT COOL.

[joe_plastic]

Geico commercial featuring caveman .
TV Announcer MALE: At Geico.com, you can handle all your car insurance needs online. It's so easy, a caveman could do it!
Seriously, we apologize, we had no idea you guys were still around.
Caveman1 MALE: Yes, next time maybe do a little research.
Waiter MALE: Gentlemen, are we ready to order?
Caveman2 MALE: I'll have the roast duck with the mango salsa.
Caveman1 MALE: And I don't have much of an appetite, thank you.
TV Announcer MALE: Geico, 15 minutes could save you 15 percent or more on car insurance.

Re:NOT COOL.

[stonecypher]

But the frustration that made me lash out was not about the US lacking knowledge about capitals, obviously. It was frustration about the US lacking knowledge about human reactions, motivations and backgrounds in the places where the US intervenes.

Mister Peabody, the WABAC machine, if you will.

Seriously though, estonia? Raise your hand if you know where that is.

Spoken like a true American.

It may be that that's what caused it, but I wouldn't go as far as to call that obvious.

It was frustration with the US counteracting its own goals by ignoring readily available information and elementary game theory.

With all due respect, I think you misunderstand. We've been trying, hard. We really do understand that everyone hates us. It's just that there's really nothing we can do about it. We have a warmongering buffoon as a president. We can see the game theory. That's why our generals refused one by one to go to war, why nobody's take the war czar position, et cetera. It took Bush seven tries to find a general who'd enter Iraq in the first place. He just wouldn't listen.

The problem is simple: things were working well under Clinton, we were on the way to repair, then the voting college system caused an enormous public divide over who the president should be, and we got stuck arguin with one another about what the right thing was to do. By the time the second election came around, there were all those "voting irregularities." We're heartbroken. We feel cheated. We feel impotent. There's nothing we can do. It's not a democracy anymore. Our leader hasn't been elected in almost eight years, we're stuck in a war that nobody over here wants, our jackass in chief refuses to accept defeat, and we're all just stunned.

We're going xenophobic again because it's too hard to face who we're becoming, against our will. It's like having a bad king. I'm tearing up just talking about it. You might be surprised to find out just how much of America feels this way. We've lost faith in our system, and our system is just failing. It's awful. We know we've become monsters. We just can't stop it.

There's talk of a Cheney impeachment underway. But, it's too late. Seven years of this. It's going to be decades before anyone trusts us again. Jesus, Clinton was just getting out from under the fucking 'Nam shadow. We're monsters again, and it doesn't matter how much immensely more good we do than bad. You know why Darfur's still going on? Because we're occupied elsewhere, and nobody ever goes but us.

America does everything it can. We give away more money than anyone else. We give away food. We send engineers. We build infrastructure. We forgive debts. When it's nessecary, we send in the troops. And, y'know what? If we had gone into Iraq before 9/11, we'd be the liberators and the heroes and the saviors of thousands and thousands of Iraqis a year. Remember Kuwait? Hell, remember Iraq last time, when it was Iran instead of Saddam?

Except the way we went in, our Commander in Creep tried to play the Iraq war off as related to Osama, when we all know it wasn't. If he'd just been honest about it from the start, this whole thing would have gone very differently. "We're here to stop Saddam from experimenting on you with chemical weapons." "We're here to keep Saddam's son, one of the most prolific non-war murderers in history, from killing people in the street for pissing him off anymore." "We're here to feed the country being starved by the guy whose palace rivals other nation-starving dictators (yummy middle eastern Brunei) and whose Qu'ran was written in human blood." (Really. Look it up.)

We're sick to our stomachs because the war is wrong and needs to end, but it also needed to happen to save way more lives than were lost, and we don't really know how to resolve that the thing we did was right

Re:NOT COOL.

[arodland]

Forget Kazaa/FastTrack. Those guys created SkyRoads. Way more important. And fun.

Re:NOT COOL.

[Incadenza]

My reaction is all the more stupid considering that I feel, quite strongly, that the US and Europe should be strong allies, and definitely not rivals. We have lots of common goals, and there are lots of areas where we agree.

That is one of the central theme's in Timothy Garten Ash's Free World. Definitely worth a read for anyone that wants a refreshing and positive look on the worlds affairs.

Re:NOT COOL.

[Rakarra]

But seriously... in this day and age, who doesn't know of and where most European countries are located?

I think most of them are over there in Europe.

Re:NOT COOL.

[Rakarra]

Now if only the people who run my government could man up like that when they made a mistake, we might actually get somewhere.

Re:NOT COOL.

[Prune]

Geico only operates in the US. Slasdhot has a significant population elsewhere, so it IMO it's not appropriate for the OP to have gotten +5 for a joke only a subset of the site users would be able to get.

Re:NOT COOL.

[QuickFox]

I'll post a reply, so don't go away, it's just taking a while.

Re:NOT COOL.

[QuickFox]

What? No quiz?

Mister Peabody, the WABAC machine, if you will.

What are you talking about? I googled and found a description of the show, but I still don't know what you mean by referring to it.

We really do understand that everyone hates us.

No! We don't hate you!

This is yet another falseness that your media love spreading. Just like they portrayed the Pakistani as dancing on the streets when in reality they offered help, similarly your media like to portray Europe's attitudes toward you as agitated rivalry and hate, when in reality we see you as an exasperatingly difficult brother.

A brother who is often amazingly, incomprehensibly rude and bullyish, both in official and in informal contacts, but a brother nonetheless. We do get angry with you. We do get exasperated and despair about you. Often we'll be very critical about what you do. But that's not the same thing as hating you. Far from it.

There's a large fringe that does hate you. But they're a fringe, albeit large. They're definitely not the mainstream, no matter how much your media love to exaggerate their role.

I wish Americans would read European media. You'd get a completely different image of our attitudes toward you. You'd also discover what a false image your media are building.

In this context I should probably mention that I don't believe in conspiracies. I don't have theories about your media conspiring to give this false picture. There are just a lot of individuals making separate, individual day-to-day decisions. At each point they probably think that slanting things this way is the good and patriotic thing to do, or simply that it will sell papers. Other people simply believe in the picture that emerges from this, and spread it further.

We're heartbroken. We feel cheated. We feel impotent. There's nothing we can do. It's not a democracy anymore. Our leader hasn't been elected in almost eight years, we're stuck in a war that nobody over here wants, our jackass in chief refuses to accept defeat, and we're all just stunned.

Your description is heartbreaking, you convey a terrible feeling of loss and despair.

However, in spite of everything you say, you're in a far, far better position than were, for example, the citizens of the Soviet Union and the Warsaw Pact before that empire fell. You have freedom of expression, freedom to create organizations and make campaigns for change, freedom to print leaflets and magazines, freedom to own your own resources and spend them on campaigns, and so on and on and on.

If the people in the Soviet Union and the Warsaw Pact could change their systems, so can you!

You're saying that a significant proportion of your population are heartbroken and feel cheated. This sounds like they'll want change. It sounds like change is possible. So what are you waiting for?

Of course you'll have to make the changes yourselves. Nobody can make them for you. If any other nation came from outside, trying to make the changes for you (supposing any nation had the necessary resources), you would inevitably turn against them. And rightly so.

Just like the US can't successfully force democracy on a country, similarly improvements on your system can't be forced on you.

We've lost faith in our system, and our system is just failing.

Your belief in your system is what holds your nation together. If you truly lose that faith, I think you risk falling apart. What else is there to hold you together? You really do need your faith in your strong, beautiful American ideals. You need faith in the American way, in the land of the free and the home of the brave, from sea to shining sea.

Even though I'm not American, I almost get tears in my eyes talking about this.

Maybe this reaction of mine will help convince you that we don't hate you.

We give away more money than anyone else.

I told you that this is an area wh

Re:NOT COOL.

[QuickFox]

That looks very interesting. Thanks for the tip!

Re:NOT COOL.

[stonecypher]

We really do understand that everyone hates us.

No! We don't hate you! This is yet another falseness that your media love spreading.

I don't read or watch the local media. It's the impression I get from what's said to me on the internet by Europeans. Granted, I suppose it's a biassed sample; only the people with an axe to grind would bother saying something in the first place.

Your description is heartbreaking, you convey a terrible feeling of loss and despair.

Welcome to America.

However, in spite of everything you say, you're in a far, far better position than were, for example, the citizens of the Soviet Union and the Warsaw Pact before that empire fell.

Yeah, but look. If you get an Ethiopian and a Greek in a room, prevent cannibalism with humorous clear plastic walls and cut off both their food supply, who do you think is gonna starve first? The Greek with the higher body food value, or the Ethiopian who's used to thin times?

We're American. The middle aged people here still remember actual freedom. We have no idea how to deal with a corrupt government. I mean, look, all things equal Guantanamo and Abu Ghraib are seriously the least threatening secret prisons in the history of man. There are publically acknowledged prisons all throughout Europe that make our black sites look like country clubs. You ever seen the inside of a portugese prison? They're fucking scary.

And yet, we can't even clean up a half dozen Guantanamæ that aren't even protected by extant territorial law, because we just don't know how. We've never had corruption like this: we're young and we've been lucky.

You have freedom of expression, freedom to create organizations and make campaigns for change, freedom to print leaflets and magazines, freedom to own your own resources and spend them on campaigns, and so on and on and on.

None of those things matter if the vote is rigged.

If the people in the Soviet Union and the Warsaw Pact could change their systems, so can you!

Neither of those happened internally. Both of those required full scale international war. Are you really sure those are comparisons you're prepared to make? In each of those cases you were talking about financially desperate industrial nations dealing with crippling external debt and a poor social opinion of generationally recent war.

You do not want to take on the United States. The reason we haven't taken Iraq yet is because we aren't really dedicated. China and the Soviet Union still prevent very real threats to us, but we could steamroll Europe in a way that'd make the Nazis look languid, and we already have a lot of the hardware in position.

The very, very last thing you want to do is suggest that we undergo revolution due to external war. We have a Bush in office. He'd take you seriously.

You're saying that a significant proportion of your population are heartbroken and feel cheated.

Yep.

This sounds like they'll want change.

Oh yeah.

It sounds like change is possible.

Sorry, you lost me. I've been saying things like "We don't know what to do" and "we feel impotent" and "we don't vote anymore" and "there's nothing we can do." Are you saying you really want the post-war answer?

Of course you'll have to make the changes yourselves.

Yeah, like the Warsaw Pact, which was put into place ten years after the end of WW2 by the rising Soviet Bloc to counter what it thought was the threat of invasion by NATO, which was the direct progenitor of the Cold War. Because, y'see, the Warsaw Pact was between Poland and Germany, but it was essentially forced through the pipes by Russia and France, because of their interest in preventing NATO from becoming a new

Re:NOT COOL.

[Zombywuf]

Most people reading /. have 2 good excuses for not knowing anything about the geography of china though, the Great Wall, and the Great Firewall. Can't expect people to much about a country where the border controls are effectively a giant middle finger. I'd be happy if the Americans who visit Scotland could figure out that it's not England, sigh....

Re:NOT COOL.

[QuickFox]

Evidently you and I view this discussion in completely different ways.

The way I saw it, we're two citizens of the world, concerned about what's happening. We're not in positions of power, we're affected by decisions made by others who are in power. So, in my view, any criticism against the actions of those in power are criticism against those in power, not against each other.

In cases where we agree, I thought you would answer something like "I agree" or "Many Americans feel this way too" or something. But your reaction was completely different. You were offended! You complained because I described things that you felt were obvious. For example, you said: Did you actually believe you were telling me something I didn't know? [...] It's offensive for you to talk down to people like that. Don't do that!

With this logic I don't see how we can agree on anything. On any matter where we agree, the person who describes the viewpoint will inevitably offend the person who reads the description.

How do you propose we handle points where we agree?

Judging from your post, you see us first and foremost as one American versus one Swede. My critical opinions about the actions of the US are a personal affront to your sensibilities as an American. You despise me for being a Swede who dares express an opinion. You tell me that I gain the right to express an opinion when Sweden is involved like the US. You tell me that you have no reason to believe some random Swede. You tell me that I'm preaching and condescending.

It seems to me that almost any description can be interpreted as preaching and condescending, if you're looking for that interpretation. It is not clear to me how we can discuss viewpoints and opinions in ways that cannot be interpreted this way.

Regarding my discussions about the media, what I care about are serious international problems. And I mean international. You seem to think I'm talking about how you get your information. I don't care if you never read an article in your life or subscribe to seventeen daily papers.

What matters is that the media should guard the guardians. Good media would scrupulously defend and nurture democracy, by constantly watching those whom the people have elected, reporting any irregularities to the people. They would also report weaknesses in the voting system, irregularities in the authorities, and so on, generally watching carefully over everything that is essential for democracy, and reporting truthfully about all this to the people.

When this works well, along with some other things, you get a feedback system that thwarts corruption.

Thus my discussions of your nation's media were not intended as any kind of attack on your person or on your people. Quite the contrary, if anything I showed you respect. I saw you as a person who might make a positive change, maybe quite a significant change, in this area. I wrote thinking that you might be a smart and capable person who could influence things for the better, and who perhaps might like this idea.

I'm simply a citizen of the world who doesn't get to vote in the world's only superpower. Essentially I don't get to vote in the world government. I see my life deeply, profoundly affected by the actions of this world government. Not having a vote, and acting from this perspective, I try to describe what I see to a fellow citizen of the world, so we can compare notes and maybe even do something.

Since our respective societies influence us in very different ways, necessarily we'll see things from very different perspectives. Therefore, one way to discuss is that each one of us describes how things look from his perspective so we can compare notes.

That was my intent when I described my perspective. I assumed that you would calmly describe yours. Then we could compare notes, and maybe find i

Better idea

[Watson Ladd]

Don't route stuff stupidly. Instead of banning RH0, make sure it doesn't do redundant routes.

Re:Better idea

[Tuoqui]

I think the idea of RH0 is the fact that you can specify an exceptionally long route rather than using the shortest possible route to your path.

Imagine a network of 9 computers in a mesh topology. Now imagine instead of taking at most 4 hops to get to your destination you can specify it to go through every single computer on the network for a maximum of 9-10 hops. Because all of this traffic passes through each computer in the network you have amplified the power of your DoS attack by a factor of 2-3x because you are increasing the network congestion as well as potential collisions and everything else.

Now imagine the internet. I can believe it would amplify the power of DoS attacks by 80x or more if this were permitted. The fact remains is that a good network administrator will let the routers know the best routes. Why specify the route with RH0 when the routers are already built to know the best possible route (through protocols like OSPF and BGP you can even have the routers let each other know about potential problems in the network).

Re:Better idea

[techno-vampire]

I think it's safe to say that in the usual Slashdot tradition, you didn't bother to RTFM before spouting off. The flaw has nothing to do with people accidentally specifying stupid routes, it's h4x0rs using stupid routes to DDOS one or more machines on the route as well as whatever machine they're addressing.

Re:Better idea

[Breakfast Pants]

From TFS, Originally envisioned as a way to let mobile users to retain a single IP for their devices...

Re:Better idea

[Watson Ladd]

I did RTFM. What I meant is that each router along the path should check to make sure the route specified is not stupid, that is having the same IP address twice. If it does they should fix it.

Re:Better idea

[Beryllium Sphere(tm)]

Not enough.

Let's say that routers search out and destroy "ping pong" routes, in their copious free time.

Malicious traffic could still route itself through every IP in your load balancing farm, so a DDoS could hit you N times with one packet. If you detect that, it could still route itself through all 13 DNS root server addresses.

I wonder how this decision got made. "Source routing" should have said "security issue" to everybody on the committee.

Re:Better idea

[QuickFox]

"Source routing" should have said "security issue" to everybody on the committee. Indeed it should — but there's a much greater mystery here. IPv6 has been publicly known for ages. A huge number of people have known it. How come nobody has noticed this problem until now?

I'm not sure it's right to blame the committee when such a huge number of other people have missed it.

Re:Better idea

[jaredmauch]

It's more like it's a known feature. IPv6 with header stacking was supposed to solve this problem folks allegedly have with IPv4 and it's lack of extensions. Evil bit aside, it's essentially "working as designed". People spin these things up periodically where a known feature could be used (misused) in the past as well. The TCP window fiasco comes to mind. Overall this is another non-event IMHO.

Re:Better idea

[mcrbids]

it's h4x0rs using stupid routes to DDOS one or more machines on the route as well as whatever machine they're addressing.

This bug sounds alot like one that I got bitten with years ago - source routing.

RedHat 6.2 came with source routing turned on by default. Since I was using a RH 6.2 system as my router/firewall, this was particularly damning, and allowed them to compromise my X11 workstation more than once. I played cat and mouse with a hax0r who penetrated my otherwise very stiff firewall for over a month, before finding out that he/she/they were using source routing to bypass all my carefully crafted firewall rules.

It was only when I set up a "default deny/log" ruleset, enabling ONLY OUTBOUND WWW/SSH/POP/SMTP connections that I found the truth.

So, I've checked source routing on every load of RH Linux when used as a firewall ever since. It's been turned off by default with every release from 7.x on, including CentOS 4.x which I'm using today.

Source routing was a bad idea then, and is a bad idea now. I will be a bad idea 10 years from now, too. Why did ipv6 re-implement this bad idea?

PS: I still don't get why RH killed their "RedHat Linux" line. I mean, I manage about a dozen mini/embedded servers and was happy to give RedHat $5/month each for security updates - and then they had to go and shoot for the moon with their "Enterprise" line. Now they get nothing from me. I never even called them for support! Maybe my 12*5*12=$720 per year doesn't matter, but that's close to a grand every year that I was happy to pay.

Guess I should be happy to save the $720/year, but it still doesn't make sense to me. /shrug

Re:Better idea

[torrija]

This somehow exists in IPv4 already, but it is capped by default. In the options field of the IPv4 header you can instruct the packet to follow a certain route, bypassing the route choosen for it by the routers.

From Wikipedia (http://en.wikipedia.org/wiki/IPv4):

The use of the LSSR and SSRR options (Loose and Strict Source and Record Route) is discouraged because they create security concerns; many routers block packets containing these options.

Re:Better idea

[jez9999]

I don't see the connection between allowing a specific route and retaining a single IP...

Re:Better idea

[Anonymous Coward]

Because my device is mobile, and one week it's in Scotland, the next week Vancouver and some time after that somewhere in Brazil. That sort of hopping around breaks normal routing protocols.

Re:Better idea

[adamruck]

Instead of allowing *any* route in IPV6, why don't you allow your route to consist of:

shortest route to your home network + shortest route from your home network to your destination ip

That would allow the maximum amplification of 2x for a DDOS attack.

That could be *very* simply enforced by limiting redundant hops to 2.

Re:Better idea

[ATMD]

What if you don't have a server running at your home, waiting to take these connections?

The majority of people don't.

Re:Better idea

[admdrew]

The majority of people also don't need/care about having a static IP, nor do their machines tend to move from one location or ISP to another a whole lot.

Re:Better idea

[arodland]

Because it lets you say "always source-route via this machine in my office, which knows how to find my laptop whether it's in Estonia or Elbonia, and will make sure that the packets get where they need to". The alternatives include tunnelling/VPNs (unnecessarily complicated, relatively speaking, and against the spirit of v6), and making every laptop in the world a BGP peer (impractical to say the least).

Re:Better idea

[arodland]

s/source-route/route/; -- similar sort of concept but it's not really the appropriate term.

A better idea.

[mustafap]

Leave it in, but advise people to disable it for network security.

That already works for other problems, right?

Re:A better idea.

[Anonymous Coward]

The problem is that it's a mandatory part of the spec. BTW, Microsoft is not affected: The Windows IPv6 stack doesn't implement that feature. (It is the equivalent to source routing in IPv4, which is not allowed anywhere.)

Re:Really, why do people say such stupid things?

[Drooling Iguana]

Well that covers a lot more people, then.

Insensitive Clod

[Anonymous Coward]

Where can I get one of these $300 Estonian Linux machines? To heck with Dellbuntu.

Re:Just what we need!

[McGiraf]

hey! It's not nice to call people nerds.

Re:Really, why do people say such stupid things?

[BluBrick]

Hei! That's not a monkey on my arm, it's a chimpanzee!

Who gives a $%##?

[toadlife]

Why you say?

Because IPv6 will never be implemented widely anyway.

Why will it not you say?

Because too many people are happy with the current IPv4 + NAT insanity that is in place now. Nevermind the fact that the insanely ridiculous kludge that is NAT and all of the insanely ridiculous mini-kludges (DynDNS, UDP Connection "Warming", etc.) that currently keep the internet glued together and working (sort of) like it is supposed to work probably cost as much or more time and energy that a multi-year dual-stack IPv4 to IPv6 transition would.

Ok, I'm done ranting.

Have a great weekend everyone! :)

Re:Who gives a $%##?

[guruevi]

Hmm, just like people wouldn't switch from Coax to 8-wire UTP because Coax was more robust? Or people that wouldn't switch from Token Ring to Ethernet because Token Ring was better? Or people that wouldn't ever need the Internet? Or 640k is enough for anyone? Or "I'll never need/use a cell phone"? Or nobody will ever drop Netware...

Re:Who gives a $%##?

[kestasjk]

I predict mobile carriers and devices will use it for VoIP, where it's a necessity, everyone else will follow.

Re:Who gives a $%##?

[alphamugwump]

There's 6 billion people on earth, and 4 billion possible IP addresses (less, actually). Sooner or later, something is going to fail hard. At that point, they won't have a choice.

Re:Who gives a $%##?

[Blondito]

Why ? Why is it a necessity ? Do you really think having publicly addressed cell phones and voip handsets in their millions on the internet is going to a be a good thing ? NAT might not be the prettiest idea around but it has advantages beyond just expanding the available ip address space, and the biggest advantage is security. Wouldn't it be great if I constantly had to patch my cell phone software because of venerability's.

Re:Who gives a $%##?

[Organic Brain Damage]

Nevermind the fact that the insanely ridiculous kludge...

Check our DNA. We are, essentially, insanely ridiculous kludges. Nothing but organically accreted fixes to a long series of problems. Why should anyone be surprised that our technology mirrors this fundamental aspect of our selves?

Re:Who gives a $%##?

[toadlife]

NAT is *not* a security mechanism.

Th "security" of NAT is a side effect of it BREAKING the peer to peer model of the internet.

Re:Who gives a $%##?

[McGiraf]

"constantly had to patch my cell phone software because of venerability's."

When a piece of software is old enough to be called venerable, it's surely more than time to patch it!

Re:Who gives a $%##?

[MichaelSmith]

Because too many people are happy with the current IPv4 + NAT insanity that is in place now

NAT is great for real world politics. I have some small networks which need to be set up in a certain way, and connected to the company LAN for the time being. But I don't want to have to redesign them to suit the current fashion in office networks so I just say to the network nazis that this network is really one box and you don't have to know what is behind the box. Its easier that way, believe me.

Same with my home system. My cable provider sees a box running netbsd current, nothing else.

Re:Who gives a $%##?

[tcopeland]

I don't know, looks like it's getting used in the 2008 Olympics (via thenewsroom).

Re:Who gives a $%##?

[maxume]

There has to be a joke about venerability, but I sure can't find it. I mean, I don't exactly revere my oldest gadgets.

Re:Who gives a $%##?

[jlarocco]

NAT is great for real world politics. I have some small networks which need to be set up in a certain way, and connected to the company LAN for the time being. But I don't want to have to redesign them to suit the current fashion in office networks so I just say to the network nazis that this network is really one box and you don't have to know what is behind the box. Its easier that way, believe me.

I'm pretty sure you can use NAT and IPv6 at the same time. With IPv4 you're forced to use NAT because there aren't enough addresses to go around. IPv6 provides enough addresses, so you only use NAT if you want to.

Re:Who gives a $%##?

[Fred Ferrigno]

The point is that NAT has obviated the need for everyone to have a publicly-addressable IP address. Remember when Qatar got blocked from Wikipedia? An entire country sits behind a single IP address. There are roughly 800,000 people in Qatar. At that rate, we only need about 7500 IP addresses for the entire planet.

As silly as that sounds, it might not be too far off from what ends up happening. If you want your own IP address, be prepared to pay a premium.

Re:Who gives a $%##?

[maop]

I'm an ID creationist you ridiculous kludge.

Re:Who gives a $%##?

[jez9999]

How the heck does that work? Even NAT is limited to the number of local ports available, about 64k. What is 65k people in Qatar try to connect out at once?

Re:Who gives a $%##?

[TheRaven64]

Do you really think having publicly addressed cell phones and voip handsets in their millions on the internet is going to a be a good thing Yes. Want to do a file transfer between your machine and your friend's, when both of you are on mobile connections? Well, it's pretty easy, your IP is 10.23.45.102 and his is 10.24.53.12, on of you just needs to connect to the other. Oh, you're using different mobile providers? And you're on different instances of the 10/8 private subnet? Well, then you're screwed, unless one of you happens to have a server outside the enormous NAT'd range that you can use as an intermediate.

NAT might not be the prettiest idea around but it has advantages beyond just expanding the available ip address space, and the biggest advantage is security NAT gives almost no security. The only security NAT gives beyond a normal firewall (which could be used with IPv6 or IPv4 with or without NAT) is that it makes it harder for an attacker to know how many machines there are on an IP. With IPv4+NAT, an attacker knows that there is one or more machines on a given IP (in a very small search space). With IPv6, they know that there is probably a machine on each assigned subnet. Each subnet is bigger than the total search space of the Internet, and so is the number of subnets.

Re:Who gives a $%##?

[TheRaven64]

A TCP connection is uniquely identified by the tuple containing the source and destination ports and IPs. Since IPv4 allows 2^32 addresses on 2^16 ports, you could have a theoretical maximum of just under[1] 2^48 outbound connections on the same port, as long as they were all to different remote (IP,port) pairs. Last time I checked, the record for the maximum number of connections being handled by a single machine was over two million (on a FreeBSD box, although this was some years ago).

[1]You need to keep an IP address for yourself.

Re:Who gives a $%##?

[sarathmenon]

You are talking about port forwarding. NAT has no such limits.

Re:Who gives a $%##?

[Poromenos1]

Amen, brother. If you recall, this was an issue with Apple's AirPort (I think), which supported IPv6 and everyone gasped when they found out that all the computers in the internal network had their own IPs. They made Apple implement a NAT in the IPv6 router, how stupid is that? If you want security, block incoming ports, for crying out loud. And Apple actually DID it.

Feel free to correct me if I have any details wrong, I'm not 100% sure.

Re:Really, why do people say such stupid things?

[QuickFox]

You forgot his purple t-shirt with a picture of a tiger in yellow and green attacking a mouse. How could you forget the t-shirt? Especially that t-shirt!

The IETF screwed the pooch on this one

[possible]

As I understand it, it is not sufficient to simply ignoring the rthdr0 headers. To protect the infrastructure, the safest thing is for all implementations to immediately DROP any packets containing these headers to keep them from propagating further.

However, there are still people in the IETF who don't want to recognize the severity of their mistake. Why do we, as a community of implementors and consumers, continue to trust these guys as a protocol standards body? It is obvious that they don't understand how complexity is the enemy of security. They add features to protocols without any concrete examples of how the feature would be used, simply because they don't ever want to make a decision. Rather than saying "No, this feature is not worth the extra complexity, we are not going to include it", it is always "OK, we will allow this as an optional mode of operation".

In this case, this was done in a particularly egregious fashion, considering the security issues with source routing have been known since at least '93 or so (in IPv4).

Re:The IETF screwed the pooch on this one

[MichaelSmith]

As I understand it, it is not sufficient to simply ignoring the rthdr0 headers. To protect the infrastructure, the safest thing is for all implementations to immediately DROP any packets containing these headers to keep them from propagating further.

Well OK, but if you are on a closed network you might want to have this kind of control over routing. It should be supported, even if it is disabled on public networks.

Re:The IETF screwed the pooch on this one

[Trepalium]

Standards bodies attract certain types of people, and it's no real surprise that the IETF is infested with them now. Read an ITU standard some day if you want to know how bad it can be. There's a reason why we use TCP/IP instead of the OSI protocol, why we use SMTP instead of X.400, LDAP instead of X.500, etc. For a rather depressing story about standards bodies, read the Wikipedia article about ATM about the choice of 48-byte payloads. I seriously doubt the IETF will ever be able to exercise these people from it's midst. Many of them were placed there to represent the interests of a particular corporation. Even if you replace the IETF with another standards organization, these same people would simply be moved into that organization.

Re:The IETF screwed the pooch on this one

[Anonymous Coward]

I seriously doubt the IETF will ever be able to exercise these people from it's midst.

Perhaps not, but they might get some good exercise if they start exorcising the PHBs. ;-)

Re:The IETF screwed the pooch on this one

[eclectro]

I seriously doubt the IETF will ever be able to exercise these people from it's midst.

I agree. I suggest we find Richard Simmons. He can exorcise anybody.

Re:The IETF screwed the pooch on this one

[technormality]

Actually Source Routing has been around since 1981 and was detailed in RFC 791. In general its a bad idea to let hosts try to pick their path through the network. Routers have a better view of the topology and are relied upon to pick the best path by design. End hosts typically don't know about anything past their default gateway nor should they need to know.

Re:The IETF screwed the pooch on this one

[Deaths Hand]

The problem with an ITU standard is that there is no such thing as an ITU standard. There are ITU Recommedations instead. And even then there are parts in the recommedations that are "for further study".

Even better idea

[jd]

Originally, IPv6 handled mobile IP by migrating the routing information up through the routers, and by using transitional IP addressing. You kept the same suffix, not the same address, as you moved from network to network. But for some certain length of time, you had both the old address and the new one. This allowed for a totally clean transition and has the same observable effect as source-based routing, but is not subject to this DDoS attack strategy.

IIRC, the main reason the transitional scheme was dropped was because routers would need to track more states. Like they're not going to be tracking gigantic numbers of states in order to have a workable authenticated source-routing system.

However, there is one good thing about this. People might finally realize IPv6 is NOT an addressing scheme, it is a very powerful protocol. (Would you believe I had to correct a senior network engineer on that yesterday?)

Re:Even better idea

[netwiz]

Yep, actually I can. Entirely too few people in the industry realize exactly how this stuff works. In all honesty, I'd been aware of this particular aspect of v6 for a while, and didn't like it at all. Seemed like a great way to completely wreck the place.

Everybody, your host ARPs for the gateway, because your packets can't have more than one destination IP in the header!

/v4 only
//been doing this too long

Re:Even better idea

[jd]

You are correct about the level of awareness and about the risks. Mobile IP and NEMO (mobile networks) are potentially serious hazards to the infrastructure, if implemented incorrectly - which seems to be a very likely thing to happen. I've offered Yet Another alternative below as to how you could do this without having to tamper too much with the way things are already done. I needed to make just a couple of minor tweaks and had no need for any kind of source-based routing or self-directing traffic. This is not intended as necessarily the "right solution", but merely one way you can do mobile IP without needing such hacks.

I always considered the one destination thing to be rather crude. But let's say that we keep that (for now), but modify the semantics. Instead of there being one physical endpoint, have one group endpoint in which exactly one member of the group will respond. (Then you can use all the conventional reliability mechanisms and all that carp.)

How would this work? The standard "unicast" packet would be transported a-la multicast to all members of the group. In all cases, the group will have exactly one physical member - your machine. Your machine gets the packet, responds as it would to any other inbound packet, and nothing changes. Everything that currently works would continue to work.

Your machine migrates to another network and rejoins the group. The packet temporarily gets sent to both destinations, but there is still only one recipient - your machine. Hence, there is still only one response to each inbound packet. The old connection gets pruned and ceases to operate.

This would absolutely positively require that the host machine is strongly authenticated, or you'd get people sniffing traffic simply by joining other people's groups. However, strong authentication is certainly doable. I don't see any serious problem there, IPSec, SSL and TLS can provide authenticated connections. Actually, these simplify things a little because then it really wouldn't matter who could wiretap. The strongest encryption ciphers and modes available for these have no (publicly) known flaws.

The next change would be that you would be using unicast semantics and unicast protocols but routing via multicast to ensure that the traffic got to your new endpoint. That one is trickier but I don't see any fundamental objection. Routing is routing. So you duplicate the traffic at times. Big deal.

Finally, you would need to own the group address. Your physical address could be assigned by the local network and you wouldn't care. Multicast routing doesn't need to transport endpoints, so so long as your LAN can identify your machine as the group owner, your physical address can remain totally invisible to the rest of the network.

Are things like this done? Sure. It's very similar to the self-optimizing routing scheme originally proposed for mobile IP, and has a lot in common with anycasting in that you are targeting a group in order to reach a single machine. It's also very similar to wireless routing techniques where the transmission has to be damn-near guaranteed to get to the endpoint where (for one reason or another) you can't be sure what path gets to that endpoint.

I seriously doubt anyone will implement this, not because of any obvious flaws (although there are probably some not-so-obvious ones), but because if you thought IPv6 was taking its time getting deployed, that would be a cinch compared to telling the Internet backbone to dump unicast routing entirely and add the compute power needed to handle dynamic groups at this kind of level. (Best guess is that it's going to double CPU requirements on average.)

An article that discusses the actual vulnerability

[slashdotmsiriv]

http://www.potaroo.net/ispcol/2007-05/6pong.html

What's with all the anti-IPv6 stuff lately?

[Ant P.]

Is something bigger going on that we don't know about? Just wondering.

Re:What's with all the anti-IPv6 stuff lately?

[laffer1]

People are actually starting to look at IPv6 security. The recent OpenBSD issues highlighted the problem. OpenBSD, FreeBSD and MidnightBSD should all be patched for this issue. OpenBSD chose to turn it off completely for now. There is some talk about adding support to PF for blocking specific traffic. FreeBSD and MidnightBSD both used a patch that adds a new sysctl to disable the feature by default, but still allow it. As I recall, the reason its in the spec to begin with is for research purposes. I don't follow DragonFly or NetBSD enough to know if they've patched yet.

Re:What's with all the anti-IPv6 stuff lately?

[rdebath]

People are looking at the security in relation to IPv6 because it's about to be attacked. A certain OS version has been released with IPv6 enabled by default, therefor, the zombie wars are going to be speading soon.

Nothing New

[jjeffrey]

How is this different to source routing packets in IPv4? Surely people will just configure firewalls and hosts to drop these packets in exactly the same way as is done for IPv4 now.

Re:Nothing New

[Opportunist]

...or not, just like they don't now.

ISPs will. No doubt about that. Will end users become magically enlightened over night when IPv6 finally hits the masses? I kinda doubt that.

Re:How many people use IPv6

[jguthrie]

I've been using IPv6 for nearly a decade, but most of the IPv6 traffic on my LAN is local to the LAN. There are very few interesting places on the Internet that have IPv6 addresses and fewer end users coming from IPv6 capable nodes.

Security Through Poorly Understood New Features

[WED Fan]

Got to love new tech biting you in the butt.

The Japanese?

[jd]

They already deploy IPv6 nationally. Just because the US domestic market is more sluggish than a salted slug, it would be wrong to assume everyone else is as bad.

What's more, IPv4+NAT (as standard) doesn't give you half the features of IPv6. I've listed them before, I'll list them again here. Sure, not many use them NOW, but most of these are major areas of growth and Internet-aware devices will (sooner or later) have to use IPv6 to get the support they need.

• IPSec
• Anycasting
• Multicasting the ISPs can't turn off
• Mobile IP
• Mobile Networks
• Extensible Headers
• Router Discovery
• Automatic Configuration
• Per-destination MTU optimization

There are probably a whole bunch of other advantages not listed here. Go to your local USAGI dealership and test drive an IPv6 today.

Re:The Japanese?

[markov_chain]

To play devil's advocate, none of these features will make any difference to me, and they will make IP addresses so much harder to type.

Re:The Japanese?

[Joseph_Daniel_Zukige]

I wish someone would tell my ISP that they've already got IPv6 running.

Re:The Japanese?

[Joe U]

There are probably a whole bunch of other advantages not listed here.

You forgot more efficient DoS attacks.

Re:The Japanese?

[jd]

You still type IP addresses? Most machines have names and if the name's too long, you can always add a bookmark to /etc/hosts.

Re:The Japanese?

[markov_chain]

Doesn't work too well for research systems. Even the /etc/hosts trick gets in the way in some cases, like kernel code or dynamic addresses.

Granted I'm not the mainstream user but I can still miss my IPv4 when it falls out of use :)

Whew!

[Billy the Impaler]

It's a good thing that nobody is using IPv6. Otherwise we might have to worry about this exploit! ;)

Act NOW! The world is falling!

[Opportunist]

Oh. No, wait, he said IPv6. Ok, then we got a little time to fix it. Even though it's about due in 2 years to become the next big thing. It has to, it's been due in 2 years for about 10 years now.

DoD Buying Cycle

[neiko]

This is particularly interesting to myself since I'm in the midst of working one of our companies products to be "IPv6 Ready" logo certified and DoD approved for their new buying cycle next year (which I am told all products must be to be on the "list"). I wonder if this will push that deadline back any...

Early IPv6 drafts had limited the Type 0 route len

[Jim Logajan]

Some history and information:

The earlier drafts of the IPv6 RFCs had limited the Type 0 routing addresses to 23 per extension header. The current limit is theoretically 128, though maximum packet size through any one link will tend to get in the way.

The number of times an IPv6 packet may ping-pong is limited by the Hop Limit field, which is an 8 but unsigned integer (i.e. 255 times).

While it is true that a very permissive router or host may process a packet with more than one Type 0 routing header, RFC 2460 strongly recommends that a router or host only process one such extension header.

One product that has been designed to locate implementation problems with IPv6 stacks (it can't do anything about design flaws!) is the Maxwell product from http://www.iwl.com/. Truth in advertising requires that I point out I helped create some of the test cases for that product (however, I am not an employee of IWL or own any equity or options on equity in the company).

Re:Sorry you lose

[Thexare Blademoon]

Perhaps you should explain to him what Tallinn is before he tries ordering one at a restaurant.

Aren't the old excuses still good anymore?

[ClosedSource]

Isn't the conventional wisdom that due to the end-to-end argument, it's OS and application problem by definition?

Re:Aren't the old excuses still good anymore?

[Vegeta99]

Asking people to "disable by default" seems to be the old excuse.

Re:I don't.

[asdfghjklqwertyuiop]

What's so insecure about IPv6?

Don't confuse Estonians with Russians

[Goonie]

Estonians don't like Russians very much. They got squished between Hitler and Stalin during WWII, and ended up part of the Soviet Union for 50 years, during which their language was suppressed, hundreds of thousands of Russians were brought in, and ran the place with their typical environmental consciousness and regard for the local ways (none at all, in other words). So mistaking Estonians for Russians isn't likely to be particularly popular with Estonians.

In any case, Estonia writes with Latin characters and the language is more like Finnish than anything else, apparently.

Re:Don't confuse Estonians with Russians

[Skapare]

Estonian (Eesti) and Finnish (Suomi) are close enough for mutual understanding to work. Estonians watched Helsinki TV for real news and programming when Soviet Russia occupied their country (and probably still do, but now via cable legally). But the languages are not as close as Swedish, Norwegian, and Danish are to each other.

Re:Don't confuse Estonians with Russians

[cp.tar]

Yup... Estonian is a more innovative language; Finnish is quite archaic.

Estonian also has more loan words from both Slavic and Germanic languages.

Anyway, it seems that's why it's easier for Estonians to understand Finnish than vice versa.

Re:Don't confuse Estonians with Russians

[teh kurisu]

...when Soviet Russia occupied their country (and probably still do, but now via cable legally).

Now that's the way to occupy a country!

Re:Don't confuse Estonians with Russians

[asdfgl]

when Soviet Russia occupied their country

Isn't this supposed to be: "In Soviet Russia the estonians occupied YOU"'?

Re:Don't confuse Estonians with Russians

[jc42]

Actually, the Finnish/Estonian pair, along with the Spanish/Portuguese pair, is used in linguistic texts to illustrate one of the technical problems of the standard definition of "language" and "dialect": Two dialects are the same language if the speakers can understand each other (perhaps with difficulty) without any special language study. In both of these pairs, speakers of the "smaller" language (Estonian and Portuguese) can generally understand the other language without much difficulty, while speakers of the "larger" language (Finnish, Spanish) generally can't understand the other. So by the definition, Estonian is a dialect of Finnish, while Finnish is a separate language from Estonian, and similarly for Portuguese/Spanish. This is clearly absurd, so we need to work on the definition a bit. Either that or casually accept that the real world is too messy to be clearly compartmentalized like this.

(I've seen this compared with the similar problem that biologists have with the term "species". By the standard inter-fertility definition, for example, domestic dogs are the same species as wolves and jackals, but wolves and jackals are different species from the domestic dog. Also, lions are the same species as tigers, but tigers are a different species from lions. The explanations are similar to the above, and produce a similar absurdity.)

But Estonian isn't close to Russian at all. Estonian isn't even an Indo-European language. It's a Finno-Ugaritic language, and despite a couple centuries of work, linguists haven't yet successfully connected the two language families.

Actually, the asymmetric relation of Estonian and Portuguese to their majority neighbor languages is pretty much a result of the same process: If you compare a few utterances in both cases, you'll quickly see that Estonian and Portuguese have gone through a simplification process similar to French, in which many sounds have been lost, mostly at the ends of words. It's difficult to understand your language with a lot of dropouts, so the Finns and Spaniards have problems making sense of Estonian and Portuguese. But if someone else is speaking your language with a lot of additional "nonsense" sounds added in, it's easy to ignore the "noise". So to an Estonian, Finnish is mostly Estonian with a bunch of added noise that can be ignored. This sort of sound loss has happened in a lot of what used to be dialects, and is a common way for a new language to split off from its ancestor.

I've read claims that this was what first separated Old English into a new language. 1000 years ago, it was really just a West German dialect, and the people on both sides of the Channel could mostly understand each other. Then the people in Britain started dropping most of the inflectional endings on nouns and all of them on adjectives, using a stricter word order instead. This made the language on the island mostly incomprehensible to people on the mainland. Then the Great Vowel Shift came along and finished the job ...

(Yeah; this is a bit of an over-simplification. So? ;-)

Re:Don't confuse Estonians with Russians

[cp.tar]

But Estonian isn't close to Russian at all. Estonian isn't even an Indo-European language.

Where did I ever state such nonsensethat you should refute it?

I was talking about loan words, of which there are quite a few.

I'm taking an introductory Estonian course this year, and my lecturer, a great Finnish guy, specializes in the influence of Germanic and Slavic languages on Finnish and Estonian; some of the first things he taught us were the most common loan words in Estonian.

And if you want first-hand accounts for language/dialect confusion, seek no more: I'm a native speaker of Croatian, which is still very often called Serbo-Croatian in international circles (especially Anglo-American ones). To over-simplify, Croatian language is considered to have three dialects: Kaykavian, Chakavian and Shtokavian (English spelling both to bypass Slashdot's garbage filter and to ensure you can actually pronounce them), and the Croatian standard is based on the Shtokavian dialect.
however, these three dialects are actually languages; not only by the criterion of mutual understanding (for Slavic languages have a dialect continuum), but also by the criterion of different grammars (Kaykavian only has six cases, while Shtokavian has seven, for instance; their morphologies also differ).

The problem arises because the Serbian standard is also based on a dialect of the Shtokavian language; a very similar yet different one. And even though the grammars of the two used to be made compatible, the two languages are now pretty different from each other - not only on the lexical level, but also on the syntactic and even (a bit) on the morphological level.

That's why I stick to the political definition of a language (it is a distinct language if that's what the speakers feel), and when confronted with borderline cases, I stick to language systems and complexes.

P.S. There are some very convincing arguments for the Nostratic theory (the -m, -s, -t paradigm, for one); it is difficult to find much more proof than that because certain things change way too much in time. However, I don't do comparative linguistics any more than I absolutely need to, so don't ask me for details; I enjoy listening to that stuff, but can't be bothered to learn hard, solid facts.

Re:Don't confuse Estonians with Russians

[jc42]

The South Slavic languages do seem to be a popular example among linguists, mostly because they're an extreme example of a continuum of dialects without any natural language boundaries, while speakers far enough apart are clearly speaking different languages. So the officially recognized languages are defined by politics.

Actually, my favorite definition of "language" is that a language is a dialect with its own army. This tends to explain things better than those silly linguistic definitions, which are merely logical.

But if you want to see a real mess of dialects and languages, with terminology that's equally messed up, look at Chinese. It's really odd to hear the media talk about the "Chinese language", which would be a lot like the "European language". To be more precise, it would be more like considering all the Romance languages just dialects of Latin. So the French, Portuguese and Romanians all speak the same language, right? And by the same criteria, the Poles, Russians and Croatians all speak the same language.

I do sorta like the Nostratic hypothesis. And I get the impression that every linguist expects that the Indo-European, Finno-Ugaritic, and Semitic languages really are distant relatives, with a common ancestor 8 or 10 thousand years back. But at that distance, there aren't many hard, solid facts to work with. So we can have lots of fun talking about it without worrying about anyone proving us wrong.

It's too bad that we didn't invent recording equipment 10,000 years ago. Or, if you prefer the really far-out "theories", we did, but the recordings were lost, maybe in the Flood or when the big library in Alexandria was burned.

Re:Don't confuse Estonians with Russians

[cp.tar]

But if you want to see a real mess of dialects and languages, with terminology that's equally messed up, look at Chinese. It's really odd to hear the media talk about the "Chinese language", which would be a lot like the "European language".

Well, it's the media. They never get anything right.

When I hear "Chinese language", I merely assume "Cantonese". In linguistics classes, it's always "Chinese languages" or "Sino-Tibetan languages".

It's too bad that we didn't invent recording equipment 10,000 years ago. Or, if you prefer the really far-out "theories", we did, but the recordings were lost, maybe in the Flood or when the big library in Alexandria was burned.

Nah. They weren't lost. it's just that we don't yet have the technology to understand them. Hell, we don't even know we have any preserved.
OK, so the American government does know. But Tesla died before he was able to devise a way to power them. And now the project's at a standstill.

Which is just as well. Because it seems the Egyptians also had their version of the DMCA and DRM and whatnot, so decrypting those records would bring on the curse.

They had some real IP protection back then.

Re:Just what we need!

[blacklint]

I don't know how you still have a positive score for that comment. Have you ever met Paul Vixie? I have. He's a great man with a good sense of humor (see http://en.wikiquote.org/wiki/Paul_Vixie). Now can we just take this quote to mean that exploiting this part of the IPv6 specification has an extremely low barrier to entry as it was intended and move along?

Re:leaders

[Thirdsin]

You know those spam emails that have a nonsensical sentence or paragraph followed by a hot tip on cheap stocks??? yea this anonymous post reminds me of those emails... at least i can delete the emails..

Cheers from Soviet Estonia!

one thing

[Joseph_Daniel_Zukige]

I don't really like IPv6 for several reasons, which I won't go into here.

But one thing IPv6 would solve for me is this problem:

My (Japanese) ISP is not anxious to have me serving the web from my house. (Not sure if I blame them, if there were a lot of people like me among their customers they'd probably have to start metering us and charging a few yen per GB of upload over some limit each month.) Anyway, a single static IP address from them would cost JPY6000 a month, if I remember right (and if things haven't changed).

IPv6 would take away their excuse for asking for so much money. I'm guessing they'd be hard pressed to find an excuse for not giving me a whole range of static addresses.

Of course, they could claim something about security and require DHCP anyway, I suppose.

The point is, the internet is supposed to evolve until every home has a communications server in their phone. Want a blog? On your own server. Blog gets popular? pay your ISP USD3.00 a month or something to mirror it. Mail? Web site? News? Etc.? On your phone.

NAT in its present form takes too much tweaking to do that.

Re:one thing

[Fred Ferrigno]

(Not sure if I blame them, if there were a lot of people like me among their customers they'd probably have to start metering us and charging a few yen per GB of upload over some limit each month.) I wish my ISP would do that. It would put an end to all the crap they go through to make sure you can't really use your bandwidth. No more artificial limits on connection speed. No more traffic shaping. No more server blocking. I'll pay for the bandwidth I need and they'll bend over backwards to give it to me.

People would also get much more conscious of how they use their bandwidth if leaving BitTorrent running 24/7 or letting your computer be infected by a botnet virus cost real money.

IPv6 seems to be designed pretty poorly.

[narf501]

As a protocol, IPv6 seems to have so many glaring omissions or just bad engineering issues. The first one... no use of firewalls or NAT devices. Hello here... firewalls are critically needed on the Internet, and many laws and regulations specify use of one. Now this... Guess most companies which value their reputations will be sticking with v4 until Doomsday.

Re:IPv6 seems to be designed pretty poorly.

[MadAhab]

NAT sux. it's kind of a hack and it complicates firewalling greatly.

IPv6 does not forbid firewalls. in fact they will work better without NAT.

Re:IPv6 seems to be designed pretty poorly.

[Slashcrap]

As a protocol, IPv6 seems to have so many glaring omissions or just bad engineering issues. The first one... no use of firewalls or NAT devices. Hello here... firewalls are critically needed on the Internet, and many laws and regulations specify use of one.

I think you have an overly negative view due to your half-baked opinions being based on badly written, idiot-level Slashdot summaries of already poor articles, rather than being based on even the most minimal understanding of the pros and cons of different network protocols.

Now, I don't want you to think that I'm defending IPv6. If I was doing that, I would point out that there is nothing in IPv6 that stops you using a firewall and that iptables and pf have supported IPv6 for years. No, I am attacking you. I just have this thing about the clueless spouting factually incorrect statements in public forums. Deliberate trolling is fine with me, but I've always had a thing about loud idiots.

Also...Your writing style...Is annoying.

Re:IPv6 seems to be designed pretty poorly.

[Rakarra]

NAT sux. it's kind of a hack and it complicates firewalling greatly.

It does, but it's necessary for political reasons, specifically to get around greedy ISPs that want to charge you more for each device you attach to your DSL/Cable modem. "Oh, you have a home network? Maybe you need our Super-Deluxe or Business-Class service!"

No hiding?

[Joseph_Daniel_Zukige]

Maybe he things IPv6 would prevent hiding behind a NAT.

Make the default "Off"

[mark-t]

Because it seems to me that this could be useful, so it makes sense to still forward these sorts of packets along.. but the default would be to do it optimally rather than following the explicit route.

One possible and very practical use for this could be to send data across networks that don't happen share the same address space (ignoring the fact that IPv6 gives you so many addresses that you probably wouldn't ever _need_ to use different address spaces, it's still potentially possible that somone might _want_ to do this). So you use source routing to go first to the system that acts as the gateway between them and then the next IP in the list is on the other network.

Re:Nice commentary

[Dunbal]

a racial slur

Being Estonian is not a slur, sir, it's a compliment!

It all depends on your point of view, racist :P

Estonian is like Finnish indeed - Not Russian

[Siker]

My mother speaks Estonian and can with some level of adaptation understand and express herself in a way that is understood by the Finnish, which I know for certain as my father is Finnish. Unfortunately, as I grew up in Sweden and was too much of an ungrateful kid to actually learn the languages of my parents, I can't directly comment on the similarity of the languages.

I second the opinion that the reference to an 'Estonian teenager' isn't very appropriate. It continues a strong, traditional and completely wrong tradition to separate 'us' and 'them'.

Re:Estonian is like Finnish indeed - Not Russian

[fbjon]

Well to me, Estonian sounds like some totally whacked-out Finnish slang. I always think I can understand it, but after a few seconds I realise I didn't get anything. Subtitles FTW.

Already fixed in OpenBSD

[whamett]

The patch was released on April 27. Now that's quick!

The OpenBSD project does a great job with security; other development teams could learn a lot from them.

Re:Already fixed in OpenBSD

[DaleGlass]

I looked at the patch, and placing #if 0 / #endif around the code isn't particularly impressive.

Sure, good job on getting it out of the way, but it's not like they came up with an actual fix, they simply disabled it.

Re:How many people use IPv6

[jguthrie]

The benefits? None that I can think of at the moment. In fact, while my initial connection was a pretty stable one to the 6bone through Sprint, the current connection is flaky as hell and it's a minor pain to keep checking it to make sure I can ping the other end of the tunnel. One of these days, I'll automate the testing and reconnection of it, but it'll have to wait until it's a whole lot more important to me. Mostly I just ignore it and test it when I think about it. The only thing that it hurts when it's done is if the place I'm getting to has an AAAA record, the attempted connection to the IPv6 address has to time out before it retries the IPv4 address, so a very few sites are slower.

The original reason I got an IPv6 connection was to see what it took to set up an IPv6 network, and I had this T1 to Sprint and Sprint offered free tunnels to the 6bone so, I figured, why not? I mean, IPv6 was the next big thing (or so they told me) in the late 90's, so I was trying to be ahead of the curve. Eventually, I set up tunnels between my ISP and what was then my day job and my house and I (briefly) enjoyed the benefits of being able to SSH directly from one workstation behind a NAT connection to another workstation behind a different NAT connection. Yahoo.

When my ISP went under, and the 6bone went away, I got a connection to one of the public tunnel brokers, and it worked for a while. Then I changed my feed to Time Warner and the first cablemodem filtered protocol 41, so the tunnel wouldn't work no matter what I did. After replacing the cablemodem for other reasons, (and waiting long enough for me to wonder if it would work with the new equipment) I was able to get a tunnel to a tunnel broker and I've had a block of addresses ever since. (2001:5c0:8305::/48, in case you're wondering.) Some people have a garden. I have a home network and I enjoy puttering about with it from time to time. (The rest of the time it's a freakin' nuisance.)

Why Linux?!?

[Sterling2p]

Can't this be done with a $300 Windows machine? Are they trying to piss off as many small groups of people as they can in a general negative comment like this??

The complaint makes no sense

[dbIII]

The first one... no use of firewalls or NAT devices.

Neither does IPv4 - these things are seperate to the spec and could be added on to IPv6 as well - although NAT is a kludge to get around running out of addresses which you would not currently need for IPv6.

There are a lot of IPv6 firewalls out there, the traffic has to be routed to get to you and your firewall at the incoming connection can block everything other than the required ports so long as it can understand IPv6.

There's some good books out there on networking. I recommend the O'Reilly one with the crab on the cover to avoid furthur embarrassment. The old editions likely to be found in a library probably still cover IPv6 (too old and it will be describing this new NAT thing).

Except this is not stereotyping

[aepervius]

In a study on kids, it was shown that the average US kids has less of a grasp on how the world is than the average kids of other continents. How was this done ? They were all asked to make a rough map of all continent. Although all kids had a tendency to make their own continent a bit bigger in proportion to the rest of the world, the biggest & msot extrem deformation was with US kids which in many case only drew the north american continent with some "blob" beside N-A representing the other continent. So this study clearly made a quantified demonstration that at least in low grade US kids have a less good grasp on geography than other kids.

Now granted this cannot be expanded to say "US adult do have too less a grasp on geography" but some annedoctial evidence with CNN (showing Austria as Hungria on TV If I remmember, and other of the same type) at least give an indication that at some level this might not be completly false to pretend that US adult have a poor grasp on world geography too. And if I may add, on world politic too, but that is my opinion.

Re:Except this is not stereotyping

[Thundersnatch]

US adult do have too less a grasp on geography

"Hello, Pot? This is Kettle. You're black!"

Re:Nice commentary

[gujo-odori]

First of all, I think you can make a pretty good argument that Estonian is not a race. Nationality? Yes. Ethnicity? OK. Race? Estonians are white, so no, Estonian is not a race. White is a race.

Secondly, it's well attested that Eastern Europe is a major center of online criminal activity. As someone who has been in the security field for the past four years, I can say that there are days when I wish I could put a firewall around all of it, to keep things *in*

The assumption that it would be a teenager is actually the part least likely to be accurate. It could be - they call them script kiddies for a reason - OTOH, a lot of adults are involved in computer crime, and they are involved in it for profit.

While his remark was flippant, it was not nearly as inaccurate as you might think.

typical design stupidity

[nanosquid]

Instead of making the next generation IP standard a simple extension that makes address fields a little larger and maybe fixes one or two long standing bugs, the IPv6 people redesigned things from scratch.

It's no wonder people are reluctant to adopt IPv6.

Intended or not...

[ZxCv]

NAT is *not* a security mechanism.

Whether or not it was intended, NAT *is* a security mechanism. Obviously not the best or the prettiest, but to say it provides no additional security is just ignorant.

Th "security" of NAT is a side effect of it BREAKING the peer to peer model of the internet.

Side effect or not, it provides additional security no matter how you look at it. From a purist's point of view, it certainly does break the peer to peer model of the internet. But from a practical user's standpoint, it rarely if ever breaks anything, provides additional functionality and security, and is usually brain-dead simple to implement.

Re:Intended or not...

[fbjon]

It's not at all ignorant to say that NAT is not a security feature. It's a hack at best, and no-one would miss it if we didn't need it. And it frequently breaks things, actually, unless you only surf on the web.

Re:Intended or not...

[Hatta]

NAT is not a security mechanism at all. Imagine the simplest nat configuration where you have a 1:1 correlation between the internal IP and the external IP. No security there. The security comes from blocking ports which can be done just by a firewall with no address translation. Just because most firewalls come with NAT doesn't mean they're the same thing.

But from a practical user's standpoint, it rarely if ever breaks anything, provides additional functionality and security, and is usually brain-dead simple to implement.

Hardly, it breaks peer to peer apps, DCC, AIM file transfers, etc. You have to manually configure it to allow those ports, and only one computer on the inside network can use those services at any time.

Why Estonians?

[Reigo Reinmets]

Excuse me, but i believe Russians are the DDOS attackers, specially lately, when they are bombing Estonia IT networks because of their stupid monument.

I live in Estonia, and no, i don't speak Russian language.

Now, maybe a big part of the world doesn't even know where Estonia is, but We are quite advanced IT country, here's some examples:
* We got National ID cards - and loads of services that use it as identification
* We just launched a cellphone based ID service, that basically replaces the need for a smart card reader and allows identification from anywhere in Estonia.
* We have E-Government
* Our internet banks are surely in the top 3 world wide from feature perspective
* And last, but not least, there's Skype

Arrrrrgh!

[Grindalf]

syn ack syn ack syn ack aieeeee thud!

Original CanSecWest presentation

[mrogers]

The CanSecWest presentation that started all this is available here.

Re:Just what we need!

[ctzan]

Now can we just take this quote to mean that exploiting this part of the IPv6 specification has an extremely low barrier to entry as it was intended and move along?

I got it.

It's like saying: "everything's so simple, even an American can figure it out."

Yes, DragonflyBSD has already been patched.

[Renegade88]

DragonflyBSD 1.4.x, 1.6.x, and 1.8.x systems have already been patched.

This very serious message urging all users to upgrade was posted on their mailing list earlier this week: DFBSD Message 2007/5/63

Re:Nice commentary

[ctzan]

define "Eastern Europe".

Estonia is not Romania or Bulgaria.

It's a small, moderately prosperous and racis^WWestern Democratic Values bla bla bla country in /Northern/ Europe.

Most Estonian will be happy to explain you how *all* the crime in their country is carried out by Russians or more recent immigrants. You know, stuff as usual.

feature

[kemo_by_the_kilo]

this isnt a bug its a hidden feature. its in place because ipv6 was made by the dark side of the force

"where most European countries are located"

[Anomalyst]

(With Chicaga twang) Like Kansas and Kentucky, Dey're over by dere.

Re:Let's get it right

[TheRaven64]

Nobody cares about doing a transfer between IP addresses. They DO care about doing a transfer between text names that are easy to remember. And with that, it makes no difference if you're using IPv4 or IPv6. Text names are just a mapping to IP addresses. At the end of the day, one machine needs to initiate a connection to the other. This is not possible when both are behind NATs and neither end has control over the NAT device.

multicasting

[tim90402]

Can you elaborate on "Multicasting the ISP's can't turn off"? Or, in general, how does IPV6 address any of the issues that have prevented widespread multicast support?

So you're saying...

[Junta]

That IPv4 is not intelligently designed?

Re:So you're saying...

[jc42]

That IPv4 is not intelligently designed?

Well, IPv4 itself was a fairly intelligent design a quarter century ago. But then it started to accumulate cruft like NAT, which seems to have been designed by a gang of chimps banging on keyboards, giving us the growing mess of today's Internet where my machine and yours can't connect to each other because they're both behind NATted firewalls. As a result, I have to email friends individual copies of my nifty pictures of my vacation, pet conure, and the cute baby cardinal that just showed up at the bird feeder with his parents. With the original IPv4 design, I could just put the pics online and email the URL, and with IPv6 I could do that (if and when all our ISPs permit IPv6). But for now, it means lots of gigantic email messages to people who mostly won't even bother to open half the attachments.

We are starting to get more useful apps that require that end-user systems have public addresses and be allowed to accept incoming connections. As the Joe Six-Packs and Aunt Millies of the world learn of these apps and "need" them, we'll see the death of ISPs blocking end-to-end connections. But IPv4 can't handle this, mostly due to its meagre address space. So we will need to migrate to IPv6 to handle the customer demand, even from the great masses who have no idea what a TCP port is.

And we'll get better security than the joke that is NAT as a side benefit.

Not that IPv6 security is perfect, of course ...

A soverign remedy.

[Ungrounded Lightning]

Is that why they all but wiped out many of those tribes you just mentioned ?

If you want to know what happened to the American Indians you can ask them - or their mixed-race descendants. Like my wife. Or a significant number of my friends. (Unfortunately it's a couple years too late to ask the person who was perhaps my closest (just) friend for four decades...)

There was a lot of death due to European diseases. But contrary to popular myth, germ warfare was NOT used against them by the US. (One English general did do it before the Revolution.) When epidemics got started the Indians and non-Indian settlers worked together to try to mitigate them: Disease like smallpox were a threat to all.

Tribes were some of the first adopters of the smallpox vaccine. (The Sioux had a gold medal struck and sent to Jenner.)

The Indians are still here - in large numbers. (The Mohicans periodically issue press releases to point out that, contrary to the book title, they're still around. B-) ) There aren't a lot of fullbloods - but there aren't a lot of full-blooded English-Americans, or French-Americans, or Whatever-Americans, either. There was a lot of intermarriage. Many of those of Indian ancestry found it convenient not to mention it - sometimes even to their offspring.

"Redneck" isn't just about getting your neck sunburned if you work outdoors and have a short haircut. It's also about having a high likelyhood of some Indian bloodline. Many of the Indians - both fullblood and partbreed - have assimilated into the general population of the US. They're farmers and ranchers, civil engineers, high-iron workers, merchants, professors, computer scientists, nanotechnologists, ...

... without tyrannical rulers and enforced, draconian, social homogenization.

Well how's that working out for ya ?

A lot better than you'd think if you're depending on the media - especially ours - to tell you. B-) And a WHOLE lot better, over virtually all of the last quarter-millenium, than the European alternatives.

BTW, if you can show me a link to a world map showing the locations of all those tribes you mentioned I'd appreciate it

Here you go. There are links to a full-sized PDF and an index. The ones outside the continental US can be found easily as well.

- but in the meantime, the subject was COUNTRIES.

These ARE countries. THAT was my POINT. Most of them just happen to be surrounded by various parts of the United States.

"Indian nation" is NOT a feel-good term used by the soppy-headed. It's a literal, legal, reality. These are independent, sovereign nations, with their own territories, borders, and so on. Most of them have treaty-based alliances with the US federal government. Some don't. They have automatic US citizenship - much like the citizens of Puerto Rico. They are exempt from some US taxes - which ones depend on treaty terms and whether they're living on the res or off it. Some tribes receive ongoing payments - think "rent" - as part of whatever settlement allowed non-tribal members to settle some of their lands.

They're countries in an alliance with the US. They have more independence than the "several states" (which subordinated all their foreign policy, interstate commerce regulation, and currency matters to the federation). They're also far more independent of the US than satellites of the USSR (such as Estonia) were of Russia - or than the member states of the European Union are likely to be of their own central government within a couple decades.

Boning up.

[Ungrounded Lightning]

Now where can I bone up on the info you mentioned?

Start here. It has links to a lot of useful stuff, mainly on US Government sites.

Google is your friend. Things like info on the Six Nations' declaration of war on the Germans are easy to find with searches like "Iroquois war Germany".

Speaking of whom: It was the Iroquios Confederacy that was the main inspiration - primarily through Franklin - for the structure of the federal government of the United States. Prior to the discovery of their working Republic and its long history (which has been described as "outdoing the Romans"), the history of democracy and republican forms in Europe - particularly certain episodes from Greece - were used as royalist propaganda. They were cautionary tales about why government of the people was doomed to failure and despotic rule by a member of an elite was allegedly necessary.

Quit a bit of this history has been unearthed in recent decades. A search for "Iroquois Franklin" will point you to quite a bit of it, such as full online text of Bruce Johansen's The Forgotten Founders

Re:Nice commentary

[gujo-odori]

White is a race. Black is a race. I can think of a couple other skin colors that qualify, too.

Don't look now, but the dumbest thing on /. is, umm, you.