Slashdot Mirror

← Back to Stories (view on slashdot.org)

Major 'Net Players Mulling IPv6 Whitelist

Posted by Soulskill on from the transition-period dept.

netbuzz writes "From this week's IETF meeting in Anaheim comes word that leading Web content providers are talking about creating a shared list of customers who can access their Web sites via IPv6. The DNS Whitelist for IPv6 would be used to serve content to these IP addresses via IPv6 rather than through IPv4. David Temkin, network engineering manager with Netflix, says: 'We're looking into the same service that Google has, where we will try to track what connectivity the user has. We're in discussions with Google, Yahoo, Netflix and Microsoft to see whether it makes sense to have a shared, open source DNS whitelist service.' ISPs are not wild about the idea."

14 of 158 comments (clear)

  1. ISPs are not wild about the idea. by John+Hasler · · Score: 4, Insightful

    If ISPs would get their heads out of their asses "this idea" would not be needed.

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    1. Re:ISPs are not wild about the idea. by mellon · · Score: 5, Insightful

      Actually it's not the ISPs they're referring to who have their heads in their asses. Indeed, I don't think anybody has their heads in their asses on this one--each side of the discussion has legitimate points. From the perspective of IPv6 deployment, the whitelists suck, because mostly they prevent people who are trying to use IPv6 from using it--you have to be on the whitelist before you can get AAAA records from these online services. It's very hard to get on the whitelist, and very easy to get knocked off of it.

      ISPs who are deploying IPv6 want to just get the AAAA records, and not have to jump through hoops to get on a whitelist. But the providers worry about people who have crappy home gateways that fall over and die when they get AAAA records, and also about people who have devices on their networks advertising IPv6 connectivity, when they don't actually have it. One presentation in that meeting set the number at about .8% of users, which they felt was too many.

      Personally, I think they should just turn on the AAAA records and let the customers who have broken routers see that their routers are broken and fix them. But it's a rough tradeoff--IPv6 has at times gotten a bad rep for being the cause of network problems, and so network no-nothings tend to tell you "IPv6 is the problem" when in fact it's bad code on embedded devices that's the problem. Since disabling IPv6 "fixes" it, IPv6 gets the blame. That's the rationale for the whitelists, and as much as I hate them, I can't say that this rationale is completely wrong.

    2. Re:ISPs are not wild about the idea. by trapnest · · Score: 3, Funny

      I want to use ipv6 because it's cool and new.

  2. Not a "whitelist" by pem · · Score: 3, Insightful
    This is not a whitelist proposal.

    This is the mother of all cookies.

    1. Re:Not a "whitelist" by Abcd1234 · · Score: 4, Interesting

      LOLFR, "globally unique MAC address"... riiight. No manufacturer has *ever* reused a MAC address... *snicker*

    2. Re:Not a "whitelist" by mellon · · Score: 3, Funny

      Yes, a cookie that says you get your connectivity through an ISP that's on the whitelist. Ooh, scary! :')

  3. This doesn't have to last long by Xipher · · Score: 3, Insightful

    Any ISP that's not "wild" about the idea should step up and work with the community on actually getting IPv6 connectivity as functional as IPv4. I can see Google/Netflix perspective here. If they don't have some sort of white list they will get a black eye for having poor service when it's not even a result of something they control. Hopefully this will be something very short lived but I can imaging if service providers don't step up and start taking IPv6 seriously it's just going to prolong the issue.

    --
    I don't know everything.
  4. I'm sure they have a reason for it... by pathological+liar · · Score: 4, Insightful

    The article doesn't make it particularly clear what that might be though. The closest I found was:

    "There's a pretty key reason for whitelisting," Temkin explains. "It's really, really easy for anyone using, for example, Hurricane Electric's tunneling to find that the IPv6 network becomes an island and that it is broken because they didn't update a tunnel...You end up with the customer having a bad experience. They never see the content or they only see the content after a 30-second wait."

    Which seems like a no-brainer to me: Fix the tunnel. I don't even understand how the whitelist might help that -- if the whitelist says "This user has IPv6 connectivity" and you have a broken tunnel either you don't get the content at all, or you still only see the content after a 30-second wait.

    The real 'island' problem is that IPv6 routing is kind of a mess. If you're on the east coast of North America and want to connect to western Europe, depending on who your provider is it may well decide to send all of your traffic through Korea, if it even makes it to your target at all. I imagine that's a problem that will solve itself as more routes come online.

    1. Re:I'm sure they have a reason for it... by Abcd1234 · · Score: 3, Informative

      The real 'island' problem is that IPv6 routing is kind of a mess. If you're on the east coast of North America and want to connect to western Europe, depending on who your provider is it may well decide to send all of your traffic through Korea, if it even makes it to your target at all. I imagine that's a problem that will solve itself as more routes come online.

      It's actually worse than that. Currently many people have routers at home that send out v6 router advertisements despite not actually having IPv6 connectivity. The result is that many people end up with v6 addresses, and when those machines then try to connect to websites that advertise AAAA records, they end up with long delays as the browser first attempts a v6 connection, times out, and falls back to v4.

      Honestly, try googling for "Ubuntu disable ipv6" some time... it's amazing how many people are struggling with this issue. Which is why so many sites are reluctant to roll out v6 connectivity and AAAA records (even Google doesn't do external AAAA resolution unless your ISP has arranged a special agreement with Google which guarantees proper v6 connectivity (luckily Hurricane Electric has such an agreement, so as long as I use their DNS servers, I get v6 connectivity to all of Google's services)).

  5. Re:Nice Try but... by Kjella · · Score: 3, Insightful

    The real issue I think is, who wants an IP6-only Internet connection? NOBODY. Because despite everything, there's millions of applications and shit that won't work because they assume there's nothing but IPv4. You can pry my IPv4 address from my cold dead hands, being on IPv6 would be very close to being permanently behind NAT - you get out, nothing gets in. And if you're handing out a IPv4 address as well, you've gained nothing. I'm guessing someone at the bottom of some barrel somewhere end up taking it anyway because that's all there is, but it won't be in the first world countries. That is the only way it'll really happen beyond nice bullet points on how we should all go IPv6.

    --
    Live today, because you never know what tomorrow brings
  6. Re:yeah also if you unplug your modem and forget.. by Abcd1234 · · Score: 3, Informative

    Seriously, whitelisting just because people smart enough to set up a tunnel forget that it doesn't work any more?

    Huh? What the hell are you talking about? The reason this whitelist is necessary is because many people are victims of routers that send out v6 router advertisements despite not having v6 connectivity, or are on a network that claims to have v6 connectivity, but that connectivity as actually broken. As a result, these people get v6 IPs, and then when software tries to connect to websites that advertise AAAA records, they get long delays while their browser times out attempting to connect over v6, at which point it falls back to v4.

    Hell, all you have to do is Google for "ubuntu disable IPv6" to see how many people are suffering with this problem.

    So, please, quit being a paranoid jackass. There are *very* good reasons to set up this whitelist, and TBH, I think it may be the only way to start getting sites to advertise AAAA records (right now they don't because they're afraid of impacting the user experience due to this very issue).

  7. Re:Nice Try but... by mellon · · Score: 4, Interesting

    I want an IPv6-only connection. I want one that works. Because then I can have a global IP address that's reachable, and then I can do peer-to-peer protocols. This is much better than IPv4, where mostly my devices are behind a NAT, and peer-to-peer requires clever device-specific hacks to punch holes in the NAT. This reduces reliability, and in a lot of cases makes simple protocols that ought to work fail. I can't do iChat video with my dad because he's on the far side of two layers of ISP-inflicted NATting. And no, he can't change providers - what they have now is orders of magnitude better than what they had before my mom and several other members of the selectboard in her small town organized a local wireless ISP using an antenna at the top of a local mountain. If they had IPv6 that worked, it would be *much* better.

    The problem is that right now IPv6-only connections don't work, because not enough stuff on the network is reachable. That's changing, and this is part of the change. At the recent IETF, there was a v6-only network with a 6to4 NAT, and it worked pretty well, although it turned up a few bugs in a certain vendor's IPv6 stack.

  8. Re:The issue is metadata by Abcd1234 · · Score: 3, Informative

    How do you get on this whitelist?

    *You* don't get on the whitelist. Your ISP gets on the whitelist, by demonstrating they have functional v6 network connectivity. Once that's done, the ISP is added to the whitelist, and thereafter, any DNS records resolved using the ISPs DNS servers will include AAAA records from participating content providers.

    For example, Hurricane Electric entered just this sort of agreement with Google. As such, anyone using HE's DNS servers get Google's AAAA records, and so because I use HE as my tunnel broker, I get access to Google via v6. However, Google knows nothing about me in particular.

  9. Re:Why do they need a whitelist by Fastolfe · · Score: 3, Insightful

    This is to deal with cases where an ISP sets up "trial" or "beta" IPv6 services for their users, and they don't support it as well as their existing IPv4 service. They might have an IPv6 outage for hours or days, but nobody cares because it's just a trial, right? Meanwhile, the user is having an awful experience trying to pull up www.google.com, and they don't know why, and since every other web site seems to come up without a problem (because they're all still on IPv4), they conclude that it's a problem with Google.

    You can avoid much of this by whitelisting ISPs that have demonstrated that they actually care about IPv6.