Slashdot Mirror
Vint Cert Warns IPv4 Users: 'Time To Get With the Program' (zdnet.com)
An anonymous reader quotes ZDNet:
Vint Cerf notes that the world ran out of IPv4 address space around 2011, some 13 years after internet engineers started sketching out IPv6, under the belief back then that IPv4 addresses would run out imminently. Since 'World IPv6 Launch' on June 6, 2012, significant progress has been made. Back then just one percent of users accessed Google services over IPv6. Now roughly a quarter of users access Google over IPv6. But Cerf noted that "it's certainly been a long time since the standards were put in place, and it's time to get with the program"...
The Internet Society's snapshot of IPv6 in 2018 notes that Google reports that 49 countries deliver more than five percent of traffic over IPv6. There are also 24 countries where IPv6 traffic is greater than 15 percent, including the US, Canada, Brazil, Finland, India, and Belgium. Additionally, 17 percent of the top million Alexa sites work with IPv6, while 28 percent of the top 1,000 Alexa sites do. Enterprise operations are IPv6's "elephant in the room", according to the Internet Society. Around 25 percent of all internet-connected networks advertise IPv6 connectivity, and the Internet Society suspects that most of the networks that don't are enterprise networks.
The Internet Society's snapshot of IPv6 in 2018 notes that Google reports that 49 countries deliver more than five percent of traffic over IPv6. There are also 24 countries where IPv6 traffic is greater than 15 percent, including the US, Canada, Brazil, Finland, India, and Belgium. Additionally, 17 percent of the top million Alexa sites work with IPv6, while 28 percent of the top 1,000 Alexa sites do. Enterprise operations are IPv6's "elephant in the room", according to the Internet Society. Around 25 percent of all internet-connected networks advertise IPv6 connectivity, and the Internet Society suspects that most of the networks that don't are enterprise networks.
it is 2018, and as of today, Verizon FIOS still doesn't support it. Why? Who knows.
I mean I love my Ipv4 address! couldn't they let me use that 4ever? Why Vint whyyy
The few managers and consultants I've talked to dislike ipv6 because
They do not want to type long ipv6 addresses. (their or their client's DNS is probably not setup well)
They fear incompatibility. (mostly I heard Exchange Server, which might still need netbios names (I'm not talking wins), even thought microsoft said with Active Directory you don't need netbios resolution, but you do...
Perhaps microsoft should have an end netbios campaign, like they did with ie6.)
Vint Cerf remains loyal. After helping to make the Internet easy to track, now he serves his masters by pushing a tech to make things easier, like fixed IPs even when changing networks or ISPs.
It looks like slashdoters are still stuck with XX century protocol
Ipv6 Socks proxy war on humans. The sentence may not make much sense (of humor) but think about it...
get off my lawn
Yes, we pretty much have to make it work somehow anyway. Because the kids who cooked it up fucked it up and nobody seems to be able to do better. But it's still a dead horse. You can flog it all you want, it's still dead, Vint.
I'm a Centurylink gigabit customer near Seattle with a static block of IPv4 addresses. Their IPv6 support is still only 6rd, which their implementation only works with a small handful of routers. Sadly, I just found out that my latest router is one that doesn't support it. STILL waiting on that native dual-stack support.
I firmly place all of the blame on the major ISPs at this point. Most have IPv6 dual-stack on their carrier networks, but are sluggish as fuck delivering the packets to the last mile for some ridiculous unknown reason?
"Vint Cert Warns IPv4 Users: 'Time To Get With the Program' "
Nahhh I still disable it on all my home devices. I don't respond well to nagging and ridicule. If you're thinking of doing that, go fuck yourself. I do not care what you think.
They tested IPv6 service about 7 years ago, but took away my IPv6 routers at the end of the trial period. All I have left are my static IPv4 addresses.
I'm in total agreement: at least move to IPv5 already, if you aren't ready for IPv6! Sticking with IPv4 is just being stubborn.
ISPs are just sitting on huge allocations of unused addresses making it appear they are all used up. If they were all used up there is no way that a subscriber to an always on connection like a cable modem would be able to sign up for new service. I don't see any ISPs that have suspended new sign ups cause they are out of addresses to give out.
Theres also the issue that IPv6 brings to the table of every device on your internal network now having an internet routable IP at it's interface. For the average joe blow who knows nothing about internet security this is a huge problem. All the devices on their LAN will be able to be probed and exploited remotely unless proper fire-walling is setup, of which I don't see many consumer routers having this kind of proper fire-walling built in.
At least with the IPv4 space and NAT, you got a pretty effective setup out of the box to isolate your internal network devices from the wild west of packets smacking against the WAN port of that router. I highly suspect that once IPv6 does take foot, we are going to be seeing a lot more remote exploits against devices.
Now there IS no shortage of IPv4# any more, since the invention of NAT. The only reason for IPv6 now is total traceability and the ability to directly address any device... something most users do not want.
We haven't "run out" of IPV4 addresses. Not even remotely so.
A good comparison would be land. There was a time, even within the last 50 years -- where one could (for example) 'stake out' land in Canada. You'd head to unclaimed land, put up your fences, work it and use it -- and in 5 (or 10? it's been a long time since I read up on this), the land would officially be yours.
This is closer to IPV4 realities, than not.
Why?
Because, IPV4 used to be *free*. You needed netblocks, you got netblocks. You request, and they were delivered.
Then they became non-free. Much like land in Canada, you can't just take it and use it, nope -- you have to buy it from someone.
A lot of that goes around, too. One corp selling to another. CorpA leasing to subscribers. ISPs selling additional IP addresses / month, for a fee.
If we had really "run out", I would have to WAIT to connect to the internet. Or, I'd be stuck behind a NAT device (I'm not), because my ISP had to aggregate clients because they had no free IPs.
Truth is, there's loads and loads of IPV4 laying around.
Otherwise, why would people be saying WE'RE GOING TO RUN OUT! for TWENTY FUCKING YEARS, and there's still a shit-tonne of IPs left.
Hmm?
Eh?
Hum?
Bah!
(And yes, SNI alone helped a lot... but that's not the point. Or maybe it is -- because, it's an example of "look -- there's gold all over the ground" and now "we have to dig for it, maybe we'd better use gold more wisely")
I bet in 2050, we'll still primarily be IPV4.
is all you need to know. ipv4 forever, you fucking libtards.
RFC1918 and port address translation effectively dealt with the IP address problem without the additional complexity of IPv6. IPv6 isn't just "IPv4 with more IP addresses."
"Tempers are wearing thin. Let's just hope some robot doesn't kill everybody." --Bender
Would someone tell me how this happened? We were the fucking vanguard of networking in this country. The IPv4 was the IP to own. Then the other guys came out with TCP. Were we scared? Hell, no. Because we hit back with a little thing called DNS. That's IPv4 and easy to remember english names. For usability. But you know what happened next? Shut up, I'm telling you what happened—the bastards went to IPv6. Now we're standing around with our cocks in our hands, selling four numbers and names. Usability or not, suddenly we're the chumps. Well, fuck it. We're going to IPv12.
#DeleteFacebook
I'm all for using ipv6, I think it's better, everyone should prefer it -- just don't mess with ipv4 users. Don't come saying it's obsolete when it still can work.
I'm all for Unicode, but ASCII has practical uses.
I'm all for country-code based top level domains -- just let's not mess with working [.com]s.
I'm all for 64-bit -- use it if you can and have RAM by the gigabytes... why not, it's cheaper these days... also, if it's costly, just drop the 32-bit version, if it's your call. Just don't campaign or annoy those who offer 32-bit in their own distros. Don't force new hardware on those for whom their existing ones work well.
I can't help it if my ISP still doesn't offer IPv6. They just assigned an IPv4 address permanently to all customers and figured "there, it's fixed".
Chicken and egg. In Azure, the only way you can get a public IPv6 address is by using a load balancer. You can't just put a single VM up on IPv6. Even if some other provider does offer better IPv6 support, Azure is #2 atm, so they'll need better IPv6 support as well.
NAT is going to be around for the next 50 years.
Editors, at least check your TITLES for blatant typos before posting. 'Time To Get With the Program' ...
My ISP doesn't give me IPv6 connectivity. So I'm sunk.
I suspect that many of the security breaches we read about every other day are due to people not knowing how to properly secure ipv6. Maybe I'm wrong but I don't see many easy to use tools for ipv6 and average users need them.
I disabled ipv6 in my sysctl file and DROP all input, forward, and output in ipv6tables. I haven't had any problems at all.
I have yet to meet a single competent CSO that will let IPv6 any further than a public DMZ or the outside of a corporate firewall.
Corporations hold onto NAT for reasons that are real, not imagined, and not easily overcome by smoothly worded IPv6 talking points.
If obscurity was not an effective part of security why do real security standards demand the obfuscation things like SSNs, Credit Card numbers, Bank Account numbers, etc? Why does Google block out zones on Google Earth when governments ask, And why are so many Police Officers afraid to give their real names to the public while serving in the line of duty?
Absolute identity has consequences. Many time the full risk of full exposure falls well into the realm of unintended consequences.
$ dig tech.slashdot.org aaaa
tech.slashdot.org. 59 IN CNAME www.slashdot.org.
$ dig www.slashdot.org aaaa
(no answer)
The World in which IPv6 Was a Good Design. I found this brief history on IP and Ethernet to be quite informative. It also suggests a possible way forward for mobile IP (by basically putting another layer on top).
Editor, A1-AAA AmeriCaptions
A stateful firewall is exactly the same as IPv4 nat. Firewall solved.
Long addresses? Please. What is dns for? Why does bind support dynamic dns? Idiots complaining about IPv6 not being memorable needs to get out of the kitchen.
Privacy extensions, solved. Yet you still have eg cookies at the http level. You use Facebook and google. Static IPv6 assignments are not an issue in comparison.
RFC1918 addresses fucking suck for VPN.
Imagine you connect to your workplace VPN. You use a /24 in 10/8. Your work place uses the same /24. You are going to have issues...
Nat is an ugly hack and needs to die. Anyone advocating Nat over IPv6 is an uneducated fear mongering idiot who knows fucking nothing about networking or firewalling.
Unfortunately these idiots are in key roles at 99% of ISPs.
Also IPv4 really is exhausted. Itâ(TM)s done. Want to start a new business or isp needing ip space? Enjoy your max 1024 IPv4 addresses from your RIR. Then pay a premium to buy on the market.
Getting your final /22 from your RIR can get you a /48 to /32 of IPv6 space. Same price.
At this point anyone not jumping in is effectively stifling growth of the internet. Anyone arguing against IPv6 is a Luddite and is probably scared of the big hex numbers.
And now is up to us to pick up the pieces.
They simply made the address field too small.
And do not but that "this was an experimental network, we couldn't have known" weasel-talk.
You see, about the same time Vint and Bob were working on their little 4 Bytes in the Address Field protocol (1981), Other people were also working on similar protocols.
Some Guys at OSI were working at CLNP, and guess what? That has 20 (5 times more!) Bytes in the Address Field...
Some other guys at Xerox were working on IDP, which has, hear this 12 Bytes! on the Address Field...
Those guys at Xerox and OSI knew how to think big, and were real visionaries. Other people realized big address fields were needed. Too bad uncle Vint and Uncle Bob did not...
But, by luck of the dice and historic accident, IP emerged as "the" network layer protocol. Fair enough.
When world + dog realized that IP had not enough addresses, the IAB came up with a nice solution: Use CLNP. Good, that thing was _already_ implemented debuged and tested in most routers in the world, client implementations existed (and were debuged and tested) for most OSs in the world, and all the IP (pun intended, I mean, intellectual property, such licesinsing and patents) was already sorted out. There is even an RFC (1347). Work and migration could have started then and there in 1992!
But even if you dislike OSI, you could have used IPX (a decendant of IDP with 12 Bytes addresses). Again, IPX had rock solid implementations for pretty much all OSs at the time, was implemented in every single router, and had all the Licensing/Intellectual properties sorted out. There is also and RFC for that (RCF 1791). So, again, the migration could have started then and there in 1995!
But the IETF, suffering from a bad case of Not Invented HEre Syndrome, did what is called the "palace coup" and decided to disregard the orders of the IAB, and create IPv6. What were Vinton's opinions on that? I think he stayed mum (or even worse, cheered the move).
What we know now as IPv6 was voted as "the way to go" between 1994 and 1995 , and the firts implementation (on AIX) appeared in 1997. And was not until 2000 that most OSs had production quality IPv6. So, we lost between 5 and 7 years of transition time (depending of if you preffer using CLNP or IPX)... And countless man-hours were wasted reimplementing the Long Address wheel in every OS and every Router and Every modem, and .... you get the drift. And is a weird one at that which, for example, does not have a header checksum...
And after all this, old uncle Vint is pontificating on the need of migrating fast to IPv6? Get a grip!
PS: In NO way is this post intended to diminish the contributions of Vint and Bob to networking. Those contributions are huge. is just to point out the incoungruence of getting us in this mess in the first place and then pontificating for us to hurry up!
*** Suerte a todos y Feliz dia!
Spectrum still has no IPv6 support. It really is getting to be ridiculous that its 2018 and there is still no IPv6 support. When, if ever? Do these companies need to be fined to compel them to upgrade>
I know I'll get burned for saying this but IPv6 fails the scratch and sniff test. I've grown up around the IPv4 dilemma yet no-one I know that I worked with (contractor worked at 30+ different businesses) ever seemed to fully grasp IPv6. Workers don't get it, vendors don't get it, network providers don't get it, telcos don't even seem to get it. Based on the fact that we've been at this for 15years+ and it still hasn't gained any traction it's time to call it a failure and move on.
Ever heard of that Vint?
That error should be fixed.
There is not a single ISP on the NBN in Australia who provides IPv6 over FTTC. That is new technology launched in 2018. Way to go NBNco!
bash$
Hardly anything works with IPv6 except new things. The vast majority of ISPs don't even support it.
The problem is, IPv6 is not an upgrade to IPv4, it's a completely different and incompatible protocol! /SPX or AppleTalk because the cost of migration is the same!
You may as well be trying to switch people to IPX
It's like saying You should all use Linux now! when all your programs run on Windows and aren't compatible with WINE.
Switching to IPv6 will require, in many cases, throwing out perfectly functional hardware and software and replacing it with newer unproven gear at great cost for no immediate benefit; Try selling that one to management!
They really really should have engineered some sort of backward-compatibility into it - As it is now, it is just a competitor to IPv4 in the same way the theoretically superior Itanium/IA-64 was a competitor for x86/AMD64 and we saw how well that went.
I honestly think they should go back to the drawing board while IPv6 implementation is relatively low if they are serious about getting people to switch in a more timely fashion, otherwise they'll have to just accept the transition will be glacially slow as it'll only happen as existing working systems become obsolete and break and replacement is forced.
append="disable_ipv6=1 disable=1 autoconf=0 ipv6.disable=1"
Yup!
no more ipv6 on the pipes...
just sayin it can also be configured similarly for grub with the GRUB_CMDLINE_LINUX_Default="quiet splash disable_ipv6=1 disable=1 autoconf=0 ipv6.disable=1"
Why is every IPv4 address not also an IPv6 address, in fully backwards-compatible fashion?
Also, why isn't the IPv4 address I'm assigned behind my carrier-grade NAT, plus the IPv4 address of the carrier-grade NAT server, an IPv6 address?
for eg
If youtube for limited ipv4 users to 480p or less
if facebook limited ipv4 to just 2 hours a day
if netflix limited ipv4 users to 480p or less
etc..
progressively making it worse for ipv4 users as time go on...
There would be public outcry and the ISP's and service providers would be forced to get off the butts and implement ipv6
So why shouldn't they give themselves the best treatment?
To share the 'net with turd world hordes at all was a big mistake.
Cerf with an F, not Cert with a T
I warn Vint Cerf: if you had not done such a crappy job of designing IPv6 then you would not be whining now about why people do not want to use it. The warning: next time let somebody competent lead the project, if there is any next time for you.
Bleah. Vint Cerf, narcissist, responsible for arguably the most expensive technological mistake in history.
Still getting downmods for calling Vint Cerf what he is. If you had ever met him, you would know too.
When all you have is a hammer, every problem starts to look like a thumb.
Vint Cerf followed up his Commodore 64 with the Commodore Plus/4. It's better because it has more bytes available for BASIC programs!
We need an IPV7 which is IPV6 minus the stupidity of every address being route-able on the internet...internal systems should not be left to the possibility that a mistake is made and the system is on the internet all of the sudden.
"Vint Cert" sounds like the name of a website where you can buy security certificates from Vint Cerf.
Forget "Let's Encrypt"; get your certificates from Vint Cert!
NAT has nothing to do with packet dropping; NAT is juts "Network Address Translation".
Rather, the firewall is responsible for dropping packets.
As always, the U.S. government (via the military) chose winners and losers; as always, government chose the wrong solution, and we're stuck with it.
If I had an account I'd mod you up.
Slashdot loves their old school leaders and will defend them to the death. Vince is an arrogant prick; that has been proven. Can't do shit about it but call it as you see it. Don't let the downmods stop you. Keep spreading the good word.
I warn Vint Cerf: if you had not done such a crappy job of designing IPv6 then you would not be whining now about why people do not want to use it. The warning: next time let somebody competent lead the project, if there is any next time for you.
Bleah. Vint Cerf, narcissist, responsible for arguably the most expensive technological mistake in history.
Still getting downmods for calling Vint Cerf what he is. If you had ever met him, you would know too.
I have. Leaves nothing to the imagination.
When all you have is a hammer, every problem starts to look like a thumb.
I mean I love ny IPV4 address. Why can't we marry and have cute little IPv2 addresses, we wouldn't hurt anyone. So why we have to suffer? Whyy?
When I still had AT&T U-Verse, not only did they not provide IPv6 but they took steps to block IPv6 over IPv4 tunneling so maybe someone should talk to them? I complained to the FCC and they approved the practice.
This isn't like the argument of whether we should be using QUIC instead of TCP (which is a legitimate battle). We really need to switch over and move on..
I'm ok with QUIC being used which it already is btw - in Chrome and other Google services. But we do still need IPv6.
After all the ivory tower BS of the article you linked to, we need shit that actually works. It's very easy for the ivory tower people to cry foul that it could have been done better etc. We need something that actually works and IPv6 does. Unless you come along and actually implement something better, that's what we have.
Yes, it's a disgrace we're not all using something like MinimaLT right now, but that's life. Much worse than any of that is running out of address space, when we have the technology to have static IP addresses for any device in the world forever .. with IPv6.
IPv8 (or whatever it will be called) will be a a battle for another day...
And the sooner we get IPv6 the sooner you can have that argument.
Yeah, it was always going to be messy. Once you put your pen down and realize you actually have to have backwards compatibility and still push forward to make way for the future, it's going to be someway messy and most of that mess has been taken care of tirelessly over the last 2 decades. That's life. It's disgraceful people are holding this back. I'm a conservative and believe me, we need this. Vint Cert is right (unsurprisingly) We need to get with the program. ISP's and financial services companies who are stalling on this need to fall into line or f*** off to Mars.The internet wasn't created for those parasites.
can suck it. They are the very people who resist IPv6 for political reasons. They like the idea of the internet being a constrained resource so they can kick out the little guy from having a dedicated IP address.
If we had really "run out", I would have to WAIT to connect to the internet. Or, I'd be stuck behind a NAT device (I'm not), because my ISP had to aggregate clients because they had no free IPs.
Many ISPs already put subscribers behind NAT, particularly mobile ISPs and home ISPs in later-to-develop countries. The only way to get your own IPv4 address from those ISPs is to upgrade to business class service with a static IP.
That's what copy/paste and mDNS are for.
Copy/paste is practical within a single device but not, to my knowledge, across devices. What solution do you recommend for synchronizing the clipboard across devices that run Windows, macOS, X11/Linux, Chrome OS, Android, and iOS?
Step 1 in the deployment of any computer at large corporation is to disable IPv6, otherwise things mysteriously don't work. The real problem with IPv6 is that it is not user friendly in the same way that IPv4 is. Remembering 4 sets of 3 digits is incredibly simple, especially when the first 2-3 sets of digits are all the same. I don't see IPv6 ever being adopted unless Google were to disable support for IPv4 forcing the whole damn world to switch or no longer be able to access Google Search and Ads.
...as he said when he was on campus a couple years ago, google's self-driving cars that have NO steering wheel and NO pedals.
But people do want to use it. They just can't because telcos don't support it. Minor telcos do. The ones that realise that investment is not a dirty word. It's not Vint Cerf's fault that some groups thrive on fucking their locked in users. At least when you invite over a prostitute you get some enjoyment out of it.
Did you mean to have a discussion with yourself?
Just like every homeowner is expected to buy connectivity and addressing from their isp?
And when smartphones were new, a lot of people were reluctant to buy a cellular data plan because they were already buying connectivity from their home ISP. Some householders just don't want yet another perpetual utility bill, which means yet another company dipping into the family's checking account and potentially exposing said account to accidental or fraudulent withdrawals that cause overdrafts.
if you're content to use the same domain as thousands of others then there are many free options
You mean free dynamic DNS? One drawback of this has been that Let's Encrypt issues only 20 certificates per registrable domain per week. The dynamic DNS provider has to apply to Mozilla for inclusion on the Public Suffix List, which is administered on a Microsoft-run website. Some are unwilling, and last I checked, others' applications were in a months-long backlog.
and nothing to stop the isp from allocating a subdomain to their customers.
Of course there is: The major last mile ISPs have a business policy not to let home users run servers in the first place. I concede that ISPs have power to amend this policy, but you'd have to show ISPs a good case for amending this policy, as upgrades to more expensive business-class service make them money.
Plus there is always .local and llmnr/mdns if you don't need global reachability of your hostnames.
Neither Let's Encrypt nor any other trusted-by-default HTTPS certificate authority does .local. It violates the CAB Forum's Baseline Requirements.