Very unlikely. If you fat finger the drop all at the end, maybe. But why in the world would you change that?
Something to consider is its primarily a proprietary OS problem and a ipv4 problem. If I run freshly updated Debian on my firewall and my file server, and I run completely wide open, and no one knows my file server address (why would they?) then all they need to do is port scan a/64 to find a box that's about as hardened as the firewall. Its not a serious issue.
When we're all unemployable we'll all be unemployeed.
Except for the scammers.
Higher requirements are always better, right? Lets have HR request 10 years of windows 2008 experience, 25 years of linux kernel development experience, and willing to work 160 hour weeks for $8/hr w/ no benefits. How could we strike out when we're only getting the absolute cream of the crop?
The dumb con artists get weeded out, at great expense to the company, the smart con artists end up as execs, also at great expense to the company.
Register a fake name with Facebook etc... as that is what we are really talking about here.
Register your real name with all fake data. In fact do it a couple of times. Am I the vlm that is a famous author? Or the doctor of divinity? Or the airline pilot?
Another way is fragment your life into separate accounts to really confuse them. Am I vlm the ex-chemical engineer? or vlm the ex-cable pulling monkey? Or vlm the military vet? How many states have I lived in again?
Make it impossible for HR to figure out which is really you. If they give you a hard time, or even just comment on it, "well those cousins of mine, they get around".
Network Address Translation Address Translation? Is that like an ATM machine or a PIN number?
I think its a fair phrase to use, since the whole point of the post was some people confuse the concepts of NAT and stateful firewalls. So I'm writing about the "address translation" part of NAT not the helpful side effect of stateful firewalling.
"NAT address translation" is obsolete with ipv6 vs "NAT stateful firewalling" is better just called "stateful firewalling"
It's harder for a worm to propagate when 99.999% of address space is empty as opposed to being another windows box.
Simply because of security for my home network I prefer a single point of entry, not a dozen.
Most people will probably continue to have one ISP connected by a firewall. Instead of NAT which inherently does stateful firewalling, they'll just have a simpler stateful firewall and skip the address translation tables.
So one external IP address is simply enough for most of us.
How do I run a couple SIP phones, and a couple italk video conferences over a single ip address? Its a huge pain.
For years, ipv6 folks like myself have been using tunnel providers.
At this moment, in my highly biased opinion, your best bet if you have a static ipv4 addrs is he.net, and your best bet if you have a dynamic ipv4 addrs is sixxs.net. But your mileage may vary based, etc. I've used them both to great success.
So if you want a NAT router to keep network wormable flaws away from the OS you can still do it.
you're confusing NAT address translation with stateful firewalling. Linux has been able to do that for ages on ipv4 or ipv6.
A side effect of ipv4 NAT is providing stateful firewalling, in that obviously the fw has no idea what to do with incoming traffic that doesn't belong to a flow you've already set up. All you need is one line to do this in v6.
You're looking for a line vaguely similar to this:
ip6tables -i eth0 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
And try not to forget to drop by default anything coming in thru eth0 that doesn't match the line above, of course.
RFC 3041 dated January freaking 2001, assuming you're talking about using MAC addresses in the ipv6 address. Frankly I feel this is paranoia combined with ignorance of current ISP logging technology, in other words you don't have anonymity with ipv4 either.
along with ISPs seeing how many systems you have running on their network
Rates somewhere between 1) who cares 2) See RFC 3041 3) News to me that proxy servers are impossible on ipv6
exposes systems to OS flaws.
I suppose there are / will be bugs in v6 that would not happen in v4.
The logic in fact seems to be nothing but a really big switched network.
Thank god. Die NAT die! Can't happen soon enough. Some people will still want stateful "one way" firewalls. No problemo.
In short, I don't like what IPv6 gives us over what we lose with IPv4.
Given your list of misconceptions and misinformation, I'm not surprised.
First link is to a trash tabloid-ish site per the ads I saw. Not exactly peer reviewed science.
All the squealing is oriented around the assumption that the date they calculated is correct, and then wanders into wild speculation.
However, the cruddy first link carefully avoided any discussion of screwing up the dating.
Its very easy to improperly date a rock. For example, you can properly calculate the date of individual sand grains. But, its a really bad idea to assume the age of the sand grains equals the age of a sandstone later made out of that sand.
Another example, lets say I take a dump on the top of Rib Mountain, a quartzite xenolith in my area (sort of). Now its possible to figure out the "birthdate" of rib mountain, around one billion years, and the surrounding sedimentary rocks were worn away about half a billion years ago. Does my coprolite indicate human habitation one billion years ago, half a billion years ago, or last month? I suppose for a website with all the class of weekly world news, the story would be human habitation one billion years ago. But, although I have a low slashdot UID, I'm not that old (yet).
Humanoid statues can hold cables with their elbows, shoulders, top of their head, middle of their chest etc. Not just with their hands - like real humans.
If you think of all the places that have had piercings, there's quite a few more places to hang an insulator.
A few strategically scattered EMPs and all of those tapes and discs could be as valuable as the plastic they're printed on.
Humorously, the first two examples were paper tape and punch cards. Admittedly a six-digit slashdot UID would not be expected to be able to read those, but at least some of us 5 digit UIDs can. Not by inserting into an orifice but looking at them visually. This is an historically interesting skill for us 5 digit UIDs, kind of like going to a Renaissance Faire, although I'm guessing the 2/3/4 digit folks actually submitted slashdot posts via punchcards in ye olden days.
And as for the plastic comment, the best "paper" tapes were actually made out of mylar, so you were right even when you were wrong, although "best" depends a lot on the gear you use them with, etc. Mylar not so good for certain optical readers, etc.
Non-traditional, but is it unusual? I thought I'd seen transmission towers with guy wires, or at least some looked as though they should have guy wires (narrow base, tapering up and out).
Actually, if you examine the pictures, those are more like "girl wires" since these towers seem to have, uh, kind of wide hips and not much on top if you know what I mean. "Honey, does this 16 KV three phase service make my butt look fat?"
From a structural engineering perspective a phallic symbol would be much simpler and more stable, and from an EE perspective probably less corona discharge. Vaguely water tower shaped. Maybe there are some coastie states where that idea would fly.
(e.g. not looking for something to do with all that N2O, but looking for a source of the gas).
The problem is that rocket fuel grade N2O (few particulates to clog the injectors, few corrosives, low water content, low contaminant content such as CO2, N2, etc) is frankly pretty cheap, about twice the cost of cow milk per volume.
Even if N2O from sewage is magically "free" (don't they need enclosed tanks instead of open top tanks?), the filtration and purification plant is going to make it more expensive than the industrial product.
So its all just a stunt.
Finally I laughed at the whole concept of it being an "emissions free source of energy". If it takes 10 calories of petroleum to produce 1 calorie of edible food, the end to end efficiency must be lower than 10%, probably far, far lower. If you could extract much energy from poop your body would have evolved to extract it. We're actually darn near 100% efficient at simple sugars, for example, somewhat less so for indigestible fiber of course. Anyway its either an irrelevantly small source, or requires a ridiculous amount of primary energy (petroleum). Its a rube goldberg machine to extract a little extra energy from petroleum and sunlight.
but they don't have a way to deal with the N2O, so they use a different type of combustion system (a rocket booster) to burn that and emit oxygen and nitrogen gas (2N2 + O2)
Still doesn't answer my question of why a rocket?
Chemical oxidation is chemical oxidation no matter if you react it in a catalytic chamber, a boring old flame, a fluidized bed, or a rocket engine. They picked a rocket, which seems like a pretty stupid idea.
A rocket engine : Has a high thrust to weight ratio so it flies further but is an unholy PITA to design, Operates at high pressure AND temperature so you need exotic materials (either one separately is way simpler than both simultaneously), rockets have all kinds of terrible flame stability problems unless the injectors have a pretty high delta-p so you need to pressurize the heck out of the fuel and use tiny little easily clogged injector nozzles, output extremely high velocity exhaust (louder than hell). Oh and there are also multiple ignition problems such as "hard starts" when the fuel pools before ignition and blows the chamber like a bomb, and various sequencing problems (gotta spin up the oxidizer and fuel turbopumps at the same rate), and finally most non-hypergolic systems have serious issues with multiple restarts.
N2O will just burn, so why not do something way more appropriate like flow it into the intake manifold of a fuel injected IC engine hooked up to a generator, or "just freaking burn it" in a simple burner, or a somewhat more fancy fluidized bed?
So I ask again, is there any reason to use a rocket engine other than "gee whiz cool"?
Why all the complication of a rocket engine (aerodynamic flow, high thrust to weight ratio, ignition problems, injector stability/howling issues, injector clogging issues, high pressure fuel pumps) when they could just pipe it into a nice boring fluidized bed?
Sounds more like a stunt, to "get kids interested in science", than a solid technical engineering decision.
The same can not be said of the human brain, because it has the ability to change its hardware (via growing new connections between neurons).
If only you could mathematically simulate the connections between neurons growing and shrinking. You could call it a neural Beowulf cluster. Nahh, that doesn't rhyme. How bout calling my new idea a "neural net"? Nahh, no one would ever do that.
IPv4 devices will not be able to access IPv6 devices, which means that if you have devices with old OS in your network, you will have to use both v4 and v6.
Only if you use stuff much older than, say, Y2K. My MFC cannon laserprinter/scanner works ipv6 out of the box and its a couple years old. My wifes ancient 1st gen mac mini supports ipv6. My windoze-xp gaming partition works. Any roughly late 90s+ era linux kernel support v6.
If you want, you can set up a machine that specifically excludes v4 or v6, to allow complaining about it, but its more work than just letting it dual stack outta the box.
There is only a small amount of servers that support v6 and even smaller number of them support only v6.
Uhhhhh, apache 1.3 worked with patches, so post '98, a mere dozen years ago, is OK with minimal effort. Very early in the 2.0 series, Y2K, it got mainline ipv6 support.
You can, if you want, intentionally set up a server such that ipv6 won't work. But it actually takes some effort, at least in the last decade or so.
There are quite a few tunnel brokers for v6 to get you access over the past decade or so. he.net, sixxs.net, others, etc.
I hope we go to IPv6 sometime. I just dread having to go find an auction to pay hyperinflated prices for a 5 IP subnet if I want some v4 statics.
Most BGP operators filter their incoming routes at/24 or sometimes larger. So if you'll dread the cost of five addresses, the actual cost of, say, a/20 will really annoy you.
I could see poorer ISPs with large swaths of unused IP space being purchased by richer ISPs solely for their IP space...
Also expect to see a full court marketing B.S. press pushing "NAT access" as somehow being better or more private than getting public ip space, and if it happens to kill P2P all the better.
It's my job to count these. There are over 16,000,000 hosts that respond to ping on my network alone. If everyone does this I can see how the number would grow exponentially.
nmap -sP 127.0.0.0/8
Maybe its time for a "SETI at home" or "folding at home" type of distributed project.
How abouts you scan 127.0.0.0/9 and I'll take 127.128.0.0/9. We can split the workload several times over.
But guess what happens as you get a little older? You stop giving a shit about that stuff. You just want to get on with it, already. Suddenly tweaking and fiddling with config files in/etc doesn't feel hardcore, it feels really fucking boring.
You fix that problem at the start by by purchasing the correct hardware, not installing the correct distribution. I've been doing that since '93, its really quite easy.
Also in the past two decades or so I've noticed that the "stuff that only runs under windows" like winmodems, winprinters, winscanners, is generally, garbage and a complete waste of time under any OS, when compared to "standardized real stuff".
I was never able to buy and use a winmodem in the 90s, but I don't feel it was much of a loss.
That saved me from a mighty holy war being brewed up by the IT department. They tolerated it and left the engineering department alone, which worked pretty well.
Slashdot Mirror
ip6tables -i eth0 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
I'm going to email that to my mom so she can get her new dsl modem set up right.
If she had no problem doing "about the same thing" to set up her ipv4 connection, doing ipv6 is not going to be any harder.
The Chinese will be selling boxes at Walmart that do the same thing for ipv6 someday, as they do now for ipv4.
Merely stateful firewalls tend to fail open.
Very unlikely. If you fat finger the drop all at the end, maybe. But why in the world would you change that?
Something to consider is its primarily a proprietary OS problem and a ipv4 problem. If I run freshly updated Debian on my firewall and my file server, and I run completely wide open, and no one knows my file server address (why would they?) then all they need to do is port scan a /64 to find a box that's about as hardened as the firewall. Its not a serious issue.
When we're all unemployable we'll all be unemployeed.
Except for the scammers.
Higher requirements are always better, right? Lets have HR request 10 years of windows 2008 experience, 25 years of linux kernel development experience, and willing to work 160 hour weeks for $8/hr w/ no benefits. How could we strike out when we're only getting the absolute cream of the crop?
The dumb con artists get weeded out, at great expense to the company, the smart con artists end up as execs, also at great expense to the company.
Register a fake name with Facebook etc... as that is what we are really talking about here.
Register your real name with all fake data. In fact do it a couple of times. Am I the vlm that is a famous author? Or the doctor of divinity? Or the airline pilot?
Another way is fragment your life into separate accounts to really confuse them. Am I vlm the ex-chemical engineer? or vlm the ex-cable pulling monkey? Or vlm the military vet? How many states have I lived in again?
Make it impossible for HR to figure out which is really you. If they give you a hard time, or even just comment on it, "well those cousins of mine, they get around".
The only problem is that if everyone does this, then no one can find one another, which totally negates any reason for using Facebook
I've been told the only purpose for facebook is farmville. No problemo.
Network Address Translation Address Translation? Is that like an ATM machine or a PIN number?
I think its a fair phrase to use, since the whole point of the post was some people confuse the concepts of NAT and stateful firewalls. So I'm writing about the "address translation" part of NAT not the helpful side effect of stateful firewalling.
"NAT address translation" is obsolete with ipv6 vs "NAT stateful firewalling" is better just called "stateful firewalling"
Will I get less spam in my mailbox?
It's harder for a worm to propagate when 99.999% of address space is empty as opposed to being another windows box.
Simply because of security for my home network I prefer a single point of entry, not a dozen.
Most people will probably continue to have one ISP connected by a firewall. Instead of NAT which inherently does stateful firewalling, they'll just have a simpler stateful firewall and skip the address translation tables.
So one external IP address is simply enough for most of us.
How do I run a couple SIP phones, and a couple italk video conferences over a single ip address? Its a huge pain.
No ISPs that service my area support IPv6.
For years, ipv6 folks like myself have been using tunnel providers.
At this moment, in my highly biased opinion, your best bet if you have a static ipv4 addrs is he.net, and your best bet if you have a dynamic ipv4 addrs is sixxs.net. But your mileage may vary based, etc. I've used them both to great success.
So if you want a NAT router to keep network wormable flaws away from the OS you can still do it.
you're confusing NAT address translation with stateful firewalling. Linux has been able to do that for ages on ipv4 or ipv6.
A side effect of ipv4 NAT is providing stateful firewalling, in that obviously the fw has no idea what to do with incoming traffic that doesn't belong to a flow you've already set up. All you need is one line to do this in v6.
You're looking for a line vaguely similar to this:
ip6tables -i eth0 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
And try not to forget to drop by default anything coming in thru eth0 that doesn't match the line above, of course.
Anonymity is lost pretty quickly with IPv6
RFC 3041 dated January freaking 2001, assuming you're talking about using MAC addresses in the ipv6 address. Frankly I feel this is paranoia combined with ignorance of current ISP logging technology, in other words you don't have anonymity with ipv4 either.
along with ISPs seeing how many systems you have running on their network
Rates somewhere between 1) who cares 2) See RFC 3041 3) News to me that proxy servers are impossible on ipv6
exposes systems to OS flaws.
I suppose there are / will be bugs in v6 that would not happen in v4.
The logic in fact seems to be nothing but a really big switched network.
Thank god. Die NAT die! Can't happen soon enough. Some people will still want stateful "one way" firewalls. No problemo.
In short, I don't like what IPv6 gives us over what we lose with IPv4.
Given your list of misconceptions and misinformation, I'm not surprised.
First link is to a trash tabloid-ish site per the ads I saw. Not exactly peer reviewed science.
All the squealing is oriented around the assumption that the date they calculated is correct, and then wanders into wild speculation.
However, the cruddy first link carefully avoided any discussion of screwing up the dating.
Its very easy to improperly date a rock. For example, you can properly calculate the date of individual sand grains. But, its a really bad idea to assume the age of the sand grains equals the age of a sandstone later made out of that sand.
Another example, lets say I take a dump on the top of Rib Mountain, a quartzite xenolith in my area (sort of). Now its possible to figure out the "birthdate" of rib mountain, around one billion years, and the surrounding sedimentary rocks were worn away about half a billion years ago. Does my coprolite indicate human habitation one billion years ago, half a billion years ago, or last month? I suppose for a website with all the class of weekly world news, the story would be human habitation one billion years ago. But, although I have a low slashdot UID, I'm not that old (yet).
An Academy Award for "Best Unmade Motion Picture".
Alex, What is the Star Wars movies containing Jar Jar Binks?
Humanoid statues can hold cables with their elbows, shoulders, top of their head, middle of their chest etc.
Not just with their hands - like real humans.
If you think of all the places that have had piercings, there's quite a few more places to hang an insulator.
A few strategically scattered EMPs and all of those tapes and discs could be as valuable as the plastic they're printed on.
Humorously, the first two examples were paper tape and punch cards. Admittedly a six-digit slashdot UID would not be expected to be able to read those, but at least some of us 5 digit UIDs can. Not by inserting into an orifice but looking at them visually. This is an historically interesting skill for us 5 digit UIDs, kind of like going to a Renaissance Faire, although I'm guessing the 2/3/4 digit folks actually submitted slashdot posts via punchcards in ye olden days.
And as for the plastic comment, the best "paper" tapes were actually made out of mylar, so you were right even when you were wrong, although "best" depends a lot on the gear you use them with, etc. Mylar not so good for certain optical readers, etc.
Non-traditional, but is it unusual? I thought I'd seen transmission towers with guy wires, or at least some looked as though they should have guy wires (narrow base, tapering up and out).
Actually, if you examine the pictures, those are more like "girl wires" since these towers seem to have, uh, kind of wide hips and not much on top if you know what I mean. "Honey, does this 16 KV three phase service make my butt look fat?"
From a structural engineering perspective a phallic symbol would be much simpler and more stable, and from an EE perspective probably less corona discharge. Vaguely water tower shaped. Maybe there are some coastie states where that idea would fly.
(e.g. not looking for something to do with all that N2O, but looking for a source of the gas).
The problem is that rocket fuel grade N2O (few particulates to clog the injectors, few corrosives, low water content, low contaminant content such as CO2, N2, etc) is frankly pretty cheap, about twice the cost of cow milk per volume.
Even if N2O from sewage is magically "free" (don't they need enclosed tanks instead of open top tanks?), the filtration and purification plant is going to make it more expensive than the industrial product.
So its all just a stunt.
Finally I laughed at the whole concept of it being an "emissions free source of energy". If it takes 10 calories of petroleum to produce 1 calorie of edible food, the end to end efficiency must be lower than 10%, probably far, far lower. If you could extract much energy from poop your body would have evolved to extract it. We're actually darn near 100% efficient at simple sugars, for example, somewhat less so for indigestible fiber of course. Anyway its either an irrelevantly small source, or requires a ridiculous amount of primary energy (petroleum). Its a rube goldberg machine to extract a little extra energy from petroleum and sunlight.
but they don't have a way to deal with the N2O, so they use a different type of combustion system (a rocket booster) to burn that and emit oxygen and nitrogen gas (2N2 + O2)
Still doesn't answer my question of why a rocket?
Chemical oxidation is chemical oxidation no matter if you react it in a catalytic chamber, a boring old flame, a fluidized bed, or a rocket engine. They picked a rocket, which seems like a pretty stupid idea.
A rocket engine : Has a high thrust to weight ratio so it flies further but is an unholy PITA to design, Operates at high pressure AND temperature so you need exotic materials (either one separately is way simpler than both simultaneously), rockets have all kinds of terrible flame stability problems unless the injectors have a pretty high delta-p so you need to pressurize the heck out of the fuel and use tiny little easily clogged injector nozzles, output extremely high velocity exhaust (louder than hell). Oh and there are also multiple ignition problems such as "hard starts" when the fuel pools before ignition and blows the chamber like a bomb, and various sequencing problems (gotta spin up the oxidizer and fuel turbopumps at the same rate), and finally most non-hypergolic systems have serious issues with multiple restarts.
N2O will just burn, so why not do something way more appropriate like flow it into the intake manifold of a fuel injected IC engine hooked up to a generator, or "just freaking burn it" in a simple burner, or a somewhat more fancy fluidized bed?
So I ask again, is there any reason to use a rocket engine other than "gee whiz cool"?
Why all the complication of a rocket engine (aerodynamic flow, high thrust to weight ratio, ignition problems, injector stability/howling issues, injector clogging issues, high pressure fuel pumps) when they could just pipe it into a nice boring fluidized bed?
Sounds more like a stunt, to "get kids interested in science", than a solid technical engineering decision.
The same can not be said of the human brain, because it has the ability to change its hardware (via growing new connections between neurons).
If only you could mathematically simulate the connections between neurons growing and shrinking. You could call it a neural Beowulf cluster. Nahh, that doesn't rhyme. How bout calling my new idea a "neural net"? Nahh, no one would ever do that.
IPv4 devices will not be able to access IPv6 devices, which means that if you have devices with old OS in your network, you will have to use both v4 and v6.
Only if you use stuff much older than, say, Y2K. My MFC cannon laserprinter/scanner works ipv6 out of the box and its a couple years old. My wifes ancient 1st gen mac mini supports ipv6. My windoze-xp gaming partition works. Any roughly late 90s+ era linux kernel support v6.
If you want, you can set up a machine that specifically excludes v4 or v6, to allow complaining about it, but its more work than just letting it dual stack outta the box.
There is only a small amount of servers that support v6 and even smaller number of them support only v6.
Uhhhhh, apache 1.3 worked with patches, so post '98, a mere dozen years ago, is OK with minimal effort. Very early in the 2.0 series, Y2K, it got mainline ipv6 support.
You can, if you want, intentionally set up a server such that ipv6 won't work. But it actually takes some effort, at least in the last decade or so.
There are quite a few tunnel brokers for v6 to get you access over the past decade or so. he.net, sixxs.net, others, etc.
I hope we go to IPv6 sometime. I just dread having to go find an auction to pay hyperinflated prices for a 5 IP subnet if I want some v4 statics.
Most BGP operators filter their incoming routes at /24 or sometimes larger. So if you'll dread the cost of five addresses, the actual cost of, say, a /20 will really annoy you.
I could see poorer ISPs with large swaths of unused IP space being purchased by richer ISPs solely for their IP space...
Also expect to see a full court marketing B.S. press pushing "NAT access" as somehow being better or more private than getting public ip space, and if it happens to kill P2P all the better.
It's my job to count these. There are over 16,000,000 hosts that respond to ping on my network alone. If everyone does this I can see how the number would grow exponentially.
nmap -sP 127.0.0.0/8
Maybe its time for a "SETI at home" or "folding at home" type of distributed project.
How abouts you scan 127.0.0.0/9 and I'll take 127.128.0.0/9. We can split the workload several times over.
But guess what happens as you get a little older? You stop giving a shit about that stuff. You just want to get on with it, already. Suddenly tweaking and fiddling with config files in /etc doesn't feel hardcore, it feels really fucking boring.
You fix that problem at the start by by purchasing the correct hardware, not installing the correct distribution. I've been doing that since '93, its really quite easy.
Also in the past two decades or so I've noticed that the "stuff that only runs under windows" like winmodems, winprinters, winscanners, is generally, garbage and a complete waste of time under any OS, when compared to "standardized real stuff".
I was never able to buy and use a winmodem in the 90s, but I don't feel it was much of a loss.
If you can make a 60GB SSD, you can make a 600GB SSD. What advance in tech is being brought to the table?
Heat dissipation. Say you own a 60 GB SSD that draws 1.5 watts. A 600 GB drive would, superficially, draw 15 watts.
In theory you could trade speed (striping 10 devices in parallel) for power (concatenate 10 devices in series).
The main advantage I got out of Debian rapidly approaching 15 years ago was the DFSG Debian Free Software Guidelines
http://www.debian.org/social_contract#guidelines
That saved me from a mighty holy war being brewed up by the IT department. They tolerated it and left the engineering department alone, which worked pretty well.