I’m the administrator of kbin.life, a general purpose/tech orientated kbin instance.

  • 1 Post
  • 201 Comments
Joined 1 year ago
cake
Cake day: June 29th, 2023

help-circle

  • Yeah, but they’re not. That’s the modern world. But also even if it was a web server there’s usually ways to advertise the IP for the app to connect to. I’ve seen other stuff do that. So getting an IP is easy. Once the app knows the IP and if you really want to allow connections from outside to your IOT devices (I wouldn’t) it could remember the IP and allow that.

    You really don’t need to give a fixed IP to everything. I think I’ve given 1 or 2 things fixed IPv6 IPs. Everything else is fine with what it assigns itself.





  • I’d go further than that and say that deciding to leave the house or not, are both gambles.

    But in the context of spending money with the only net result being you lose money, make money or retain the same money with no other goods or services provided in return. Then gambling is the primary attribute of that spend.

    Bookmakers and investments meet that criteria, your other purchases are not.




  • Ironically I just left the startup world for a larger more established company and the code is some of the worst I’ve seen in a decade. e.g. core interface definitions without even have a sentence explaining the purpose of required functions. Think “you’re required to provide a function called “performControl()”, but to work out its responsibilities you’re going to have to reverse-engineer the codebase”. Worst of all this unprofessional crap is part of that ground-up 2nd attempt rewrite.

    I think this is actually quite common in commercial code. At least, for most of the code I’ve seen. Which is why I laugh most of the time when people imply commercial code is better than most open source code. It’s not, you just cannot see it.


  • And of course, if they can charge you for a static IP then defaulting to dynamic is imperative, isn’t it? Pretty sure they’d try that with IPv6 too just to keep the income stream.

    I’ve mentioned it elsewhere. Some ISPs here in the UK have a dynamic IPv6 prefix. Want a static one? Sure, pay up.

    I suppose to an extent this kind of thing is akin to low cost airlines. Sure you can “technically” get a flight for €15. But once you’ve made it even remotely bearable you’ll be paying around the cost of a full service airline. But, it does make it very hard to have a website doing a proper price comparison.

    I suspect it’s the same here. I pay a bit more than most ISPs. But for that, I get decent in country support, fixed IPv6 prefix and static IP (I actually have a legacy IP block, but you don’t get those included in the base price any more). Whereas plenty of other providers charge less, but will charge you for anything beyond the most basic of connections. It means my ISP always appears at the expensive end of price comparisons.


  • But this is another interesting thing. Dynamic IP addresses made sense, when we were dialling up for internet, and the internet wasn’t the utility it is now.

    Back then we’d dial up for a few hours in the evening or weekend. Businesses that didn’t have a permanent presence would connect in the day to send/receive emails etc. So, you could have 500 IP addresses to around 1500 users and re-use them successfully.

    But now, what is the real point in a dynamic IP? Everyone has a router switched on 24/7 sitting on an IP. What is the real difference, in cost in giving a static IP over a dynamic one? Sure, CGNAT saved them IP addresses. But, with always on dynamic just doesn’t make sense. Except, that you can charge for a static IP. The traffic added by the few people that want to run services is usually running against the tide of their normal traffic. So, that shouldn’t really be an extra cost to them either.

    If everyone that ran a website did the extra work (which is miniscule) to also operate on IPv6, and every ISP did the (admittedly more) work to provide IPv6 prefixes and ensure their supplied routers were configured for it, and that they had instructions to configure it on third party routers, IPv4 would become the minority pretty soon. It seems like it’s just commercial opportunity that’s holding us back now.







  • But new IPv4 allocations have run out. I’ve seen ISPs that won the lottery in the 90s/2000s (when the various agencies controlling IP allocations just tossed them around like they were nothing) selling large blocks for big money.

    Many ISPs offer only CGNAT, require signing up to the higher speed/more expensive packages to get a real IP, or charge extra on top of the standard package for one. I fully expect this trend to continue.

    The non-move to IPv6 is laziness, incompetence, or the sheer fact they can monetize the finite resource of IPv4 addresses and pass the costs onto the consumer. I wonder which it is.




  • Generally, a device cannot get an internet facing IP address unless something else on your network is advertising the prefix. In fact, I’d argue there’s little point using DHCPv6 now. Some devices are only interested in SLAAC. But, if you have a router that gets an IPv6 prefix from your ISP (usually /48 or /64, but you can get other sizes) it will usually then advertise that onto your local network.

    As for the IP addresses. I would say that you should definitely still have a firewall in place. But the setup is the same as IPv4 just without NAT. e.g. you set a blanket rule for your prefix to allow outbound and block unrelated inbound. Then poke holes through for specific devices and services.

    By default, IPv6 implementations make an assumption that they’re not going to be a server (if you want a device to be a server, you can just set a static IP) and their “main” IP will be a random looking one (and the configuration will depend on whether it uses an interface identifier to create the address, or if it is random) within your (usually huge) allocation. But more than that, they will usually be configured to use the IPv6 privacy extensions (RFC4941). This generates extra temporary addresses per device, which are used for outbound connections and do not accept incoming connections. That is, people cannot see your IP address on their host from your connection and then port scan you, since no ports will respond. You could still have ports open on your “real” IP address. But, that one isn’t ordinarily used for outgoing connections, so no-one will know it exists. To discover it they would need to scan your whole prefix (remember that the /64 allocation you will generally get is the internet * the internet in terms of address space, that is much harder to brute force scan).

    I think the differences between IPv4 and IPv6 might seem scary, but most of them are actually improvements on what we had before, making use of the larger pools we have available. Once you work it out, it’s really not so bad.

    I would like to see routers setup to firewall ipv6 by default to give the same protection as NAT though, meaning users need to poke holes into the firewall for incoming connections. Maybe some do. I know mine did not and it was one of the first things I did.