873
We don't talk about IPv5 (lemmy.world)
submitted 1 year ago by to c/programmer_humor@programming.dev
198 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 50 points 1 year ago (16 children)

In my personal life I will probably "never" intentionally use ipv6.

But it is a DAMNED good sniff test to figure out if an IT/NT team is too dumb to live BEFORE they break your entire infrastructure. If they insist that the single most important thing is to turn it off on every machine? They better have a real good reason other than "it's hard"

  • permalink
  • fedilink
  • source
  • hideshow 16 child comments
    •
  • [–] 15 points 1 year ago (11 children)

    It’s vulnerable af. And I mean really, it’s as bad as Netscalers or Fortigate shit. Like https://www.bleepingcomputer.com/news/security/hackers-abuse-ipv6-networking-feature-to-hijack-software-updates/ or https://www.bleepingcomputer.com/news/security/hackers-abuse-ipv6-networking-feature-to-hijack-software-updates/

    Problem is, yes it’s hard to implement but it’s even a lot harder to get it properly secured. Especially because few people are using it, and not securing it is worse than disabling it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 22 points 1 year ago (5 children)

    And I would consider a detailed argument on why it is more secure to disable it to be a good reason.

    Personally? I consider an IT team who don't know how to secure an ipv6 enabled network to not be competent. But that is a different conversation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 1 year ago

    My detailed explanation at my old job is that the dev team was full of idiots who hardcoded ipv4 addresses into their fucking code. Seriously. When we migrated from data center to cloud they had to go patch everything. The CTO wouldn't do shit about it and the director was just there riding things out until retirement.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 year ago (2 children)

    It has less eyes on it due to it being less popular. It also introduces an extra vector of attack.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 year ago (1 child)

    It does not have less eyes on and it's 50% of Google traffic.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 year ago

    Think they mean local networks.

    If an IT department carefully curates IPv4 but ignores IPv6, then a rogue actor can set up a parallel IPv6 network largely without being noticed.

    IPv6 can be managed, just that it is a blindside for a lot of these departments.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 1 year ago (3 children)

    Realistically no organization has so many endpoints that they need IPv6 on their internal networks. There's no reason to deal with more complicated addressing schemes except on the public Internet. Only the border devices should be using IPv6.

    Hopefully if an organization has remote endpoints which are connecting to the internal network over the Internet, they are doing that through a VPN and can still just be assigned IPv4 addresses on dedicated VLANs when they connect.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 11 points 1 year ago (1 child)

    If you don't have ipv6 internally, you probably can't access ipv6 externally. 6to4 gateways are a thing. 4to6? Not so much.

    And this is why ipv6 will ultimately take another 20 years for full coverage. If it was more backwards compatible from the starting address-wise then this would all have been smoother. Should have stuck with point separators. Should have assumed zero padding for v4 style addresses rather than a prefix

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 year ago

    If you don’t have ipv6 internally, you probably can’t access ipv6 externally. 6to4 gateways are a thing. 4to6? Not so much.

    I'm pretty sure stateful gateways do exist, but it's a massive ball of complexity that would be entirely avoided if people just used native v6.

  • permalink
  • fedilink
  • source
  • parent