@lanodan@phnt@slashb It's easy to restrict access when you don't want something to be public, but that's clever. Some stuff that I want accessible but not necessarily public, that stuff's on Tor now.
@p@phnt@slashb Yeah, I've sometimes put some stuff on Tor as well, specially SSH. But IIRC it's a bit of a mess to put stuff behind a separate .onion in the case where you already have a public onion service (and tor network also has a lot of bots, specially these days).
> why? not being routed is what firewalls are made for. not being routable by default is a side effect of NAT, not a feature.
This is the first place everyone goes.
The explicit goal of the utopian lunatics that created IPng, which became IPv6, was to ensure that your coffee pot *did* have a publicly routeable address. It was explicit. It was in the docs. These ideas predated even the wide adoption of IPv4--when the presumption was that malicious traffic would be rare and no one knew exactly how many things would be fucked up by heap allocations, a time before the Code Red worm--and the ideas have not been updated since, despite all of the practical experience gained going from "no global network" to "global network". If an event occurs that is unprecedented in the history of the earth and the experience does not update your ideas, then your ideas are divorced from reality.
You look at "Network 10 Considered Harmful" and they're wringing their hands that if private subnets proliferate, we won't run out of addresses fast enough and then people won't be forced into IPng where your coffee pot will be publicly routeable. These people have been trying to create the catastrophe for 30 years so that you will use their terrible Second System. This is why, until everyone stopped listening, they kept publishing these "Well now we're *really* out of IPv4 addresses" press releases every four years or so. That's not to say that we've got plenty of IPv4 addresses or that IPv4 is the ideal solution, but if there's a guy that expects an inheritance and he keeps trying to pull the plug on your life support, maybe that guy's not the right guy to trust.
Nobody likes NAT. That doesn't mean that NAT is the worst thing that can happen to you. (The worst thing that can happen to you is IPv6.) ipv6_cve--i_am_never_wrong_about_anything.gif
@phnt@p@slashb > The idea that devices on my LAN should get publicly routable addresses is insane.
why? not being routed is what firewalls are made for. not being routable by default is a side effect of NAT, not a feature. link local isn't routeable anyway, if you don't have a router set up to announce the route for slaac or dhcpv6 your devices don't get routeable addresses.
> i don't really see what's the use of a connected networked device but without the right settings to actually work?
"Working" is not reasonably defined as "publicly routeable" because "I want to be able to communicate between these two systems" is a very different proposition from "I want this system exposed to the public".
When the next Mirai-level botnet occurs, all of the people that said "Pfff, NAT isn't a security feature, you should configure your router properly" are still going to blame the routers. ISPs hate for you to run your own router anyway, they try to avoid letting you do that kind fo thing, so "configure your router" means "hack this shitty cheap thing that Comcast misconfigured". And the internet will be nuked and shat on and they'll still be insisting that there's no reason to ever be cautious about a transition between two fundamentally different states.
@phnt@p@slashb > SLAAC and link-local gateways is insane.
there is an v4 version of this when there is no dhcp around, 169.* subnet or something. link local addresses aren't routed. if one doesn't want the slaac routers, don't have the router advertise itself as a router - i don't really see what's the use of a connected networked device but without the right settings to actually work?
@phnt@p@slashb everything's just like my opinion, of course. ipv6 isn't perfect, but pretty well designed. one has to know much fewer special cases, almost everything you need to know is encoded in the address itself. most of the problems seem to be either chinesium routers doing v6 like you'd do v4 or isps being isps.
maybe v6 just is too nice in it's assumptions and out of place in this world ;)
@phnt@p@slashb > > When hosting providers throw /64s at every VM you buy, the size of the address space is useless when it's occupied by a small fraction of machines. IPs are supposed to be addresses to machines and not that you have 2^64 addresses resemble a single machine.
the last 64 bit are the interface address. the first 64 bits for the network already are 32 bit more than the whole address space of v4. i'd have used longer prefixes, but in reality it's not that relevant imo.
>why? not being routed is what firewalls are made for.
That assumes that everything that runs on IPv6 at home has properly functional firewalls. Spoiler alert: It doesn't and never will. Especially when the router acts only as a gateway without proper firewall which is almost always because UPnP exists and somehow is always enabled by default
>not being routable by default is a side effect of NAT, not a feature.
No this is a feature. LAN as the name says is _local_. The idea that a machine on my _local_ network gets a routable address everywhere by default as envisioned when the protocol was made is insane and there's no questioning about that. Especially if it is done automatically like now.
>if you don't have a router set up to announce the route for slaac or dhcpv6 your devices don't get routable addresses.
How this works is that ISP announces your assigned range and that's it. The fact that the specific address isn't announced like "Hey, I exist" changes almost nothing. It will still get routed to your home by the ISP. You can also knock in the ranges rather easily, or just look at DHT from BitTorrent and now you have an actual address. This knocking is already a common thing in botnet router exploitation.
>there is an v4 version of this when there is no dhcp around, 169.* subnet or something.
Yes, and only Windows uses that. It's called APIPA.
>link local addresses aren't routed.
They are locally and nothing asks you if you want that.
>i don't really see what's the use of a connected networked device but without the right settings to actually work?
To-be-assigned static addresses, general testing, temporarily putting the machine out of the network for whatever reason and more.
>the last 64 bit are the interface address. the first 64 bits for the network already are 32 bit more than the whole address space of v4. i'd have used longer prefixes, but in reality it's not that relevant imo.
The whole point of IPv6 was that we would hopefully never run out of addresses, then ff a decade and we are throwing /64 subnets that describe _one_ machine on the Internet. Does that make sense? The point of v6 was also that we would make P2P networking actually usable with the routable addresses on your local network, which is a good idea on paper, but terribly executed. It never should have been automatic.
> which is almost always because UPnP exists and somehow is always enabled by default
UPnP isn't even the worst of it. I arrived here and the router here had port 80 open to the world and "admin"/"admin" as the credentials. The ISP set this terrible goddamn router up: they're also the *only* ISP that serves this area.
> No this is a feature.
Well, a feature of the existence of private address spaces, right; NAT was developed to map private IP spaces onto public ones, and then they built the cone and this, because it took address allocations away from the Central Committee and just gave you a class-A to do whatever with, was anathema to the Central Committee.
> This knocking is already a common thing in botnet router exploitation.
This is imporant shit that will end up completely ignored by everyone that is engaged in motivated reasoning around IPv6.
> Yes, and only Windows uses that. It's called APIPA.
dhcpcd will try to give you one if you don't get a DHCP response and you don't give it -L.
@bonifartius@p@slashb >>i don't really see what's the use of a connected networked device but without the right settings to actually work? >To-be-assigned static addresses, general testing, temporarily putting the machine out of the network for whatever reason and more.
Also the idea that a computer does something automatically that I never asked for is stupid. A computer does what I tell it to do, nothing more and not less.
@p@phnt@slashb@bonifartius NAT is just packet mangling though, so if wan side of things comes in with a spoofed address matching your local subnet, they have access to your LAN, unless you do in fact have a firewall (pretty much everyone's box is setup that way except maybe the bullshit like exposed OpenWRT boxes, see /luci/ on shodan.io).
> turn off slaac on the client, turn off router announcements, etc.
I fully expect competent network management practices from all people that bought a light bulb with an app on it and have a refrigerator that shows them ads. I mean, sure, they may have ended up unwitting participants in the Mirai botnet that was built by literal teenagers the first time around, but they may have bought the "smart" devices because they thought it was cool, but I'm sure that since then they learned how computers work.
The majority of the networks on this earth have no administrator. They have a half-assed router set up by the ISP and that thing's defaults, set in a factory in Shenzhen and decided by an engineer that was working on the 996 schedule and whose boss didn't understand GPL compliance and then, because they were the shittiest manufacturer they were also the cheapest, and then because they were the cheapest, that's who the ISP bought the gear from. Everyone was running open wifi until the defaults on the routers started including WEP, then everyone was running WEP until WPA became the default. These are networks whose administration is done by nobody. The ISP blames the manufacturer and has no accountability, the boomer uses the thing that came in the box and has no accountability, the manufacturer says the ISP was stupid for using the defaults and has no accountability, and there is a problem that no one is responsible for solving until the Mirai botnet happens.
So, "do a thing" is not a solution. Do you really want to give a publicly routeable address to every dang Android feature phone, every light bulb, every Windows machine, every coffee pot, and then go "Well, they should have configured it properly"?
> i'd argue that for a network this is the special case.
So's running your own OS, and this is why manufacturers want to lock down the bootloader at the factory. Apple got away with it, Microsoft hasn't managed yet, but forget the goddamn phone market.
If you fuck up the people that make weird things, you fuck up the people that want to use those weird things, and eventually you fuck up everything for everyone.
> if i'd have designed it, i probably had made the network prefix longer.
We don't need more than 64 bits of address space but we got 128 and it's a colossal fuckup. We should have stuck with 48, 64. 64 would have been fine *forever*.
> To-be-assigned static addresses, general testing
i'd argue that for a network this is the special case.
> we would hopefully never run out of addresses
with 32 bit we have about 4294967296 addresses, with 64 bits there are 18446744073709551616 networks. if i'd have designed it, i probably had made the network prefix longer.
@lanodan@phnt@slashb The way you get your addresses is kind of annoying but other than that, I don't have any trouble running a bunch of Tor services. I set up a hidden service for ssh but I've not actually attempted to use it.
@bonifartius@p@slashb >net.ipv6.conf.all.accept_ra = 0 >net.ipv6.conf.all.autoconf = 0 Again, I didn't ask for this. I didn't check a checkbox, or added an option to *insert network manager* that tells it to "please, auto configure this interface".
It's automatic and without my input. People twentyfive years ago would call that malware.
@p@phnt@slashb@bonifartius Well what's the difference between SLAAC and DHCP though? At least from the perspective of a lightbulb where that stuff is always going to be enabled anyway.
It'll get networking, the kind of IP or physical protocol doesn't matters. It'll be part of a botnet (auto-updates, configuration through "cloud", …) at manufacturing time, and then turns out the domain used for the botnet was bought by someone else, or manufacturer got pwned.
@p@slashb@bonifartius Whenever I get my hands on a cheap Chinese network appliance, my favorite thing to do is dump the firmware. There's a 90% chance that you will find one or more of the following: hard-coded creds, hard-coded ssh public key with ssh started, unencrypted http traffic for system components. Security in IoT is basically non-existent in anything outside of "big" brands. And even those aren't immune to the usual vulnerabilities in the hosted UI accessible with default creds proudly hosted by the manufacturer on their website.
@p@slashb@bonifartius >ISP box I would call than an improvement over mine. I need an app on my phone that generates TOTP-like codes to have access to such "advanced" settings like disabling WiFi frequencies, changing SSID and setting channels. Port forwarding in an option there, but it does not work and the moment I log off, it gets wiped anyway.
>dhcpd That is at least excusable because you wanted to auto configure by running that. Not ideal, but at least there's an excuse.
"How do I get into this fuckin' router" was a problem I was able to solve very quickly, so that was at least convenient: if *anyone* can get in, that made it pretty easy for me to get in (and close down remote management).
> I need an app on my phone that generates TOTP-like codes to have access to such "advanced" settings like disabling WiFi frequencies, changing SSID and setting channels.
Oh, goddamn.
I got to do my favorite shit ever--lying to tech support about unplugging things--when I replaced my cable modem at my old place. Cable modems use MAC for "authentication" so you have to call the cable company and give them your new MAC address, right, but the tech support monkey didn't know this and thus had to run through the entire tech support script while I said things like "My google still doesn't work!" and then finally I heard the magic words: "There should be a number that says 'MAC address' on the back of your modem."
> That is at least excusable because you wanted to auto configure by running that. Not ideal, but at least there's an excuse.
Irritates the shit out of me because it's enabled by default. 13._hacker.mp3
> Well what's the difference between SLAAC and DHCP though? At least from the perspective of a lightbulb where that stuff is always going to be enabled anyway.
The lightbulb's perspective doesn't matter; the network administrator's does, though.
@phnt@p@slashb@bonifartius At least one that's "fun" with those when you have a decent email service is to give them a unique email address (like catch-all or using a + or . as separator like user.service@) that way you know exactly when their bullshit got owned and you get a address as honeypot/spamtrap.
Saddest of all… ISP I use got their customer database leaked, so I had to rotate the email address I gave them.
IPv6 is a psyop, at the core it's actually just an overlay network but the WEF furry network engineers make everyone swear to secrecy so that edge network engineers (also called edgelords) will waste all of their time trying to configure it instead of realizing the NSA is inside all of their routers.
> Saddest of all… ISP I use got their customer database leaked, so I had to rotate the email address I gave them.
I had spam@ for a while and then a lot of them started disallowing that and also disallowing email addresses that contain their company name so I have a lot of rot13 aliases because they're not clever enough to understand 'fcnz@' and I ended up having to remove that alias pretty quickly.
@p@phnt@slashb@bonifartius Interestingly I haven't got issues with using the company name, which is funny because of course some secretaries end up reading it as if it was flipped around so lanodan@company.com
Makes me really feel like phishing has got to be the easiest shit to pull off.
> Makes me really feel like phishing has got to be the easiest shit to pull off.
Two separate companies, I received Slack messages from people I'd never heard of giving me links to cryptpads that were set up on non-company-related domains and it was legit both times but also both times I pinged the team channel and got not response. hacking_boomers.png
@p@Suzu@phnt@slashb i didn't fiddle round with it for long. maybe by tuning some lora parameters things can be optimized. i think part of the latency is the half duplex operation (not sure on this).
@p@Suzu@phnt@slashb my "vision" for these things would be some store n forward thing like usenet was. don't really have anyone round here to try these things though. round here the only lora in use seems to be this iot-internet gateway stuff i can't remember the name of.
@p@Suzu@phnt@slashb never heard of it! looks interesting, although the ham-requirement likely will keep me away from it. don't want (or have the time) to jump through the hoops of getting loicensed or getting fined amounts of money i don't have.
> although the ham-requirement likely will keep me away from it.
Super low-power, you can run the thing with a board antenna. Ham requirements only matter if you intend to make enough noise that they come looking for you, and even then, like, the FCC took 15 years to shut down the pirate FM station that was broadcasting Alex Jones in Austin. But if you're *actually* worried, transmissions on several bands are fine unlicensed, and if you keep it under 1W, you can transmit whatever to wherever. (Before you write off 1W, some :aussie: did a moon bounce using only 50W. It's just solving physics problems and doing some practical engineering like noise floor for frequencies you wanna use. It's fun shit.) There's always the option of using unlicensed bands: they tend to be noisy anyway, bottom of the food chain (below military, commercial, NOAA, and even the hams), but you can do it.
i think the most basic question is if one wants a broadcast-mesh-something system (it's broadcasted anyway) or "calling up" a host at 2am to transmit this days data. i'm not sure which one is better?
@p@slashb@bonifartius My ISP does some stupid probably PK auth, because nothing works until their shitty router sends a magic packet after getting time from NTP. That packet is always different. I borrowed fiber stuff from work so that I could use my equipment, but no. Bridge mode of course doesn't exist.
Of course I didn't even want fiber as 100Mb/s doesn't need that and copper worked fine. But my small local ISP got bought by one of the 3 big ones here and forced it down on me. It irritates me to this day. And as a bonus, the new ISP's peering got worse and now my connection to the outside world is almost exclusively Cogent. I was enjoying lovely speeds of 120KB/s to fluffytail.org for 3 weeks until Cogent got their shit together again. And this happens like every other month.
> My ISP does some stupid probably PK auth, because nothing works until their shitty router sends a magic packet after getting time from NTP. That packet is always different. I borrowed fiber stuff from work so that I could use my equipment, but no.
Seems like they should allow you. Like, do they have a "No, we own both sides of the pipe" in their ToS, or just haven't tried to deal with them directly yet?
> now my connection to the outside world is almost exclusively Cogent.
> everyone I've talked to from them so far was either a smug idiot and/or annoying sales guy.
I had this experience with AT&T (which is just the SBC/PacBell merger; they bought the AT&T name for a song once AT&T had divested itself of enough divisions to be small enough to acquire): very explicit on the phone, asked the guy several times. I receive the gear, start using it, reboot the modem to confirm, and the IP address changes. Time Warner Business had a reasonable guy, I talked to him and asked, "You understand why I wouldn't want the IP for ns1 to change, right?" and he laughed. Their residential service was not great but the business line was excellent until they merged with Charter and formed Spectrum; I don't recommend Spectrum Business.
> And not something small, the whole republic had no connectivity on their network the last four times this happened in the last 10 months.
@p@slashb@bonifartius I haven't tried talking about it with them, but everyone I've talked to from them so far was either a smug idiot and/or annoying sales guy. I did not attempt to dump the FW either as their "price" for the router is and I kid you not 300USD converted.
That said, I'll be moving to someone else in the near future anyway. I'm tired of their outages every few months for a day. And not something small, the whole republic had no connectivity on their network the last four times this happened in the last 10 months. It's insane.
@p@Suzu@phnt@slashb well i _have_ this shady chinese handheld radio around :)
the default js8call frequencies seem to be in some ham frequency band which requires a loicense. i'm worried because i think the fines are in the 10k€ range and ham operators don't seem to "appreciate" people who aren't part of their club. hence i tried out lora which is in the unlicensed band.
@phnt@Suzu@p@slashb@bonifartius Yeah it does, the overhead of TCP/IP from what I've read makes it really slow though, like, over a 1200 baud link it's not that usable, so most of the action that goes on AX.25 is more raw. I think it'd be kinda funny to lease a 44 block and try a run an ISP at 1200 baud though.
@p@Suzu@phnt@slashb radio stuff is fun, my dad had a short wave receiver and i liked to listen to all the funny noises i can find (imagining aliens were behind them :)
what could be interesting for "another internet" are (tethered) balloons for more range. otoh they are a big fat marker that one is involved.
> radio stuff is fun, my dad had a short wave receiver and i liked to listen to all the funny noises i can find (imagining aliens were behind them :)
Ha, I had one as a kid. Really fun. You could pick up PRC broadcasts aimed at the US. I caught a few numbers stations, I loved those.
> what could be interesting for "another internet" are (tethered) balloons for more range. otoh they are a big fat marker that one is involved.
I think scatter propagation and extremely low-bandwidth (300-9600) long-range point-to-point links and then line-of-sight (9600) to the ends of the point-to-point connections; 2m/70cm can do 100 miles and can do 20 miles easy.
@bonifartius@Suzu@phnt@slashb Well, I wouldn't worry; I think you can set TXP on a Baofeng to 5W and this basically means nobody will care. Turn the radio on and scan around.
I don't know what licensing costs where you are; real easy in the US.
1) Internet is to be set up or fixed at a customer site or on customer equipment 2) IPv4 is configured 3) Ticket is closed
I've done dozens of turn-ups for small 1-2 employee stores that for some reason need a static IPv4 (and the local cable company will issue no smaller than a /30) even though there will never be an inbound connection to their greeting card store and/or muffler shop, and their firewall is going to just establish a connection to the chain's SD-WAN for outbound traffic anyway. At none of these sites has IPv6 been configured. They would do just fine behind CG-NAT, even.
Another fun phenomenon is that these circuits get turned over with identical circuits every few years. The old equipment is just left plugged in. As a gag I tried to use the static address written on each of three unused modems from the same cable provider connected to the same splitter. They all worked. They all had /30s. That tells me all of them were getting billed for. @phnt@p@slashb