Preferences

Super cool! I tried doing a pure IPv6 network a little over a decade ago; Maybe I’ll try it again. Though, my cheap IoT devices likely still need IPv4… but perhaps not internet connectivity. It might be fun to explore just how much IPv4 continues to be ingrained into cheap Things (eg: Arduino WiFI?) There always seems to be a long tail of small places where IPv4 pops straight back into the equation.

Small places?

When I disabled IPv4 a few weeks ago, I couldn't use: HN, GitHub, Reddit, Discord, Duckduckgo.

Almost sounds like a productivity enhancement.
Docker hub was the one that pushed me over the edge, so I just paid the extra 50c a month per server for ipv4 on cloud servers.

Update - 23 Aug 2023 — Today, we are pleased to announce the general availability of IPv6 support for the Docker Hub Registry

Apparently it can be done now, I wont be finding out in a hurry.

Also Android doesn't support DHCPv6
What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)
> What's the benefit of DHCPv6 over SLAAC (genuine question, never looked into DHCPv6 at all)

In corporate-y environments it allows for easier tracking of user-MAC-IP mappings for auditing purposes. If you use SLAAC there is no auto-logging as the client simply picks an address itself.

One way to do tracking with SLAAC could be to SNMP scrape/trap ipNetToPhysicalTable of RFC 4293. Another would be 802.1X or MAC authentication (interim) accounting via RADIUS (RFC 2866).

The primary advantage is you can delegate prefixes over DHCP, but that probably doesn't matter for most Android devices

There are other advantages too, like if you want to assign specific addresses to specific devices without having to configure each device separately.

all of the DHCP options, for example.

SLAAC just tells the endpoint device to self-assign an address and to roll with it. For example, there’s no way to pass in DNS servers with SLAAC.

The DNS bit it's not true: there's RFC8106 [1] for this and it's widely supported. You can set a list of DNS servers to use (RDNSS) and a domain suffix for resolving unqualified hostnames (DNSSL), exactly as for DHCP.

[1]: https://datatracker.ietf.org/doc/html/rfc8106

Can't you provide DNS servers as part of router advertisement packets ? RFC8106
You can do finer-grained subnets with DHCP than SLAAC will give you.
As a general rule, if you're deploying IPv6 subnets sized as anything other than /64, you're doing it wrong
I don't have IPv6 enabled. Literally everything works.
Congrats on having a non-CGNAT Internet connection available.
Those all work for me, on my v6-only desktop. (I don't use Discord, but their homepage loads at least.)

None of those sites have v6 though, so you'll need some form of backwards compatibility running to reach them. Presumably you were missing that.

plus these individual devices will live for a long time.

I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS.

IPv4 on local networks will probably exist for a very long time.

> I recently had to setup a non-encrypted website because I have a few old devices that can no longer do HTTPS.

That sounds like they haven't been updated for TLS>1.1 – if that is the case then rather than going all the way down the HTTP you could enable TLS1.1 (and maybe 1.0). It is open to POODLE/BEAST/others that way, but still have some protection and the site's configuration differs less from the rest of your infrastructure.

Unless the site is completely internal only of course, in which case just sticking with HTTP may be less faf.

Is there any way to get a certificate that these old devices would trust and that would work over TLS < 1.2?
No, that is the problem. They worked with less and less websites until there were none left. I needed to install some packages, which I could just put on my own server.

And I have an old Blackberry Bold that now show current electricity prices, so I know when to starte my washing machine. That can also run on own webserver.

https://gitlab.com/nelgaard/elpriser

Technically the certificate issues are separate from the protocol versioning. It's just that clients that don't support TLS 1.2 often also don't support sha2 certificates or may not have a path to validate certificates from currently available CAs (although you can usually push through that; no protocol support and no cert signature support is not a user bypass prompt)

As a side note, barely anything supports TLS 1.1 but not TLS 1.2

This item has no comments currently.

Keyboard Shortcuts

Story Lists

j
Next story
k
Previous story
Shift+j
Last story
Shift+k
First story
o Enter
Go to story URL
c
Go to comments
u
Go to author

Navigation

Shift+t
Go to top stories
Shift+n
Go to new stories
Shift+b
Go to best stories
Shift+a
Go to Ask HN
Shift+s
Go to Show HN

Miscellaneous

?
Show this modal