People always talk about Arch. I wonder what people think of other oses and the people who run them lol. Like I’m a bearded Debian user (closer to the look of the Dilbert comic unix guy).
Well, I'd like to think I'm just a normal looking dude who blends in in a crowd. I just use Debian 'cause I got sick of Windows' shit a long time ago, like, back when telemetry was introduced in Windows XP. That was the first sign of things to come. When we would start losing control of our own OS and computers and losing privacy as well. I shouldn't even notice the OS when I do normal computer shit, and I want to keep it that way. Those who are old enough to have grown up with PCs in the 90s get what I'm saying. We had control.
Ah man, you toughed it out clear into XP? Win2k was the last version I ever ran here. That whole shit of “oh you inserted a USB drive, please reboot” really got on my nerves. Plus trying to write code and having Windows crash once a week.
Don’t forget Win3.x. I remember working on that, trying my hand at OS/2 Warp with high hopes. I never used NT, just the home version of Windows 2k, however I was already trying to move away from Microsoft at the time. I was introduced to AT&T Unix in the late 90’s with our Audix voicemail system, and learned a lot while attempting to upgrade the hardware to a more current 486 computer. I got hooked but Unix was expensive as hell, then the internet led me to Linux. My first attempts were with a version of Slackware that ran from a folder on the Windows desktop and by '99 I had my first dedicated server up and running. It wasn’t until 2006 that I finally dumped my dual-boot desktop and permanently dropped Windows.
I haven’t either. 😆 Switching to Linux solved all of those problems allowing me to run for months at a time between reboots. Of course back then things didn’t work so smoothly, and I did have some struggle getting my sound card working. These days it pretty much all just works.
I would only point out that most hardware problems are due to vendors refusing support of any OS except Windows. If they didn’t support Windows you would see equal problems there. I know there has been a lot of contention with nVidia over the years, not so sure about others.
Also, linux does take direct control of all hardware and runs it hard. If a vendor claims their devices can run under certain conditions then Linux expects it to actually perform that way. Many vendors exaggerate their claims though and it’s quickly discovered that their devices cannot actually perform as expected on the general hardware sold to the public. Nobody is surprised, and the linux driver admins eventually make those features optional so you can test the specific device to see if it lives up to the vendor’s claims. My nVidia GTX 1050 has been running well for me though.
Otherwise I agree that yeah, a lot of faults come down failing hardware. In my case the same machine that constantly blue-screened under Windows worked fine for many years under Linux, and I’m one of those who really push the hell out of my computers. Coding in Visual Studio while also having a bunch of other windows open for reference on my current project, on a machine that only had a gig of memory? Yeah I expected a lot. And moving forward to today, I have dozens of windows open to browsers, spreadsheets, terminals, image editors, and 3D modeling software. Surprisingly I currently have over a gig of free ram right now (on a machine with 16GB) but I’m usually closer to a half or quarter gig free. My machine is pretty clean right now because it rebooted a month ago from a power outage during a storm, so we’ll see how it looks in another couple months.
EDIT Here’s how to disable it. If you can’t on your modem/router. Open the network menu from the icon in bottom right of screen > right click on the network you are connected to and click “status” > In the popup click on the “Properties” button > You’ll get another popup with the name of your network adapter in a top line/box and a secondary box with a list of things in it > Look for the entry “Internet Protocol Version 6 (TCP/IPv6)” and uncheck the box in front of it > click OK.
IPV6 is already rolled out in parts of the world. My provider has a Dual Stack lite architecture, the home connection is over IPV6, IPV4 is normally being tunneled via V6 through a provider grade NAT.
As I AM a network nerd, I pay for a dedicated IPV4 address every month, so I can reach my stuff from outside from old IPV4 only networks.
So when I plug in my router, connect a windows machine and just google stuff then all this traffic will be IPV6 without me configuring anything.
It’s so great fun having the attack surface being doubled by dual stack setups.
Unfortunately (or fortunately, it depends on how you see it), some providers are already on IPv6. My Italian ISP has IPv6 with CGNAT, so all its users are on IPv6 without even knowing what it is.
Eh, they’re alright. They had to deal with more bullshit than I ever had to in high school.
They had to deal with the daily threat that a school shooting could be their school. All I had to deal with was teenage girls having a war over who was hotter. Backstreet Boys, or N-Sync.
Which to be fair, if you said the wrong one to a teenage girl in the 90s, she’d be likely to flip out on you. Still though, they wouldn’t pull a gun!
I’m honestly surprised that the closest we ever got to a parody boy band was Justin Timberlake singing Dick in a Box with Lonely Island. Seems like SOMEBODY should have made a parody band! Weird Al can’t do EVERYTHING, ok???
Zoomers are fine, just making fun of the concept of young people thinking Windows 3.1 couldn’t connect to the internet. America Online, bitch. A/S/L? Also Zi could type my friend’s phone # into Doom and it’d call his modem and we could play each other
In this case? Research, but you are correct in that it’s incredibly unlikely that someone today has their computer directly connected to the internet without a router or something preventing any incoming connection
IPv6 genuinely made some really good decisions in its design, but I do question the default “no NAT, no private network prefixes” mentality since that’s not going to work so well for average Janes and Joes
No NAT doesn’t mean no firewall. It just means that you both don’t have to deal with NAT fuckery or the various hacks meant to punch a hole through it.
Behind NAT, hosting multiple instances of some service that uses fixed port numbers requires a load-balancer or proxy that supports virtual hosts. Behind CGNAT, good luck hosting anything.
For “just works” peer to peer services like playing an online co-op game with a friend, users can’t be expected to understand what port forwarding is, let alone how it works. So, we have UPnP for that… except, it doesn’t work behind double NAT, and it’s a gaping security hole because you can expose arbitrary ports of other devices if the router isn’t set up to ignore those requests. Or, if that’s not enough of a bad idea, we have clever abuse of IP packets to trick two routers into thinking they each initiated an outbound connection with the other.
IPv6 has two main types of non-broadcast addresses to think about: link-local (fe80::) and public.
A device can self-assign a link-local address, but it only provides direct access to other devices connected to the same physical network. This would be used for peer discovery, such as asking every device if they are capable of acting as a router.
Once it finds the router, there are two ways it can get an IP address that can reach the wider internet: SLAAC and DHCPv6. SLAAC involves the device picking its own unique address from the block of addresses the router advertises itself as owning, which is likely what you’re concerned about. One option for ensuring a device can’t just pick a different address and pretend to be a new device is by giving it a subset of the router’s full public address space to work with, so no matter what address it picks, it always picks something within a range exclusively assigned to it.
Edit: I butchered the explanation by tying to simplify it. Rewrote it to try again.
In most cases, the router advertises the prefix, and the devices choose their own IPv6. Unless you run DHCPv6 (which really no-one does in reality, I don't even think android will use it if present).
It doesn't allow firewall bypass though, as the other commenter noted.
Yep, it's all good. In my opinion, IPv6 routers should just be dropping incoming connections by default. If you want to run services you give your machine a static IPv6 and open ports on that IP/port specifically. It's actually easier than NAT because you don't need to translate ports and each IP can use the same ports (multiple web servers on 80/443).
I do agree that the average joe is going to expect NAT level security by default and that would provide that.
From a security perspective, allowing all incoming connections by default is unnecessarily exposing devices to a hostile environment. The average Joe isn’t going to understand the risk unless somebody explained it as “it’s like posting your home address on 4chan and hoping nobody manages to pick your front door lock,” and they’re likely never going to take advantage of the benefits that come from having their device be globally reachable.
Another benefit to not having to deal with NAT is that you can actually host services using the same protocol (e.g. HTTP) on multiple machines without having to resort to alternate port numbers or using a proxy with virtual host support.
Unless you run DHCPv6 (which really no-one does in reality)
Question for you since I have very little real world IPv6 experience: generally you can provide a lot of useful network information to clients via DHCP, such as the DNS server, autoconfig info for IP phones, etc. how does a network operator ensure that clients get this information if it’s not using DHCPv6?
You can, and there's a specific flag to set on nd/ra to tell the client to get other information from djcpv6. But so far I've not made it work and also, it likely won't work on android.
Really the way forward is for routers and devices to implement the same options as exist on dhcp. But, time will tell how that gets on.
This is a weakness of ipv6 but it's really the lack of widespread implementation that's behind this. If we were all using it, there would be more onus to get this stuff working.
DHCPv6 is very definitely used with ipv6 and isps, as DHCPv6-PD is needed anyway to send prefix allocations to the router
DHCPv6 does the same thing DHCP does, just for v6 addresses. This includes pushing domain suffix and dns servers.
There is also Router Advertisement, which tells the discovering client that it is a router, what the prefix is, if there is a DHCPv6 server, and what the DNS is. As an alternative to DHCPv6, the client can set their own address based on the combination of the prefix and their MAC address, the SLAAC address. The way IPv6 routing tables are built, the router can always find a route by asking upstream on the address, and upstream only has to forward downstream on an address.
DHCPv6 is very much in use with large ISPs. SLAAC only lets you get a single /64 (one network) from the ISP, but if you use DHCPv6, which is also provided ISP side, you can often request a /60 to get you 16 networks to use. Also, DHCPv6 doesn’t base the IPv6 address off the MAC address like SLAAC does, so it is better for device privacy.
Why Android does not support DHCPv6 is beyond me. It’s honestly quite ridiculous as it makes configuring LAN-side DNS and other things a lot easier.
Not the person you were replying too, but I was there when we had modems and raw-dogged the internet.
The average person clicks “Yes” on everything without reading it, has no idea what a firewall is, and they never update anything unless it does it without asking.
Having things accessible from outside your network is great if you’re a network nerd and that’s what you want, but most people are going to be in a world of unprotected shit. Especially in a world of pointlessly online devices. I don’t trust any of those fuckers to have their shit in order.
I would assume/hope the default setting for a consumer router would still be to drop incoming connections. That should suffice for the average person as long as ISPs don’t make it easy to disable that without actually understanding what the consequences are.
I would also assume that to be the default, but unfortunately the first Google search for “why doesn’t my smart fridge work from my phone when I leave the house” will be a set of instructions for turning that feature off.
NATs and port forwarding is annoying, but it’s also very manual, and only lets you fuck up one device at a time.
Then the instructions are bad. They should be how to open the firewall port for that device, which is almost the same as setting a NAT port forward, with the same limitation of only exposing one device.
If anything it makes me want routers to not even allow a blanket whitelist for all devices…
I would be fine with this. Make it as annoying as possible so people don’t blindly follow a guide to disable the firewall.
Remove firewall disable option, and only allow it to happen by DMZ or bridging to another router that would have it.
Require calling in to an ISP help desk, where they ask why you want to do that, and explain in no uncertain terms that you’re probably going to open a portal to hell or summon cthulhu. If you still want to, you have to read them out the device serial number, read out a unique code in the router admin interface, and wait a week for the option to become available.
Honestly the more I think about it the more I realize I’m wrong. I was thinking someone could enable a server on their client device without realizing it but the firewall on the router would still need to be modified in that situation, and anything not requiring firewall modifications would be just as much of a security hole on IPv4
Yeah it’s a common trip up. We’re all so used to the way that things are done in IPv4 that our natural response is to try and apply IPv4 logic to IPv6, but you’re absolutely right.
Many people think NAT is a security feature but but that’s only a coincidence and it doesn’t do anything a firewall doesn’t already do. And if we take it one step further we can actually see that a firewall and IPv6 is actually more secure than NAT. The only inherent risk of port warding in NAT is that the IP you’re forwarding to is ultimately arbitrary. Think, have a port open to SMB for a publicly accessible file sharing container, then later ditching it and via DCHP your laptop picks up that old IP and now voila you’ve technically exposed your laptop. It’s not quite that simple but that’s the essence of it.
But with IPv6, IPs are no longer arbitrary. When you allow access in certain ports to a certain machine and that machine goes away, that rule will always only allow access to nowhere.
Routers simply need to block incoming unestablished packets (all modern routers allow for this) to replicate NAT security without NAT translation. Then you just punch holes through on IP addresses and ports you want to run services on and be done with it.
Now, some home routers aren't doing this by default, but they absolutely should be. That's just router software designers being bad, not IPv6's fault, and would get ironed out pretty quick if there was mass adoption and IPv4 became the secondary system.
To be clear, this is not a reason not to be adopting IPv6.
IP4 is running out, that’s the problem. Or better, IP4 is hoarded by companies and they don’t give them up. The insane amount of network devices every human being uses on a daily basis doesn’t make the situation better. It exploded the last 10 years and only gets worse. The fuckery ISPs are doing to solve it without IP6 is insane, fuck cgnats and co. The whole networking world would be so much better to get it over with and adopt IP6 everywhere and let the hoarders drown in their mountain of IP4.
Old tale, I know, but just cause v4 is running out on the internet it doesn’t stop anyone from using it in their homes. I manage some ASNs on the internet. I have no need yet to worry about implementing v6 on the inside.
The thing is that if IPv6 were actually adopted, it would be straight up better. For everyone. It’s easier to use if it’s all the networking instead of just a niche case.
It's really not though. ISPs are a problem, but every hosting provider I've used has offered IPv6. It's really trivial to setup IPv6 name DNS, and host a website on both IPv4 and IPv6. I just do it by default now.
Once it becomes the default to deploy to both, if IPv4 died then the IPv6 side would just keep working.
For DNS, you can make a single glue record contain an IPv4 and IPv6 address.
DNS just needs A and AAAA records for the Name servers. NS records still point to the hostname as normal.
For Web servers, the web server just needs to bind to the IPv6 address(es). Then in DNS just have an A and AAAA record for each website hostname. The server name directives will cover both.
There really isn't much to it right now. The technology is mature now. It used to be a pain, but now it isn't.
My ISP gave me a IPV6 router. I have it bridged (or whatever the right term is) to another router that serves IPV4 addresses to all my devices. Worked well so far with the added bonus that the ISP can’t see what’s going on within my network.
As a tech nerd who self hosts stuff, I’m more like “what is IPV6 and why is it causing me issues, I can’t figure this out, I guess I’ll disable it, wow my problems are fixed now.”
I guess I can see why people don’t like it, as it’s caused me issues, but just because I don’t understand it doesn’t mean it’s dumb. I’d need to understand how it works before I could say anything about it, positive or negative. I guess all I could say is that it’s been way less intuitive to me, I can’t memorize the numbers, and the reason it exists makes sense. Beyond that, I unno.
I should probably spend the time to learn about it, but I already have a full time job where I work on computers all day, I’d rather focus on my other hobbies while I’m at home.
It’s not terribly difficult to learn when you avoid trying to relate it to IPv4 concepts. Particularly: forget about LAN addresses and NAT, and instead think about a large block of public addresses being subdivided between local devices.
instead think about a large block of public addresses being subdivided between local devices.
Thinking about all my devices being exposed like that gives me the heebie jeebies. One public facing address hiding everything else on a private network is much less frightening to my monkey brain.
This is what a firewall is for. Blocks inbound to the whole subnet space. Better than a NAT, which can open a port through STUN or simply a malformed packet.
Serious question - I haven’t touched my Xbox one for about 4 years , it wasn’t powered and wasn’t connected to the internet - I would love to jailbreak it and run Linux on it. Can it be done?
About Linux, it’s not yet feasible, probably soon, right now Xbox one/series jailbreak scene is only making first steps with dumping of games and launching roms and emulators without dev mode
My ISP enabled native IPv6 for me a few months back. It’s pretty great. I don’t have any windows machines, but I doubt my wife has disabled it on hers.
Anyway, our router is set up to drop incoming IPv6 traffic by default, sanely enough.
IPv6 is enabled by default on windows. Additionally, MS does no testing against machines with ipv6 turned off. People that go through the effort of turning it off may run into problems.
I have two different ISPs offering gigabit fiber to the home, neither offers IPv6 at all. One of thes years I’ll tunnel an IPv6 prefix or two onto my network to actually get some real world experience with…
That’s strange. Mine dual routes. So we get both. I don’t know they generally tell you the ipv6 unless you ask though as most internal networks are still using primarily ipv4
To note: It shows even Windows Server 2008 as affected. Since MS is only testing against OSses they support, it is possible this has existed as a problem all the way back since IPv6 was first introduced to Windows XP.
Also, for all of you “disable IPv6 because I don’t understand it” people… unless you are running Windows 8 or older, just update Windows. IPv4 has been out of addresses for so long that CGNAT is a thing, which means connectivity problems when you’re hosting stuff, and more latency and packet drops from ISP routers getting saturated with NAT tasks. IPv6 is alive on the internet since 2011 and very much used on the internet, does not tie up routers by requiring NAT translation, and therefore just performs better. Plus, if you use your network printer’s or network device’s link-local ipv6 to connect locally, you will never have to deal with static ip address or changing ipv4 lan address pain, as link-local (non-routable on the internet) addresses don’t change unless you force it.
Also don’t use $35 routers for your internet. If your router does not support ipv6 firewalling, it is long since time to fix that with one that does.
I've not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it's a problem. Depending on what most routers do in terms of IPv6 firewalling.
My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.
In my experience, it's a bit hit-and-miss whether they do or not.
Now, if this works on privacy extension addresses, it's a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.
If it doesn't work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.
Here's the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.
Harvesting IP addresses shouldn’t be a problem, since the firewall shouldn’t allow packets from a peer you haven’t talked to first. But true, if you can be attacked in response by a server you’re connecting to that would be bad.
IPv6 firewalls should, by default, offer similar levels of security to NAT
I think you’re probably right. We had decades of security experts saying that NAT is not a firewall and everyone on the planet treated it like one anyway. Now we’re overexposed for a no-NAT IPV6 internet.
I think it depends on all the caveats I mentioned. If it could have worked with an outgoing connection, then someone with a bad client could execute it for sure. The VPN wouldn't protect you.
For a professional sysadmin’s home network? Maybe. For the average Joe who probably has their 12-year-old toaster still connected to their wifi? I wouldn’t bank on it.
One restart post-update restarts changed it and helped, but something was still off. Took me like 30 minutes but it looks like my nvidia HDMI audio output got reset to a really low 16 bit sample rate. Got that set back to a decent 24 bit and its closer, but something is still off. I don’t think I had any settings/levels/enchanments.
Sounds like windows changed your audio driver. I’d download the most recent audio driver available through nvidia, then uninstall your current audio driver in device manager and manually install nvidias.
msrc.microsoft.com
Top