There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

sep

@[email protected]

This profile is from a federated server and may be incomplete. Browse more on the original instance.

sep ,

I felt dirty! and broke so much shit when i had to implement NAT on networks in the mid 90’s. Nowdays with ipv6 and getting rid of NAT is much more liberating. The difference is staggering!

  • you do not need NAT any longer, firewall is the security, just like on ipv4, just less obscurity.
  • you do not need dns views, to workaround NAT any more
  • you do not need hairpin NAT to workaround NAT any more
  • you do not need to renumber to resize a network. they are always /64, and the answer to how many hosts can it fit is: ALL of them!
  • many ALG’s will be unnecessary since there is not NAT.
  • vpn’s are easier, since it can be the same address both inside and outside the vpn, the firewall (or host even) enforces the encryption.
  • vpn’s are MUCH easier since you will have less rfc1918 collisions due to some other network using the rfc1918 of the vpn’s network
  • vpn’s are MUCH MUCH easier since you will have less rfc1918 collisions due to you using the rfc1918 of the vpn partner network, to 1:1 nat a previous vpn network you collided with some months ago… ARGH!!!
  • vpn are generally less required, heck i swear 95% of the time the VPN are just to workaround the NAT problem and the data is pointlessly double or triple encrypted.
  • you can make more granular firewall rules (eg the spesific host, or network of the source address, instead of the whole enterprise’s public ip) this is real tangible improved security, where any random machine in a network you do not control. do not automatically have openings into your own network.
  • firewall objects can if it is suited easily use and depend on FQDN DNS objects when allowing traffic. reducing the need of coordinating firewall object ip address changes between 15 companies.
  • firewall rules are easier, more readable, and much more predictable how they will work. All the hairpin nat, public to private nat, private to public nat for a thing that need a different public ip, 1:1 nat for a separate zone, NAT to a vpn or 50 (where 10 of them are 1:1 nat due to collisions, making you require 4 dns views of the same ip space!! ) very quickly gets messy and unreadable. this is probably the largest security benefit. just to reduce the complexity.
  • much easier to get people to use dns, since nobody wants to remember ipv6 addresses :D
  • nibbles in the ipv6 address can have meanings you assign to them, making the networks and structure both easy to remember and logically structured.
  • aggregating routes becomes very easy if you design your network that way.
  • firewall policies can become easier if you design your network that way.
  • your routing tables is leaner and easier, and of a better consistency. We have 1 large public ipv6 prefix, but 25ish ipv4 prefixes of all kinds of various sizes.
  • no need to spend $$ to buy even more ipv4 prefixes.
  • no need to have spent hundreds of $$ on a new ipv4 prefix only to be unable to use them for over a year because you need to sanitize the addresses from all the reputation filters. and constantly hound geo ip database providers to update the new country of the prefix. (i am bitter, can you tell…)
  • did i mention no need to renumber since you need to grow the /24 to /23 due to to many hosts in a network ?
  • did i mention no need to renumber 2 /24’s to /25’s to make space for that larger /23.
  • you do not even need any ipv4 addresses any more, use a public NAT64 service, for outgoing. and for incoming just use one of the many free public ipv4 to ipv6 proxies for your services online. for a homelab i really like v4-frontend.netiter.com (go support them) But most large business l networks use cloudflare, or akamai
  • since you do not need your ipv4 address space any more, you can ~~sell them for a profit $$$ ~~ return them to the RIR and give some address space to one of the thousands of companies struggling because they do not have any IPv4 : www.ripe.net/…/ipv4-waiting-list/
  • much lower latency on ipv6, since you do not go across a cloud based ipv4 to ipv6 proxy in order to reach the service ;)

Now the greatest and best effect of ipv6 is none of the above. It is that with ipv6 we have a slim hope of reclaiming some of what made the Internet GREAT in the first place. When we all stood on equal footing. Anyone could host their own service. Now we are all vassals of the large companies that have made the common person into a CGNAT4444 using consumer mindlessly lapping up what the large company providers sees fit to provide us. with no way to even try to be a real and true part of the Internet. Fight the companies that want to make you a eyeball in their statistic, Set up your own IPv6 service on the Internet today !

sep ,

I assume the normal fear of unknown things. It is hard to hate ipv6 once you have equivalent competence in ipv4 and ipv6.

sep ,

But DNS rarely break. The meme about it beeing DNS’s fault is more often then not just a symptom of the complexity of IPv4 NAT problem.

If i should guesstimate i think atleast 95% of the dns issues i have ever seen, are just confusion of what dns views they are in. confusion of inside and outside nat records. And forgetting to configure the inside when doing the outside or vice verca. DNS is very robust and stable when you can get rid of that complexity.

That beeing said, there are people that insist on obscurity beeing security (sigh) and want to keep doing dns views when using IPv6. But even then things are much easier when the result would be the same in either view.

sep ,

That is not how it works. You can have a home network on ipv6. And it can reach all of ipv4 via nat ( just like ipv4 do today). A net with only ipv4 can not reach any ipv6 without a proxy that terminst the v4 connection and make a new v6 connection. since ipv6 is backwards compatible. But ipv4 is naturally not forwards compatible.

Also it is the default deny of the stateful firewall that always coexist with NAT, since NAT depends on that state, that is the security in a NAT router.
That default deny is not in any way dependant on the NAT part.

sep ,

If there is a ipv6 service online. That you want to reach from a v4 only client. You can set up a fixed 1:1 nat on your firewall where you define a fake internal ipv4 address -> destination NAT onto the public ipv6 address of the service. And SRC NAT64 embed your clients internal v4 into the source ipv6 for the return traffic. And provide a internal dns view A record pointing to the fake internal ip record. It would work, but does not scale very well. Since you would have to set this up for every ipv6 ip.

A better solution would be to use a dualstack SOCKS5 proxy with dns forwarding where the client would use the IPv6 of the proxy for the connection. But that does not use NAT tho.

The best solution is to deploy IPv6 ofcourse. ;)

sep ,

I guess I am lucky. 3 out of 3 isp’s available from in my region provide IPv6 with a dhcp-pd assigned stable address by default. (Norway)

sep ,

Thank you! :) I also notice i compleatly forgot the port exhaustion issue we see with larger networks behind roo few ipv4 NAT addresses…

sep ,

You have my sympathy. I do not know of a sure way to get isp’s to behave. Espesially not if they have regional monopoly

sep ,

Beeing not assholes against their own users are basically anticompetitive these days. ;)

sep ,

Everybody would love 2 or 3 more good healthy alternative to even the playing field. Because having the future of fun hang by the tread of a single not-corrupt-to-the-core company is fucking stressfull. But dunking on valve is not the way to a healthy gaming marketplace.

sep ,

For sure! There is no real market with exclusives! EGS is the bad apple that may spoil the bunch. Now do steam services also create a pseudo exclusive, yes kinda. But developers do not have to use those, they are just making their life easier. And developers can still do their games on other platforms as well.

sep ,

I have read your arguments, I just fundamentaly disagree. I do not want to lower the ceiling until valve is as crappy as the rest. I want the floor to rise. Basically valve do not stop other companies from competing. Nothing is stopping EGS from including and contributing to proton. allowing and even helping developers to have their games on multiple marketplaces. Building awesome services to provide to developers.

sep ,

Is it a shitty businiss practice? Absolutly. Should valve as the only company allow others to under cut them? No that would be insane. Should it be regulated as illegal businiss practices for everyone - yes absolutly.

sep ,

It is basically contractual price fixing. Staggering that the practice is allowed.

Microsoft in damage-control mode, says it will prioritize security over AI (arstechnica.com)

Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be “more important even than the company’s work on artificial intelligence.”...

sep ,

Never been an issue for me debian+kde+steam it started right up the first time i tried. No tweaking needed.

sep ,

That should simply not be allowed. Cgnat for ipv4 is fine if they also provide proper ipv6

sep ,

You do as well, if you run any operating system newer then the last 10 years.

sep ,

Not much choise i guess. Usa and europe grabbed the majority of available ipv4 space. Asia got a bit. And only scraps and leftovers for africa and latin america.

sep ,

China block much of the internet so who knows with china. Do not know if anyone have real china numbers of IPv6 deployment. They also had their own “IPv9” that was rumored some years ago that may or may not have been used internally.

sep ,

I am 50/50 between incompetence. Or so they can keep on charging extra for a static ip.

sep ,

Goverments (depending on juristiction) have laws requiering isp’s to keep track of cgnat port combos. So not only is there no privacy from ipv4 cgnat. Now the isp must also spend a lot of money on the nat state tracking database.
If you need that kind of privacy, use a vpn and the tor onion network.

sep ,

Yes it does take extra work. Problem is often that that work was done in the past when isp implemented their ipv4 metodology. And instead of using the ipv6 rollout as a chance to improve their design and operations. They just add ipv6 into their ipv4 design and methodology. They encumber their ipv6 rollout with their decades of technical debt and cruft they have normalized in their ipv4 world. And it will makes things harder for themselfs when trying to turn off ipv4 in the core.

sep ,

You can make summer time the regular time you know. Removing dst is about getting rid of changing the clocks twice a year.

sep ,

I would not mind if americans used whatever. As long as anything exported from america always!! used metric. As it is now we need 2 complete sets of nuts and bolts, pipes and fittings, tools and gizmos, csbles and connectors. Just imagine the space we could save in our shops and storages if we could /2 the requires spare part storage. Not to mention the time and frustration avoided when doing basically anything on almost anything.

sep ,

What anyone mean when they say get rid of dst is to stop the flipflopping.
But i guess you are technically right. Witch i have heard is the best kind of right. Even if very pedantic ;)

sep ,

https://lemmy.world/pictrs/image/b3765e4c-e2f1-4786-85cb-d7a61805592e.png

sep , (edited )

Someyhing like searxng? Or what do you imagine?

sep ,

I imagined they used bugs per license plate for that. Since those are fixed size and vertical.

sep ,

Hosted my own xmpp server back when you could talk to facebook messenger and google chat users via federation. But when they closed their walled garden there were nobody to talk to so i stopped it.

Now with matrix i have again a homeserver. Bridged to messenger, google what the new thing is called, slack, and a few others.

sep ,

Other xmpp servers that want to yes. But i have nobody that uses xmpp again.

sep ,

While that may be true. The filter bubble is also a very real thing.
Social media sites earn their money by your attention. And try to keep it as long as possible, with all the tricks in the books, and some they invented.
So when someone belives something. They search about it. And belive they have done research. When they find what the site belive keeps them engaged.

Want to know more? sorry, been playing to much helldivers 2. ;) www.ted.com/…/how_to_pop_our_filter_bubbles

The science is not conclusive tho. Perhaps i am in a bubble… messes with the head…

sep ,

I know it is a complete joke. But every time i think of c++ i am reminded of this prank article www-users.york.ac.uk/~ss44/joke/cpp.htm

sep ,

Not seen a fs corruption yet. But i have only run ext4 on around 350 production servers since 2010 ish.
Have ofcourse seen plenty of hardware failures. But if a disk is doing the clicky, it is not another filesystem that saves you.

Have regularly tested backups!

sep ,

Iso allowing itself to be coopted into fast tracking standarizing ooxml in 2008 continues to be horrible. Ms can point and say: see ooxml is a true open format.

sep ,

That too that there are 3 different .docx does nothing for standardization

sep ,

There is a wast difference between the internet. That gives you access to information. And social media with algoriths fine tuned to keep you there as long as possible.
Cameras everywhere is for sure a disaster for anyones sanity and development.

sep ,

nytimes.com/…/hard-fork-apple-lawsuit-reddit-ipo.…Hump to minute 27 for the intervju with jonathan haidt Point is that the social media problem is global and not only affecting US

sep ,

nytimes.com/…/hard-fork-apple-lawsuit-reddit-ipo.…Jump to 27 minute mark for the talk with jonathan haidt.

sep ,

Like the exact same thing can not happen in a closed source codebase. It probably does daily. Since closed codebases the due dilligence and reviews cost money, and nobody can see the state. They are intentionally neglected.
Open source nor closed source is immune to the 5$ wrench hack

sep ,

What the social media algorithms did to teenagers are for sure a catastrophe involving blood. Suicide went up 48%. 131% for girls.

Jonathan haidt have a public repository of all research on the subject.

www.theatlantic.com/technology/archive/…/677722/

jonathanhaidt.com/reviews/

sep ,

I laughef…wife rolled her eyes ;) Great sucess!

I've Installed multiple Linux Distros on my Editing Rig to see how well Davinci Resolve Studio works. Here are the results.

So a couple of weeks ago, I made this post asking for help from those who used Linux and Davinci Resolve, and their experience. To those who’s response was effectively “I use arch btw”, I hear you, but that wasn’t the question I wanted to ask....

sep ,

I do not know what you did to debian to make steam not work. Since that have been flawless on my debian for half a decade. And ocasionally glitchy the half decade before that.

Debian +KDE is just the best i can get. But may be just me beeing used.

sep ,

Xfree86 was sonetimes a mess. And i did not have a browser anymore when it refused to start. So man pages only.

I once rm -rf all the db files of a running database: Recovered the files via inodes since they were all still open on the running database, that was a mess.

sep ,

Closing to 6k. There is just infinite replayabillity. Then you add mods, and friends.

sep ,

Factorio. The best value for money game i have ever bought. It is never on sale, so no need to wait.

The factory must grow! But remeber that the factory can not grow if the engineer do not eat, sleep and care for themself and their family!

sep ,

Valve beeing awesome again.

sep ,

Fucking wizard!

sep ,

old post, but I so wonder why you got downwoted for saying it like it is. a good isp will give you a /56, the minimum best practice. a great isp will give you a /48 you’r router will also participate in the wan /64, but that is just the uplink, and not something that will be used on the lan. www.ripe.net/publications/docs/ripe-690/#4--size-…

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • lifeLocal
  • goranko
  • All magazines
    •