walnut 🌱 (@walnut)

BET IT ALL ON DOSKEL @doskel@doskel.net

8mo

thinking about the things ipv6 could enable is weird. it's easy to forget that computers were meant to just be able to talk to eachother
both tmobile and my isp provide ipv6 so... i can just ssh into my phone? directly? with no tunnels, upnp, anything; start a server on the phone and it becomes available via its publicly routable ipv6 address because COMPUTERS WERE MEANT TO BE PUBLICLY ROUTABLE. NAT is the wrong way to use the computer. do not fall for it and learn to use ipv6.

6

3

0

Errant

@errant@glaceon.social

8mo

@doskel I am not really super into network security, but for the same reason, this sounds kinda scary. Is this merely perception? Were bad actors already not going to be meaningfully impeded by the NAT, but instead other measures/firewall? so removing this primarily removes inconvenience for the legitimate user? And not just theoreticslly, but practically - are the high-level user facing pieces of IPV6 networking effectively prevent people from accidentally leaving their computet wide open for attack?

2

0

1

0

BET IT ALL ON DOSKEL @doskel@doskel.net

8mo

@errant won't lie to you, this is very much an increased attack surface and is part of the reason malware spread so fast back in the 90s. that said, most consumer router equipment will do automatic filtering of inbound ipv6 traffic (albeit sometimes said filtering breaks ipv6 in general so it's not at all perfect), and most large deployments will already have a separate firewall
i am somewhat worried about what a misconfigured router with iot shit directly connected could enable, but that's undoubtedly a solvable problem, and at least for now most of those dumb vulnerable devices don't support v6 at all :p

2

0

MarkAssPandi @MarkAssPandi@shrimpnet.gej.pet

8mo

@doskel @errant Just curious
weren't firewalls made exactly because of that? because back when computers were all accessible, it was crucial to lock ports so that they can't just be connected to directly?

1

0

1

0

walnut 🌱 @walnut@thesoftestpaws.net

3mo

@MarkAssPandi @doskel @errant
Inbound traffic can only connect if a program is listening on that port and the local firewall is open. Something like SSH should be fine; barring any bugs it will only let authorized connections.

Problem I guess is either something legitimate exposing an unsecured service, like if you were running telnet, or malware listening for commands. I'm not sure how much of a problem NAT provides to malware. Maybe NAT traversal is too much effort, but having it call back to your server protected by cloudflare seems popular anyway. IPv6 address space is so large you may need to do that anyway rather than scan the entire internet(?). Idk, I'm not an expert here

0