• 2 Posts
  • 220 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle
  • It offers no practical benefit to small networks at the moment.

    The internet is not a “small network”, and I assume your small network is connected to it. You need local IPv6 routing to have access to IPv6-only hosts which are becoming more and more because it’s reasonable in terms of price to get an IPv6 block unlike IPv4 blocks which are being auctioned for tens of thousands of dollars at this point (!!!).

    Also restoring global addressing is a huge benefit. P2P communications in IPv4 has become an insane mess of workarounds due to lack of addresses and this becomes worse the more layers of NAT you stick behind each other to try to save your ass from the rising tide.

    I’m really sick of hearing these idiotic excuses over and over, “it’s hard” this, “it’s unsafe” that, “it’s expensive”, “understanding the eldritch secrets of IPv6 has driven 5 of my colleagues into madness” skill issue. THERE ARE NO MORE IPV4 ADDRESSES. So unless your network is so fucked that you haven’t managed to fix it in 26 years, since IPv6 has been standardized, or it really is just an internal network with no outward facing services where it doesn’t matter when someone who just has IPv6 can’t access it because they wouldn’t be able to access it anyway, and you’re not some kind of ISP, you have no reason not to have support for it at this point and you absolutely never have a reason to tell people it’s not “useful” because that is straight up wrong in the general case even if it might be true for your situation.



  • ipv6 in home lans is likely to be unsafe due to the defaults in some/many/most routers?

    no

    and those ipv6 devices can in these szenarios escalate their permissions be spawning new ip adresses

    yes and this is not “escalating their permissions”, it is in fact the expected behavior with Privacy Extensions (RFC 4941) where devices will probably have multiple addresses at the same time that are used for outgoing connections

    that would overcome lazy output fw rules?

    any router that doesn’t have deny as the default rule for WAN->LAN traffic (probably not many) is trash, and if you’re filtering LAN->WAN traffic (not really usual for a home network) then you want default deny there too, but at that point that is not an ipv6 problem

    or if i upload a malicious apk to some smartTV and have a it spawn a dhvpv6 server and then spawn a new virtual device that would be given an IP by my fake dhcpv6 to bypass. and we all can use macaddresschanger.

    rogue dhcp is not an ipv6 exclusive problem

    so you say with macfiltering the router would still prevent unwanted direct connections between my c&c server and some malicious virtual device? that’d be cool, but i dont understand how.

    yes, firewall rules can work based on mac addresses, not sure exactly what you mean












  • Cleaner how? Systemd services can already provide basically all of the isolation features you could want if that’s what you’re talking about. It’s got namespaces, chroot+bind mounts, per-service dynamically allocated users, syscall filter, capability filter, and so on.

    Docker adds a lot of for most uses unnecessary complexity (a huge part of which being the networking). This also sometimes causes problems, for example it messes with netfilter tables which works fine most of the time but can actually do unwanted things like IIRC open ports you didn’t expect to be open because you didn’t open them in your firewall. There’s also how if you use prebuilt images (which you probably do) you’re at the mercy of everyone whose containers you’re using to provide security updates in time.

    Of course there’s cases where you actually want something like docker (multi-machine orchestration, spinning up multiple of the same container dynamically depending on load, running people’s arbitrary build environments like in GitHub Actions are a few examples) but a lot of times when people are pushing it it really seems like cargo cult mentality.







  • Do be careful, the like 20–50€ USB webcams that you can usually find are absolute dogshit IME and probably blown away by any webcam on a good recent laptop (the one I have certainly is by the one on my MacBook and IIRC the laptop I had before also had a better camera). Personally I wouldn’t trust any of the ones I can see listed on amazon right now. A lot of times they have horrible autofocus, brightness adjustment, noise and so on even if the theoretical image resolution is advertised as 1080p for example. (Of course, you can always send it back but still.)

    If you want actually good quality, get a real video camera that you can connect to a computer, or if possible use your phone back camera if it’s good enough (I know Macs can use the iPhone camera as a built in thing, not sure about other combinations of phone/computer).