Hacker Newsnew | past | comments | ask | show | jobs | submit | bornfreddy's commentslogin

A friend gave out an email gmail@hisname.com (he owns the domain). He says it's incredible how many people "corrected" him, and how persistent some of them were. :-)

> But for the past two months our agents have been working on an even more ambitious project: rebuilding the WordPress open source project from the ground up.

> no WordPress code was used to create EmDash

Hm. Do you think those agents were trained on WP code?


> Having a public address doesn't worry me. At home I have a firewall at the edge. It is set to block everything incoming.

Concern is privacy, not security. Publicly addressable machine is a bit worse for security (IoT anyone?), but it is a lot worse for privacy.


I'm not confused about the NAT / firewall distinction, but it might be nice if my ISP didn't have a constant, precise idea of exactly how many connected devices I owned. Can that be _inferred_ with IPv4? Yes, but it's fuzzier.

Is this solved by the device having between 1 and X randomly generated IPv6 addresses?

Some of my devices have 1, some 2, and some even more. Takes some precision out, at least.


Aren't your home addresses assigned by your local router?

the ISP can see 58 different ipv6 addresses sending packets in the last hour

With ipv4 it can see one ipv4 address

Now sure that 58 could all be on one device with 58 different IPs and using a different one for each connection

In reality that's not the case.


Okay but why does this matter? They're your ISP they also have your address, credit card number and a technician has been in your home and also supplied the router in the common case.

The theoretical vague problem here is being used to defend a status quo which has led to complete centralization of Internet traffic because of the difficulty of P2P connectivity due to NAT.


No device on my ipv6 vlans can establish P2P tunnels outside with random clients.

Firewalls and good old monetisation prevented your p2p connectivity utopia, not nat.


The ISP still doesn't know how many devices are connected, because a lot of those devices are using randomized and rotating IPs for their outbound connections.

You already have a public IP address the only difference is if you have a rotating IP address which is orthogonal to IPv6.

The only difference is most ISPs rotate IPv4 but not IPv6.

Heck IPv6 allows more rotation of IPs since it has larger address spaces.


IPv6 can "leak" MAC addresses of connected devices "behind the firewall" if you don't have the privacy extensions / random addresses in use.

There are a number of footguns for privacy with IPv6 that you need to know enough to avoid.


Privacy extensions are enabled by default on OSX, windows, android, and iOS: https://ipv6.net/guide/mastering-ipv6-a-complete-guide-chapt...

On Linux, I think the defaults are left up to the distros so there is a chance of a privacy footgun there. Hopefully most distros follow the example set by Apple and Microsoft (a sentence I never thought I would write...)


They are now - I'm not sure when they implemented them but I know Windows at least would do some really stupid stuff very early on.

Aren't we talking about now?

No one is saying we should have activated IPv6 in its first iteration.


All desktop/mobile OSes today use "Stable privacy addresses" for inbound traffic (only if you are hosting something long-term) and "Temporary addresses" for outbound traffic and P2P (video/voice calls, muliplayer games...) that change quickly (old ones are still assigned to not break long-lived connections but are not used for new ones).

With SLAAC and a random IPv6 you would get at least the same level of privacy. One public IPv4 isn't different from /48 IPv6 network.

IPv6 vs. 4 is like Python 3 vs. 2, just worse.

There are genuine improvements in IPv6 aside from the abundance of addresses. The two that immediately come to my mind are:

1. SLAAC means routers no longer need to keep a record of each client on the network. With DHCP, the router had to maintain a table of which addresses had been assigned and getting an address involved 2-way communication. With SLAAC the router just periodically broadcasts the prefix to the network and any device that wants an address can just listen to that broadcast and assign themselves an address within that prefix without having to inform the router and without the router needing to maintain a table of assigned addresses. (2-way communication is still possible since devices can solicit a broadcast but it is not necessary)

2. With IPv6, middleboxes are no longer allowed to fragment packets. The only device that can fragment a packet is the original sender. If any segment along the path has a lower MTU than the size of the packet, the original sender is notified and then they can fragment the packet.


And IPv6 vs v4 discussions are just like Python 3 vs. 2 discussions: Often much more annoying than just getting it over with and switching.

This. Sure there are still some applications that might be difficult to v6 enable, so either patch it or use one of the myriad of options to give it a v6 front end.

It would've been less annoying to not do a breaking change from Py2 to 3. JS never had a breaking change like that.

Python 3.7 or Python 3.8 ? /s

AI can provide leads. Someone still needs to verify them and decide.

Generating and verifying bad leads costs money. Not verifying bad leads can cost much more.

At some point, you have to decide if wasting good money on bad intel makes sense.


Let me guess - you like Apple?


I think they build good products and their operating systems are ahead of their competitors in the space.


Well that's a bit misleading answer. Some apps refuse to work if G services are disabled, so they clearly communicate with them. It would be nice to know what exactly G learned about the phone through those "sandboxed" apps.


It's an Android service. But unlike on regular Android where Google play services have hard-coded special permissions, on Graphene it is an ordinary android service with all the same strict rules applying to it, as to any other service you could write.

So an application of course can use other android services if it declared that, that's why it can see whether it's running or not. But you are in full control whether google play services is installed, and what it can use.

Of course this may break certain apps (Google maps location sharing will probably not work with the location permission denied for play services), which may or may not degrade gracefully.


I denied the contacts permission to the Play Services. It just shows a notification when it tries to access them, which is actually not common at all.


I liked Dell one, loved ThinkPad, and hate MBP trackpad. I guess it's a matter of taste?


Debug it? Swap some components? Good luck with that on that shiny closed box.


IE. Enough said.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: