[ale] IPv6 vs IPv4 (was: uptime)

[jimpop at gmail.com (Jim Popovitch)]

On Wed, Mar 17, 2010 at 22:42, Michael H. Warfield <mhw at wittsend.com> wrote:
> On Wed, 2010-03-17 at 22:03 -0400, Jim Popovitch wrote:
>> Well, that brings up the usual IPv4 vs IPv6 interest :-). So a measure
>> of security comes from IPv4 but not IPv6...yet another reason to delay
>> IPv6 :-)
>
> Fraid not. ?You don't really have a choice. ?It's far far more difficult
> and expensive to prevent or obstruct IPv6 than it is to provide it. ?I
> haven't accessed IPv6 from an aircraft yet (but that would be trivial)
> but I have done a half a dozen cruise ships at sea and from several
> continents (Asia, Europe, South America, and all over the US, Canada,
> Mexico, Central America, and the Carribean). ?Behind NAT devices and
> behind firewalls. ?We've found it deep in labs communicating with Teredo
> servers out on the Internet (Windows Vista, Windows 7, and a surprising
> number of Windows XP systems that nobody can explain). ?I have yet to
> find a place where I could not reach IPv6 if I really wanted it. ?And
> the bad guys know this. ?Russia and the Ukraine are #1 and #2 on
> Google's list of v6 deployment. ?Think about that. ?In fact, I would
> honestly say, if you have access to DNS then someone has access to IPv6
> from where you are (look up Iodine, DNScat, and OpenVPN and think about
> it). ?Time for burying your head in the sand was gone a long time ago.
> The important point is that you don't know. ?You won't know. ?It doesn't
> ring any big red bells and announce itself. ?It just works and you are
> none the wiser.

I think you are missing my point ;-)

> You say another reason to "delay" IPv6? ?And exactly WHAT have you done
> to delay it? ?If the answer is nothing, you're not even a speed bump.
> If you are not actively checking for it and blocking it, how are you
> delaying it? ?Even if you are actively trying to detect it, it's now
> common on all modern Linux boxes and Mac books and you can't disable it
> on Vista or Windows 7 (and it's really difficult to disable it on Linux
> by intent and design). ?At least some of the IPv6 protocols should be
> present on virtually every modern network at this time (globals may not
> be actively routed but RD, and ND should certainly be present and maybe
> even RA). ?Have been for many many years and here you sit oblivious to
> it all. ?Delaying it is too late when it's been sitting on your network
> for 5 years or more and you still have no clue.

:-)

-Jim P.