Hacker News
points by simoncion 1 hour ago | 0 comments
> Plus dual-stack means more work, and more possibilities for misconfigurations or vulnerabilities in your network.

Nope. Your OS vendor already did the work to make both versions of IP work. And as I mentioned, if you're using a decent firewall you can write IP-version-agnostic rules just as easily as you can ones that depend on the version.

Plus, most SOHO firewalls default to dropping unsolicited non-ICMP traffic. That's the exact same security stance that IPv4 + NAT gives you. You have to go out of your way (or be using fancy gear that is aimed at people who know what they're doing) to expose your LAN hosts.

[–] spauldo 1 hour ago
My OS vendor didn't set up my firewall rules, lay out my subnets, or configure my routing. I did that. Twice. Because I've got a slightly more advanced network layout than your typical home user. And that's all much less complicated that what your typical corporate network would be, which is much less complicated than what an ISP or COLO provider has to deal with. And then there's the cloud...

Yeah, sure, if your requirements can be met by a cable modem, then you're basically good to go. Until DNS breaks for some machines and not others, and it's because your ISP screwed something in their IPv6 routing but it still works on IPv4. Or Microsoft's authentication servers decide they don't like your IPv6 subnet anymore and Minecraft refuses to start unless you turn IPv6 off. Or... You get the idea.

Hacker News