this post was submitted on 09 Jun 2024
814 points (98.1% liked)

Programmer Humor

19660 readers
358 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 1 year ago
MODERATORS
anzo
Feyter
BurningTurtle
pylapp
814
Roses are red, violets are blue, everyone is using IPv6, why aren't you? (lemmy.world)
submitted 5 months ago* (last edited 5 months ago) by [email protected] to c/programmer_humor
235 comments fedilink hide all child comments
 

Context:

People have been asking for IPv6 Support on GitHub since years (probably a decade by now)

... and someone even got so annoyed that they decided to setup a dedicated website for checking this: https://isgithubipv6.live/

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 1 points 5 months ago (1 children)

Wait, why are we talking about Layer 7 when NAT and firewalls are Layer 4 at best?

[–] [email protected] 1 points 5 months ago (1 children)

Because, as I said:

layer 7 firewalls for the network which are going to be where most the majority of attacks are concentrated.

The NAT doesn't have to operate at layer 7 to be effective for this because

coincidentally it is doing the heavy lifting for home network security because it is dropping packets from connections originating from outside the network, barring of course, forwarded ports and DMZ hosts because the router has no idea where to route them.

The point is that the SPI firewalls are not protecting against the majority of the attacks we've seen for decades now from botnets and other arbitrary sources of attacks, except, perhaps targeted DDoSing which isn't the big problems for most home networks. They must worry about having their OS' and software exploited and owned in the background, which doesn't get much of an assist from a router's firewall.

Obviously, this is however true for the NAT since the NAT are going to drop connections originating from outside the network attempting to communicate with that software to exploit it

barring of course, forwarded ports and DMZ hosts because the router has no idea where to route them.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (1 children)

How is this "dropping packets" not applicable to firewalls, then? You are not just going to casually connect to my IPv6 device as we're speaking. The default-deny firewall in my router does the heavy lifting... just like what NAT did.

Honestly, it just sounds like you need to brush up on networking knowledge. Repeat after me: NAT is not security.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (1 children)

Are you saying that everyone's router's firewall drops all packets from connections that originate from outside of their network?

[–] [email protected] 1 points 5 months ago (1 children)

It's a stateful firewall. It simply drops unsolicited packets.

[–] [email protected] 1 points 5 months ago (1 children)

So, really, you were "correcting" me for you and your specific setup at the very beginning because your router's firewall has a deny rule for all inbound connections because I must have been confusing what a NAT and what a firewall is because I must have been talking about your specific configuration on your specific devices.

Holy. Fucking. Shit.

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (1 children)

Oh come on, are you seriously suggesting that default-deny stateful firewall is not the norm??

Holy. Fucking. Shit. Indeed.

You keep on suggesting to me that you really have no idea how networking works. (Which is par on course for people thinking NAT == security, but I digress)

Let me tell you: All. Modern. Routers. include a stateful firewall. If it supports NAT, it must support stateful firewalling. To Linux at least, NAT is just a special kind of firewall rule called masquerade. Disregarding routers, even your computer whether Linux (netfilter) or Windows (Windows Firewall) comes built-in with a stateful firewall.

[–] [email protected] 1 points 5 months ago (1 children)

Having a NAT on a consumer router is indeed the norm. I don't even see how you could say it is not.

I never said NAT = security. As a matter of fact, I even said

It was not designed for security but coincidentally blah blah

But hey, strawmanning didn't stop your original comment to me either, so why stop there?

Let me tell you: All. Modern. Routers. include a stateful firewall.

I never even implied the opposite.

To Linux at least, NAT is just a special kind of firewall rule called masquerade.

Right, because masquerade is NAT....specifically Source NAT.

I'm just going to go ahead an unsubscribe from this conversation.

[–] [email protected] 1 points 5 months ago

Were I really strawmanning you? Is "I never even implied the opposite" really true? Quote:

So, really, you were "correcting" me for you and your specific setup

Yeah, my "specific setup"... which can be found in virtually all routers today.