Subject: Re: refocusing: Re: [v6tc] Issue 2: service discovery:automaticormanual?

From: "Miguel Angel Diaz" <[email-masked]>
Date: Wed, 19 Jan 2005 09:30:24 +0100

> On Tue, 2005-01-18 at 10:14 +0100, Miguel Angel Diaz wrote:
>> >> IMHO if we wish a broad and fast deployment of IPv6 the answer is that an
>> >> automatic discovery mechanism is definitively required. 
>> > 
>> > There is already Teredo and 6to4, what more is needed?
>> > Teredo on it's own already solves most if not all problems.
>> > The only issue with Teredo _could_ be that one does not get the most
>> > local relay. But I think M$ can be easily pursuade to add a update to
>> > windowsupdate that will reconfigure the default teredoserver to an
>> > anycast address.
>> > 
>> 
>> Thousands (even millions) of users over the world can't use the
>> current servers that M$ has pre-configured for 6to4 and Teredo
>> implementations on the OS, which are 6to4.ipv6.microsoft.com and
>> teredo.ipv6.microsoft.com.
> 
> Did you notice the following:
> 6to4.ipv6.microsoft.com has address 192.88.99.1
> 6to4.ipv6.microsoft.com has address 131.107.33.60
> 6to4.ipv6.microsoft.com has IPv6 address 2002:836b:213c:1:e0:8f08:f020:8
> 
> If it isn't known, that first one is the 6to4 anycast address, which is
> also the first thing that XP tries, after that it might fall back to the
> microsoft provided relay.
> 
> They (6to4 and Teredo) work perfectly fine from the several places where
> I have tried them. The only thing was the latency and throughput, which
> is logical as the Teredo box is hosted in the US, which is not where I
> am, but fortunately it uses those nice bubbles to locate a more local
> server which then causes the traffic to be optimized a bit.
> 
> Any real argument why these millions of users can't use Teredo according
> to you?
> 

I mean that currently only a few Teredo servers are deployed over the world, being the most known the ones deployed by Microsoft which are the default ones on Widows XP. It doesn't seem to be likely that only a few them can manage thousands of connections cuncurrently.

>> It is assumed that every ISP willing to offer IPv6 services to their
>> customers will deploy a TEP infrastructure on its own network, either Teredo,
>> 6to4, or whatever. The TEP discovery on the ISP network is the point.
> 
> Of course they want that, just like this is expected from 6to4.
> There is a very simple solution if you want this: anycast prefix for
> Teredo. Does not require any weird mechanisms, no weird stuff in DNS
> nothing. But to call this 'discovery', why bother with that ?
> 
>> > Now if I would live in Tokio I could live with this assumption, but
>> > unfortunately, unless I go to Akibara myself or import the stuff I will
>> > not be able to buy these cool toys (yet).
>> > 
>> > Also, the router in the house should provide this, not the camera, that
>> > should simply RA. Next to that does the word 'security' say anything?
>> 
>> The point is that "today" we are working on the networks for "tomorrow" and in the near future,
> 
> In the future there will be native IPv6 to the home, today there is need
> for some tunneling. But in ~5 years it will be mostly native.
> 
>> I think we all are agree that many home devices will support IPv6. Such devices could implement
>> methods to work with IPv6 even although only IPv4 (so not RA available) is available on the
>> home network during the early deployments. In this scenario an automatic discovery method is required.
> 
> Thus you want every small device to implement tunneling and thus create
> how many security holes in how many places?
> 

Security is an issue not only with small devices on the network but also on operating systems running on the computers and I guess it doesn't depend on the discovery mecanism used to get IPv6 connected :)

> You'd better start writing the security section of the draft like 3
> years ago if you want to cover all the possible problems you will be
> creating here.
> 
> Remember the following very simple thing: There will most likely be at
> least one computer (XP, BSD, Linux, other 'router') that supports IPv6
> in such networks. These are more than capable handling this and are also
> way easier to make centrally secure/firewalled.
> 
> If you really want that you can plug in a IPv6 camera, which will then
> also do IPv4 for the tunneling even though it is a IPv6-only cam, then
> also remember the security problems.
> 
>> >> So, IMHO the answer is that we can't live with methods that require users to enter any URL or data.
>> > 
>> > I know of almost 3500 happy users who lived with this perfectly fine and
>> > there are a number of other organizations who claim to have way more
>> > users.
>> > 
>> 
>> I guess we are thinking of different type of users. I sure that expert users (at least with some
>> technical knowledge) are happy with that situation, but I'm thinking of thousands of users that
>> aren't TI experts.
> 
> I am quite sure that most of those happy users are completely clueless
> in what they are doing and just followed that nice article they found on
> the internet or in that Computing Magazine For Dumbo's and are happily
> downloading the newest movies/music and other warez they can find.
> This is where the internet is used for and this already works.
> 
>> My father might be a good example: he likes just plug-and-play devices because
>> he has no technical knowledge at all, so he would like just plug its IPv6 camera (with transition
>> mechanisms implemented) on the home network (IPv4) and see its house while traveling around the world.
>> He wants that the camera itself is in charge of all the required configuration (TEP discovery included) to work.
> 
> He is quite likely to not even want to know how it works, he wants it to
> work, but without having his neighbor and that Brazilian kid and the
> burglar watching his house for him too... or are you going to explain
> him what security is? ;)
> 
> Next to that, implementors of small devices don't like to implement
> multiple IP stacks and replicate work which should be done by other
> equipment. Note that all the current IPv6 toys are IPv6-only and do not
> have anything to do with IPv4. There is a reason for this: they don't
> want to be bothered with IPv4 in the first place as those devices could
> not communicate globally in the first place and they where sick of
> building NAT workarounds.

Wether implementors implement dual stack or not it depends the status of the native IPv6 deployment ant when they offer their products on the market. Why are they going to try to sale IPv6 only products to users that don't have IPv6 on their access networks and proven that most users don't usually know how to configure IPv6 tunnels or IPv6 gateways?

It is probably that developers implement dual stack (at least on the earlier stages) to cope with both markets IPv4 and IPv6 (native one or with transition mechanisms). At least, it will depend on the type of product.

Regards
Miguel

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

_______________________________________________
v6tc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/v6tc

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 19 Jan 2005 10:03:37 +0100

> > On Tue, 2005-01-18 at 10:14 +0100, Miguel Angel Diaz wrote:

<SNIP>
> I mean that currently only a few Teredo servers are deployed over the world,
> being the most known the ones deployed by Microsoft which are the default
> ones on Widows XP. It doesn't seem to be likely that only a few them can
> manage thousands of connections cuncurrently.

Isn't that a very logical conclusion which can be solved by doing what
Microsoft is mentioning: deploy Teredo servers.

And isn't this exactly what one has to do with every other solution?

<SNIP>
> Security is an issue not only with small devices on the network but also on operating
> systems running on the computers and I guess it doesn't depend on the discovery
> mecanism used to get IPv6 connected :)

But it is much easier to configure a firewall once than to configure
your:
 - refrigerator
 - dish washer
 - washing machine
 - every lightbulb
 - dvd player
 - stereo equipment
 - house doors
 - jacuzzi
 - the list goes on...

and thus everything separately, maybe turning the IPv6 knob on or off.
Remember most people can't even program their VCR, you really expect
them to figure out what IP is ?

So simply keeping those components from there keeps people from having
to configure it and thus forget it. Or do you like jacuzzi at 500
degrees?... Also which device are you more likely to check up on? The
PC/router or the jacuzzi's internet connectivity? Keeping it central
saves a lot of problems.

There are a lot of people already having a lot of fun with Bluetooth for
the same reasons, I don't like to see IPv6 getting the "insecure
protocol" label slapped on.

<SNIP>

> Wether implementors implement dual stack or not it depends the status of
> the native IPv6 deployment ant when they offer their products on the market.
> Why are they going to try to sale IPv6 only products to users that don't have
> IPv6 on their access networks and proven that most users don't usually know
> how to configure IPv6 tunnels or IPv6 gateways?

If somebody buys a "IPv6 Only Camera" they will make sure that they also
get the connectivity for it if they want to have it connected to the
global internet in the first place.

XP + Teredo will automatically configure it for you, thus why bother
with the fridge? (which would create multiple different prefixes,
multiple security holes,...)

Greets,
 Jeroen

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Sat, 22 Jan 2005 23:36:24 +0100

Agree, the situation right now and I foresee for a long time, is that all
those devices implement dual stack (and indeed is my recommendation to
makers when they ask me, as this avoids any need for using translation -
which is the worst we can do IMHO - mechanisms when the other end only talks
IPv4, for example).

Also, the reason why the devices need to come with transition mechanisms
right now is because most of the CPEs don't have it. The situation may
change in the future, but is not right now. So you may need to create
different tunnels for the same home. In my own case, where I've lots of IPv6
devices for home automation in my home, obviously I setup a machine to act
as "the" IPv6 router, but I know how to do it. Again, this is not the usual
case.

Regards,
Jordi

> De: Miguel Angel Diaz <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Wed, 19 Jan 2005 09:30:24 +0100
> Para: <[email-masked]>
> Asunto: Re: refocusing: Re: [v6tc] Issue 2: service
> discovery:automaticormanual?
> 
> being the most known the ones deployed by Microsoft which are the default ones
> on Widows XP. It doesn't seem to be likely that only a few them can manage
> thousands of connections cuncurrently.
> 
> 
> Security is an issue not only with small devices on the network but also on
> operating systems running on the computers and I guess it doesn't depend on
> the discovery mecanism used to get IPv6 connected :)
> 
> 
>>> He wants that the camera itself is in charge of all the required
>>> configuration (TEP discovery included) to work.
>> 
> Wether implementors implement dual stack or not it depends the status of the
> native IPv6 deployment ant when they offer their products on the market. Why
> are they going to try to sale IPv6 only products to users that don't have IPv6
> on their access networks and proven that most users don't usually know how to
> configure IPv6 tunnels or IPv6 gateways?
> 
> It is probably that developers implement dual stack (at least on the earlier
> stages) to cope with both markets IPv4 and IPv6 (native one or with transition
> mechanisms). At least, it will depend on the type of product.
> 
> Regards
> Miguel
> 
> This electronic message contains information which may be privileged or
> confidential. The information is intended to be for the use of the
> individual(s) named above. If you are not the intended recipient be aware that
> any disclosure, copying, distribution or use of the contents of this
> information, including attached files, is prohibited.
> 
> 
> 
> 
> This electronic message contains information which may be privileged or
> confidential. The information is intended to be for the use of the
> individual(s) named above. If you are not the intended recipient be aware that
> any disclosure, copying, distribution or use of the contents of this
> information, including attached files, is prohibited.
> 
>