orangeboats

Christ. This again.

Sometimes people just want to geek out and talk about technical things, this isn't rocket science, is it?

Yes, those people mostly do realize the importance of understanding and discussing politics. But that doesn't mean _every single_ thread must devolve into a political discourse, especially when those discourses have a general tendency to lead to nowhere. It gets real tiring real fast...

I am willing to bet my 20 cents that you don't talk about saving the environment every single time you eat. And the reason is much the same -- it gets tiring.

Anyway. If you want to make a political statement, why not do it in a more suitable thread rather than a thread simply about the release of a model? It's not like HN strictly bans political threads.

I think interpreting the word too literally may not result in a productive discussion here. Especially taking into account that the original comment is translated from another language.

All things considered, it seems plenty obvious to me that "rubbish" is used to express the commenter's frustration.

More particularly, their frustration about how the discussion always devolves into non-technical discourse (the actual thing that they are referring to when they say "rubbish", and "human rights" is one example of such discourse) anytime China is mentioned.

They are frustrated because they think this is in direct contrary to the Hacker part of Hacker News, because Hackers should be more interested in the technology.

It's gotten to the point that the moment I see "Rust" and "TUI" together, I immediately assume it's vibe coded. The combination just seems to be vibe coders' favorite, for some reason.

If the PoW cybersecurity theory is correct, the difficulty of atacking and defending is constant over time

I am not the one arguing to weaken cyberdefenses and most certainly I did not write multiple paragraphs to bash on security measures ;)

If you want to make a wild bet, go to the casino.

Are you seriously suggesting that the number of people attacking computer systems across the world, is the same as 20 years ago?

Wow.

No wonder why the X11 vs. Wayland argument can last for so long on HN when it's mostly ended in other Linux communities (sporatic controversies aside).

---

Furthermore. Nowhere did I mention the word virtualize in my original comment, and I do not think my comment warrants the paragraphs upon paragraphs of virtualization-bashing.

Wayland was started 18 years ago.

Oh no, not this again. The design of Wayland started 18 years ago, but the stabilization happened 14 years ago, and the _convincing_ across the ecosystem obviously happened way later than that.

I would put the year closer to 2016, when distros started to consider Wayland as an option.

Obviously, XZ happened on Debian. But $malware can occur on any Linux distribution at any time. For a recent example just look at Arch Linux.

Also, are we still assuming that we would still get only one attack over 20 years, instead of the frequency increasing to, say, one attack per year?

---

But those are not my original point, XZ utils was just an example.

My original point is that: why should we not practice defense-in-depth, where we make sure malwares have to jump through multiple hoops (and hope that they trip on one of them!) in order to launch an attack?

I'm not sure I get what's being discussed here

I think it's the implication that any GUI program running under X can see any other GUI program and watch the user's interaction with the other programs. Vim is a CLI program though though...

If we want to move to a version with minimal privileges

Then you would have to cut everything provided by the X protocol into many, smaller, controllable pieces. Because if the permission control is just a switch that says "ability to communicate with the X server", then the whole exercise is rather moot, isn't it.

And when you cut the protocol into smaller pieces...

But granting full rights to distro-provided programs like vim or xeyes is perfectly sane

Saying this after the whole XZ utils ordeal has happened is quite interesting.

Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange?

X11 (the one that most people are familiar with, not the locked down one with X security -- because the latter introduces compatibility issues) does not have an access control model where programs can request for specific permissions.

In other words, xeyes would just work(TM) without the user granting it permission to read global mouse pointer position. And simultaneously, the same is true for $compromised_distro_provided_program.

It is disturbing, and it is hard to blame them. Given the political climate nowadays, I guess it's really hard to tell what is satire and what is real anymore.

Sometimes I see batshit insane takes on places like X, thought they were just satire. Later it turned out the posters were actually being dead serious.

Communist governments often prefer to use expressions that are more down-to-earth and colloquial, due to their populist root.

It could be related to that, or just a matter of North-South dialectal differences I guess.

Don't let the year deceive you; IPv6, while designed in the 90s, was considered launched since only 2012.

Did you just miss the headline a few days ago, that IPv6 adoption has reached 50%?

You might be right if IPv6 adoption stayed at 10% or so. But the current trend suggests that sooner or later someone is going to demand IPv6 support on your side.

I doubt it honestly. Most people are connecting to sites like Youtube, Instagram etc., which do actually support IPv6.

It's how I get 60~80% IPv6 traffic on my home network. A great portion of it was because of my mom watching Youtube.

Even when you discount the services run by FAANG, for personal sites, Cloudflare and GitHub Pages (but surprisingly, not GitHub itself) support IPv6 and enable IPv6 support by default.

In some cases the built-in firmware is very barebones, just enough to get U-boot to load up and do the rest of the job.

It's scary that your 1-minute old comment got insta-downvoted.

Unfortunately it's you who feels that way. Because you never realized that third world countries are being hurt by IPv4 address space depletion.

The lack of self awareness is appalling.

The fact that we are giving IP addresses an hierarchy is stupid. If you don't want outsiders to connect to your device use a firewall.

Come on... that's the top comment on the thread you shared.

https://news.ycombinator.com/item?id=47355046

This article that "begs to differ" is inventing IPv6 all over again. It just refuses to call itself so.

I quote from the top comment:

So you have to ship new code to every 'network element' to support IPv4x. Just like with IPv6.

and

So you have to update DNS to create new resource record types [...] Just like with IPv6.

and

You need to update socket APIs to hold new data structures for longer addresses so your app can tell the kernel to send packets to the new addresses. Just like with IPv6.

If bad routers etc. makes you think IPv6 is bad... then man, I think for me IPv4 is a mountain of shite.

But my comment was not directed at you, more so towards those people who looked at IPv6 very superficially (i.e. the ipV6 AddRESs iS UgLY!!1! people), so ¯\_(ツ)_/¯

Got it. So they are subhumans who shouldn't get a public IP anyway.

The topic is CG-NAT and port forwarding

You don't mention port forwarding without mentioning about hole punching.

Because what port forwarding is for, if not to ease the establishment of direct connections?

You don't need to establish P2P connection

If you are seriously suggesting Server-Client Is All You Need (TM), I feel we might as well stop the discussion now. VoIP essentially requires P2P, WebRTC is much better with P2P. BitTorrent etc obviously runs on P2P.

Services that provide relays (for people who can't establish P2P connection) for free, can only do so because they expect most connections to NOT go through the relay, and so they could simply stomach the costs of running one small relay.

Can you clarify what you mean by hole-punchable? If all else fails, just use TCP, right? Does TCP also not work?

I... uh, what? Please... learn more about hole punching before trying to engage in the topic.

Hole punching, in the context of NAT, is a technique where you establish peer-to-peer connection between hosts behind a NAT.

It does not matter which protocol you use, UDP or TCP or chuckles SCTP. If you want to establish P2P connection, you must hole punch.

The only alternative is to use relays.

I have not, but that is not inherent to CG-NAT, is it? Any switch or other hop between you and your destination can be overloaded.

A typical hop does not need to maintain a huge dynamic state table. NAT, due to its very own temporal nature, must do so.

destination itself can be overloaded.

Apples and oranges. Destination overload is a service problem. Hop overload is an infrastructural problem.

What is this entitled mindset that somehow people without CG-NAT already benefit from their public IPv4?

I will raise you the opposite point: why deprive people of their ability to have a globally addressable IP address?

But even UDP should work through CG-NAT.

I have already told you why it is wrong to make such as assumption, haven't I?

I have heard of stories coming from China and Vietnam that some ISPs implement so-called "type 4 NAT", otherwise known as symmetric NAT or NAT with endpoint-dependent mapping.

This kind of NAT is NOT hole-punchable. And because you don't control the NAT, you are simply SOL if one day your NAT decides to switch to it. Can't even use Tailscale without significant service degradation now, ouch.

Granted, I have only heard about it in Vietnam and China, and it's not a national thing -- only some provinces seem to have symmetric NAT implemented. But I feel the need to remind you that the ISPs there were able to get away with it, because the two countries have significant IPv6 presence. [0]

Port forwarding is nice, but everyone already knows you can hardly run a server at home (even in countries where port forwarding is standard).

You can hardly run a server at home because we have been facing address space depletion since the dot com bubble.

I hardly understand why it warrants treatment as such a terrible awful disaster.

You haven't faced an overloaded CGNAT gateway, have you? [1]

[0] https://stats.labs.apnic.net/ipv6/XD

[1] https://www.reddit.com/r/ipv6/comments/1as8dvy/is_there_a_wa...

Pretending that 0-9A-Z is somehow comparable to 行 or ∮ is quite daring, I will give you that.

And once again: any anti-IPv6 people could have already learned proper IPv6, if they directed 10% of their efforts (spent on bashing the IPv6 address format) to learn IPv6 instead.

- In the grand scheme of things, the IP address itself is of very little importance. It was given undue attention because of how IPv4 was inherently limited in address space.

- If you simply needed a way to name your machines, what are you doing not using the (m)DNS? You know, services literally with the word "Name" inside their name?

What happens when DNS is down (IPv4 edition)?

DHCP? For country-level IP allocation?

Yeah, your mama was not wrong - you indeed are a special one. Now, let's bring you to a nearby playground...

other than port forwarding

other

Well you just handwaved away the most significant difference between NAT and native IP, obviously there won't be any major difference to discuss about anymore!

No, we can't ignore port forwarding. The key thing to realize about NAT is that someone owns the NAT. Back then, the NAT lived inside each of the home routers, so even if you have a "strict" NAT (endpoint-dependent mapping NAT, i.e. one that doesn't allow for hole-punching), you can easily bypass it by setting up a manual port forwarding entry.

With CGNAT that's no longer possible, you do not control the NAT. If your ISP decides to screw you over, you essentially do not have a choice but to get a relay, which needlessly costs you money.

---

But if you really want to know what advantages native IP has over NAT, I'd say the lack of keepalive packets (to keep a holepunched NAT entry from being removed) is a pretty nice thing.

IPv4 - first come first served, with a 24 karat FU to the 3rd world countries. It is their fault that they are poor.

IPv6 - still the same, but the space is large enough that any first-mover advantage is minuscule.

You have to be really special if you think a 32-bit address space can cope with the ever expanding internet. We only managed to scrape by for now because ISPs keep on putting more and more people behind CGNAT. (My country's ISPs forced the migration to CGNAT because they literally couldn't get more IPv4 blocks without spending a hefty amount)