[kalleboo]

> If we were given an unlimited supply of IP addresses from the ISP and all devices were accessible externally, it seems security issues in would be a much larger problem.

Nearly 40% of US traffic is already IPv6. 40% in Germany, 30% in Japan. I haven't heard of any massive increase in security issues caused by every device getting its own IP address.

[Macha]

Is that because there's still usually NAT at the users router or cell tower even with IPv6?

[Nextgrid]

I’ve never seen NAT being used with IPv6. I don’t see the point, it would be more effort to use it than not.

[tjoff]

Yes, but it would be worth it. There is no need nor benefit to have a per-device unique address advertised to the world.

If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.

[zAy0LfpBZLC8mAC]

> There is no need nor benefit to have a per-device unique address advertised to the world.

Yes, there is!

But possibly more importantly: There is no benefit to assigning devices ambiguous addresses. It's as sensible as having all rooms in your business have "1" as their room number because you somehow have convinced yourself that that prevents people from entering your building.

[tjoff]

What need or benefit?

I have no idea what you are trying to convey, I do not think you understood the concept.

I'm not talking about security.

[zAy0LfpBZLC8mAC]

The benefit of not having addresses collide. I mean, that's the whole point of assigning globally unique addresses?

When you connect some previously unconnected networks (a merger, or simply access for some sort of cooperation, or for maintenance access, or whatever), it's a nightmare with RFC1918 when address ranges overlap, which they invariably do. If you use globally unique addresses, you can be sure that there will be no problem.

When you debug something, you don't have to figure out what maps to what where in the network. When two machines talk to each other, the packets are labeled with the IP addresses of those two machines and the ports they are using, no matter where in the network you investigate. No matter who writes a log file about some operation happening in the network, all of those log entries are labeled with the same, uniquely identifying addresses.

And on the other side, there is still exactly zero benefit to using ambiguous adresses.

[notwedtm]

There are plenty of benefits and/or use-cases for having each internet connected device have it's own unique address. If not just for nonrepudiation, the elimination of NAT hardware and complexities is a plus as well.

If you're not talking about security, maybe you should be?

[ilikepi]

The benefit is to eliminate the disadvantages and complexity (however opaque) of running NAT.

I don't think anyone is suggesting that all devices be reachable by default. It's entirely reasonable and prudent to have a firewall between my home network and the world, but NAT is not strictly required for this.

[tjoff]

That is a benefit, true. However I don't feel that it is comparable to the drawbacks.

I'm not suggesting that anyone suggest devices being reachable. Them having a unique identifier is bad enough.

[zimbatm]

Actually it would make P2P communication much simpler.

WebRTC or any other video conferencing software wouldn't need a STUN server if all the clients were able to talk directly to each-other.

[tjoff]

First real benefit I guess. Yeah that's nice. Not worth it for me personally though.

[dorfsmay]

For privacy, you can setup your OS to require a different random IP every time it reconnects to the network. You will always be in the same /64, but with a different IP.

[tjoff]

That's a hack that doesn't protect anything for ongoing sessions. Slight improvement but hardly enough.

[dorfsmay]

Do you use incognito windows for each website you browse and close them before opening a new one? Do you disable cookies completely?

If not, using NAT doesn't add much privacy for "ongoing session".

Also, how many people share your internet connection? If it's a handful, like most household, your one in a handful, pretty small area. If that's a concern to you, you should use a VPN.

[zshrdlu]

Perhaps they're talking about NAT64?

[namibj]

Well, it's a firewall that behaves like NAT.