Hacker News new | ask | show | jobs
by kortilla 2016 days ago
Use DNS, that’s what it’s there for. MAC addresses aren’t referred to as fundamentally flawed and they are approximately the same length as the shorted version of the address you posted.
2 comments

Forget DNS. Use an overlay with content routing. Hierarchies suck.

It's extremely hyperbolic to call an ugly syntax a bad "design". But IMO it would have been much nicer if they just reused '.' as in IPv4. ':' seemingly came out of their pie in the sky desire to replace MACs.

Speaking of MACs, every time every time I see some cheap trash gizmo come with its own MAC I'm surprised there isn't address space pressure. I guess that's due to having 16 more bits as well as being non-aggregable.

Yeah, that extra 16 bits is a game changer. The whole v6 debacle wouldn’t have happened if v4 was 48 bits.

It’s funny, there is an interview with Vint Cerf where he mentions the choice of 32 bit address space for ipv4 was essentially pulled out of a hat and it could just as easily have been 48/64/24.

Do you ever configure, type or have to share MAC addresses? Probably not.

On the other hand, most devs / technical staff type IPs into the browser and terminal daily.

> On the other hand, most devs / technical staff type IPs into the browser and terminal daily.

No they don’t. Configure a DNS server and type these in once. Any time I see IP addresses passed around it’s a sign of broken infrastructure. (It also means you aren’t using tls or you’re training people to accept cert errors)

> No they don’t

Oh yes they do.

> Any time I see IP addresses passed around it’s a sign of broken infrastructure

Nope.

> It also means you aren’t using tls or you’re training people to accept cert errors

So, let me get this straight. You have a server that's behind CloudFlare, and you're claiming we should use DNS and TLS to SSH into it?

I think you’re confused a bit, so let’s split apart the use cases to be clear why IPs are bad in both cases.

You said devs and technical staff were typing IPs into their browsers. Presumably this means the address bar, which breaks TLS.

SSH derives a big chunk of security from key caching. If you’re using IPs you now can’t have an IP change without triggering key warnings on the SSH clients for a new key at a minimum or (worst case) a breach.

IPs should be passed to the DNS server, yes.

Every server/VM I control (~200) has a DNS entry. Every active IP has a reverse (PTR) entry.

I have a monitoring task to check for missing DNS entries, as it usually suggests a problem (i.e. we've deployed or undeployed something incompletely).