Re: [v6ops] Google Alert - IPv6

[Dave O'Reilly <[e-mail]>]

> On 1 Nov 2017, at 14:07, Lee Howard <[e-mail]> wrote:
> 
> 
> 
> On 10/29/17, 8:32 PM, "Dave O'Reilly" <[e-mail]> wrote:
>> 
>>> 
>>> 
>>>> Can we regulate our way out of this problem?
>>>> ——————————————————————————————
>>> 
>>> Probably not. Countries with the highest IPv6 deployment have had either
>>> no government influence, or little more than government talking with
>>> industry about their IPv6 deployment plans. Countries with IPv6 mandates
>>> on industry seem to have very low actual deployment.
>>> 
>> 
>> I completely agree with you that there are too many regulatory models
>> around the world for a recommendation of regulatory solutions to this
>> problem to be likely to meet with much success. However, Belgium has the
>> highest IPv6 adoption rate on the planet according to
>> https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-a
>> doption&tab=per-country-ipv6-adoption and I understand that the reason
>> for this is that the telecoms regulator in Belgium required that a
>> maximum of (I think it was) 16 people can be sharing a single IP address
>> on a CGNAT at any given time. I forget the exact figures but it was
>> definitely a regulatory intervention.
> 
> 
> My understanding, which is indirect, is that Belgian law enforcement and
> telecom regulators sat down with ISPs and said, “Our reading of EU law
> says CGN is illegal.” And ISPs said, “We have to do CGN, or turn off the
> Internet, (or maybe increase Internet prices to buy IPv4 addresses).”  So
> the regulators agreed to forebear enforcement of the no-CGN law unless
> address sharing exceeded 16 users per address.
> 
> I have been unable to find this agreement in writing, though. That might
> be intentional.
> 
> So, yes, I suppose it is regulatory intervention, but it’s not new
> regulation, it’s a different inteprpretation than other EU member states
> have of EU law. And it’s not a regulation, it’s an unwritten understanding
> (or forebearance). 
> 
> I would welcome correction if my understanding is inaccurate our outdated.
> 
> 

I know it was a regulatory intervention alright but I don’t know the details of the discussion, perhaps it is a voluntary code of practice. In either case, such interventions are unlikely to be broadly applicable as a solution to the crime attribution problem.

>> 
>>>> 
>>>> 
>>>> However, the obvious question to ask is - are the Belgian authorities
>>>> catching any more criminals now that they have such a high adoption
>>>> rate
>>>> of IPv6? Has the problem of crime attribution due to CGNAT gone away
>>>> for
>>>> them, or does it actually require global adoption of IPv6?
>>> 
>>> The question is more like, “Are Belgian authorities catching more
>>> criminals than other countries in proportion to their IPv6 deployment?”
>>> They’re probably not catching more bad guys than they were before CGN,
>>> they’re just trying not to lose ground.
>>> And the answer is probably not good, because although Belgium has great
>>> numbers on eyeballs, their IPv6 deployment on content sites is still
>>> weak
>>> (https://www.vyncke.org/ipv6status/detailed.php?country=be ).
>>> 
>>> 
>> 
>> Exactly! So they can attribute domestic IPv6 activity to domestic IPv6
>> addresses but the second IPv4 to IPv6 transition takes place they’re no
>> better off than anyone else.
> 
> Do you mean IPv6 is no better than CGN for attribution, or do you mean
> IPv6 is no better than native IPv4?
> 

What I meant was that at some point IPv6 to IPv4 translation will need to take place, which is essentially a form of large scale address sharing, similar but not identical to the CGNAT problem (similar enough to form part of this discussion in any case). Until IPv6 is ubiquitous and IPv4 is no longer routable this problem will remain to a greater or lesser extent.

>> 
>>>> 
>>>> The role of the IETF in this
>>>> ——————————————————————————————
>>>> 
>>>> Right from the front page of the IETF website: "The mission of the IETF
>>>> is to make the Internet work better by producing high quality, relevant
>>>> technical documents that influence the way people design, use, and
>>>> manage
>>>> the Internet.”
>>>> 
>>>> Large scale address sharing technologies present a challenge to the
>>>> management of the Internet so that seems to fit right within the remit
>>>> of
>>>> the IETF to me. Correct me if I’m wrong...
>>> 
>>> Not entirely, but this seems more operational to me, and might be better
>>> targeted as a recommendation for how to manage servers.
>>> 
>> 
>> Well, the IETF has already published such recommendations (RFC6302). The
>> question is what, if anything, else the IETF can/should do.
>> 
>> I wrote this document and I didn’t really know what to do with it, so I
>> published it as an internet draft and have been trying to collect input
>> on what/where the best places to progress the conversation are…and here
>> we are.
> 
> I do think it has been a good discussion. You might propose it as a talk
> at NANOG, RIPE, or whatever your local NOG is. Even better would be to get
> in front of web server operators, but I don’t know whether or where they
> meet.
> 

Good idea, I will investigate this further. I have been trying to find out how best to approach OWASP and the apache software foundation to try and get the discussion going with them at least. No success so far, but I’ll keep going.

daveor