Slashdot

In looking at the various logs I keep to monitor what's going on on my home network, I've noticed an interesting fact about Vista that I haven't seen published anywhere. This is something of a guess, but it's supported by the increased activity in my logs, the fact the packets are coming from the US, the User-Agent strings and the curious and regular form of most of the new IPv6 connections I've been seeing. This fact is that Vista is fairly aggressive in supporting IPv6.

Now, Windows XP supports IPv6 fairly passively right out of the box. If you put it on a network with other nodes that speak IPv6 and a router or DHCPv6 server advertising a prefix, it will happily pick it up and gain a globally routable IPv6 address. But Vista goes one step further. If it figures out that it's been assigned a globally routable IPv4 address it sets up its on 6to4 tunnel so its IPv4 address can be used to route IPv6 packets to it.

This is slightly worrisome as the IPv6 packets stuck inside the IPv4 packets represent a potential attack vector that may slide by all the filtering. But so far all the machines I've been able to portscan with some confidence that the computer at the IP I saw was still there look like they're heavily firewalled. This is better than I expected, but I did notice a different, more worrisome trend.

I expect that what firewall manufacturers will do when they learn of this is just block all IP packets with a protocol field of 41 (0x29), the IPv6 in IPv4 protocol. This is because in most Internet discussions IPv6 is treated either with "it will never happen" or "it's evil and stupid and NAT is enough". Basically, people are afraid of something new and don't want to have to learn it, so it's easier to dismiss it than embrace it.

I have some evidence that this is already happening. I think all the Vista originated 6to4 tunneled packets all have IPv6 addresses of the form 2002:hexip_upper16:hexip_lower16::hexip_upper16:hexip_lower16. When I ping the associated IPv4 address I often get a response, but when I ping the IPv6 address I don't. But I do in a very small number of cases. My guess is that something is filtering incoming IP packets with a protocol field of 41.

This means that whenever such computers try to visit my website (which has an IPv6 address) they will likely get absolutely nothing in response, or a long wait until the browser decides to fall back to IPv4.

This is actively hostile and wrong. IPv6 is happening. Learn it and get used to it. Fix your broken hardware and software. The specs have been relatively stable for the base protocol now for more than 4 years. There is no excuse for not knowing something about it.

Useful links

• The TCP/IP Guide is a ridiculously comprehensive book and includes these bits of info:
  • A whole section on IPv6: Internet Protocol Version 6 (IPv6) / IP Next Generation (IPng) (IPng was the old name for IPv6
  • And in specific, this very helpful chapter: IPV6 Global Unicast Adresss Format
• This Wikipedia entry on 6 to 4 (IPv6 inside IPv4), though this isn't all that great.
• This Cisco page on 6 to 4 gateway routers that's fairly decent but has no decent overview, just an explosion of technical details. It does talk about how ISPs should do things to better support IPv6 though, so that's helpful.
• The Numbers Resource Organization maintains a helpful page that allows you to set up a nice nameserver for doing PTR lookups of your 6to4 IPv6 addresses. Here is a link using their name: http://6to4.nro.net/. If you're running IPv6, your browser should be smart enough to go to the IPv6 version first. If it isn't, this IPv6 link should work: http://[2001:dc0:2001:7:2d0:b7ff:feb7:f7f9]/ (Slashdot (in an example of the kind of stupidity I'm talking about) mangles the href badly, so cut & paste it).

In fact, that's a big problem here. No pictures, no overview, just an explosion of technical detail. There are some sites that have an overview that are put up by the IPv6 task force, but they are so badly designed I don't want to link to them for fear of crashing someone's browser with the evilness.

Has anybody else noticed how the tagging system seems to have changed. Gone are the tags like 'fud', 'itsatrap', and 'haha'. No more 'slashvertisement' and the like either. I find the current set of tags bland and useless. They are OK for hunting down an article, but horrible for being able to tell anything about an article before you click on it.

I found 'slashvertisement' and a few of the other tags about chronic problems that the Slashdot editors tend not to acknowledge to be particularly helpful. Does anybody know how or why the tags became so bland?

So, I'm looking for a job now. My résumé is updated and I've called a few people I know. I'm curious if any of you know anybody.

Here is what I'm looking for:

Ideally someone would point me at an investor who was interested in funding CAKE development for a couple of years with possibly another couple of people. The focus would be on creating a web-service that provided various services for CAKE users, not selling CAKE itself. A business model like LJs is the idea.

Barring that, I would really like to work for a company that wasn't so interested in someone who was capable of cranking out code. I'm not any good at that. I can program well, but I'm not fast, and I'm very cautious about working with a system I don't fully understand, especially if it's not easy to play with and test. OTOH, I am pretty good at talking to people about technical stuff, talking about design, pointing out flaws in designs, and creating new ones. So, a job that focused on the latter more than the former would be good.

And here's a few bullet points:

• Working on code that was going to be published as Open Source code would be a huge plus.
• I know Python and C++ best out of all the programming languages I know.
• I would really vastly prefer working with a POSIX-like environment like Linux. :-)
• I do best when working with systems level software, not UI software

I made this LJ entry recently. If you feel inclined to comment, please do it there. I have anonymous commenting enabled. I always do. :-)

If people would like to get together anyway, despite the cancelled meetup, let's use this entry to arrange a time and place. :-) I was thinking of doing that anyway, and then droleary suggested it as well, so I'm all for it. :-)

I bought a new PowerBook as well, so I'd have a toy for people to ogle. :-)