Management/Product/Product Engineer - When you are responsible for getting the work done then you look for any and every option to speed it up.
Owner/Platform/Senior Engineer - When you are responsible for ensuring it works and can be maintained then you have to pay attention to how to build it, aka the trade offs
You are running a machine with tons of vendor provided agents/scripts to do god knows what on a cloud provider which itself runs tons of agents/scripts to manage that infrastructure and then you expect to be secure.
And no, before the labs there was a degree of fear for everyone to hack into some one else system. With the labs changing the narrative, anyone can just blame the agents for the breach, whoever did it would only get fame and no blame
At this point it feels like they have made it a /dev/null for things which are not easy to resolve and one is still on the hook to provide some answers
This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6
> Most security conscious operators would only allow IPv4 instead of IPv6.
I strongly disagree. That's obsolete knowledge, thrown around by people who want to be considered security conscious but haven't actually updated their knowledge in many years. A statement with similar implications might be "security conscious operators require their users to rotate their passwords monthly", which is what a lot of people use to think a decade ago, and now what it really communicates is that you're talking to a dinosaur.
No, it's not. If you really want a NAT there is no reason you can't use a NAT with ipv6. In fact, it can work even better because instead of using a random port for the translation, you can use a random ip address for each connection.
Why would it be reachable? It might be name-able but that doesn't imply reachable.
You're conflating the two parts of NAT: address translation and inbound filtering. A router can block any inbound traffic coming from WAN, even if the IPv6s on the LAN side are public.
In fact, hole punching for IPv4 shows this distinction. By default inbound traffic is blocked, but as soon as private host has opened up a connection, it is (indirectly) reachable and nameable (via the routers public IP + port).
BTW, static IPv4 NAT with public addresses on both sides exists as well.
Addressable means routable. Otherwise the distinction between a Public and Private address becomes one of firewall rules rather than a meaningful property of the IP Address.
And as you say, hole punching is still “PUBLIC IP” + port. Not an IP and any port you fancy unless the firewall was configured correctly.
Maybe I am wrong, maybe you’re confused, maybe IPv6 is just rubbish. Maybe all 3.
You were asking about reachable, not routable. Of course, an address behind a firewall might be adressable and theoretically routable, but it certainly isn't reachable.
The default config of a SoHo router has both: (a) NAT44 separating public vs. private IPv4, (b) and also a firewall that blocks any unknown ingress traffic on IPv4 and IPv6.
From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts: If the firewall is in-place both IPv4 and IPv6 traffic will be blocked. If you open up the firewall (via hole punching or port forwarding on IPv4, or via IP allows for IPv6), I can send packets to your public IPv4 + port and they will arrive at you private server, or I send them to your servers GUA IPv6 and it arrives. There is no security difference.
The fact that the private IPv4 block is not globally reachable counts for something. If I accidentally give you my private IP (192.168.17.102, by the way!) you can't do anything, absent other details, no matter how much misconfiguration occurs. If I give you my IPv6 GUA, there's a lot more variability.
Like everything in IPv6 this one too is a complete pile of rubbish because it requires a central registry and “allocation” to avoid problems. Yes, seriously.
I “inherently” reachable. You can play semantics but the point stands.
> From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts
This is complete nonsense. Security is about layers and risk mitigation. You know what is better than firewall rules that can be misconfigured or overridden due to conflict or interface name changes and so on? An IP that can be addressed from global space. Wild!
What do you mean globally accessible? All the devices on my network have global IPv6 addresses for the last 5 years - since my ISP enabled IPv6 but none of them are accessible unless I configure it.
Do you ever wonder if most people don’t “see the facts” and after almost 3 decades and so much the adoption at 50% might mean to consider if the technology is just rubbish?
I do! But then I ask those people to explain how to go about doing v6 in a way that isn't rubbish, and the only answers I get to that are a) impossible, b) no answer/refuse to answer, or c) they start reinventing v6 but with weird names for everything. Or some combination of the above ("just add two octets and have a flag day" is a common one, combining (c) with (a)).
I've more or less come to the conclusion that the people who think v6 is bad don't know what they're talking about. If none of these people can come up with a better approach than v6, that suggests that v6 really is more or less the best approach available.
> after almost 3 decades and so much the adoption at 50%
I think we all wish it had been faster, but the v4->v6 transition is the first time humanity has ever done a transition like this, on this scale, involving so many disparate networks controlled by so many people in so many countries. How do you know that 50% at 3 decades is slow? Maybe this is just the par time for this kind of thing.
They key things is that pretending interoperability with IPv4 can be an after thought or dual stack is a good idea was just stupid and proven to be so. Flag day or IPv4 fading into oblivion never going to happen.
I know 50% is slow because that is LESS than new deployments over the past 3 days, so if someone thing “better” can be deployed to new projects until all old projects migrate is broken.
I've seen that draft. It's not backwards compatible in any ways that v6 isn't.
The people designing v6 knew from the start that interoperability with v4 was a requirement. It's written right into the list of requirements for v6[1], right in the same place that they say that a flag day is never going to happen.
Why do you believe otherwise? The RFC is right there for anybody, including you, to read.
You don’t understand it then. In V8 every IPv4 address is a valid address, that means you can have IPv4 and IPv8 on same IPv8-lan and first class support for translation into the protocol instead of an array of hacks is a miles better solution than the pile of rubbish that v6 is. In fact, IPv6 isn’t even a new version of IPv4, it is a different protocol entirely and a rubbish one.
Most IPv4 "security" is a side-effect of NAT. NAT was not intended as a security feature, but it does provide a level of security in the common consumer implementation (PAT, single external IP, unroutable internal network.)
There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.
But if you've ever had to deal with endpoint security, if you're just doing static rule based blocking/throttling, /32 or /24 blocking is often your best option. Thanks to CGNAT this often means having a pretty large impact since an ISP's residential customer might end up getting randomly assigned a "bad" address and the cooldown for these rules is often months long or more.
In IPv6 land, you can just block a /128 or even a /64 and rarely hit anyone else in the crossfire.
Blocking /128 is unlikely to block anyone for very long around here. Both the major ISPs give out /56 blocks with prefix delegation. In almost 4 years, mine hasn't changed.
My working theory is that being able to understand a detail answer itself requires a certain level of understanding for that topic. In that absence of that it would throw off a big crowd which was hoping to find something simpler, something that aligns with their existing understanding easily.
There is a cost to produce something based on raw materials and then the possible price you can charge from the customer based on demand and supply.
The term Value is pretty vague here. Its more of a perceived value so its hard to put a number against it, there is no direct way to translate it to something more concrete.
May be bit orthogonal, one way I can think of it is to map to physical needs like clothing, housing, food and medicine?
It is really only the perceived value which matters to a business - that's the value at which you can sell or replace your asset on the market. Offers above that price, you sell (and replace if needed). Offers below that price, you don't.
If it costs more to produce (and sell) the asset than you can sell it for, you're losing money and assets go down. If it costs the same, then in this example the net change in S&P assets would be zero.
> there is no direct way to translate it to something more concrete.
There's an incredibly easy way to do that, sell it.
If Nvidia takes $20 of parts and sells it for $100, they created $80 of value. If we had VAT, that's what would be taxed (minus things like r and d but, for simplicity...).
that definitely $80 of value for Nvidia added but does it really added something to whole system? if some physical goods moved from one company to another with generation of VAT, does it really add up to economy as whole or just one seller made bad decision and loosed some $, other gained few $ but overall balance of value just still same.
I don't want to pick on you but this is a major pet peeve of mine. A lot of people view the economy as a fixed size of value. As a result, when someone is a millionaire, they consider that million dollars to be something extracted from others. That's a very Feudal view of economics. What's usually the case is that millionaire add a million dollars of value by creating a more valuable product from raw materials.
This example is an easy example. Before Nvidia, there was just a pile of silicon and copper worth $20. It doesn't take $80 to turn that thing into something that is worth $100. The value within the economy increased.
Most of economic activity is growth. There is economic activity that isn't growth, which is what rent-seeking is.
I think it exactly what I'm trying to say. Current state is that GPUs that Nvidia produced are not really in use, they mostly stored in warehouses as is not enough power for them so while they has 'potential future value' it's not proven to be created as lot could happen, unlikely natural disaster or they just could loose in value as demand drops or competitor will came with cheaper option.
Yes, values are inherently speculative - the S&P is just measuring current market values though - something like the market consensus of the net present value (profits further in the future are treated as less valuable than profits today). As this consensus changes, the S&P goes up and down.
In a company as big as Anthropic, moving at current pace, the person/team writing this article and the team(s) collecting data would be way distant. It should be more than obvious that the data is being collected in not just one place but many (different teams are looking for different gems in that data). What part is used for training, how and when would be spread across the company way too wide for anyone to confirm with certainity.
On the IP side, About 6 months ago I used Claude to help me draft a patent application for something which I believed was novel, I verified in the USPTO as well. Then out of being busy I dropped that idea. Couple weeks ago I picked up the work again, verified with Claude for the problem statement to see if there is any existing solution. It suggested my own solution back to me which was surprising since I only use in browser and delete the history explicitly. I asked it for references or resources and it could not find any. That helped me to understand the boundaries bit better.
I have noticed this as well, when it can't help me and I thought it might be a difference in models, or using the same account somehow (tried a different one).
These models may not train directly on my chats and data, but in some cases it does seem to keep an impression of the pattern and process.
reply