mOSL
mOSL copied to clipboard
0xmachos
Question: disable IPv6
Quick question: does disabling IPv6 cause any problems? macOS does create IPv6 tunnels to Apple for iCloud, FindMyMac etc.
@JayBrown I have no idea. Anecdotally I have experienced no issues running with IPv6 disabled however that's far from conclusive.
A quick Google on IPv6 tunnels, I have no experience or knowledge of IPv6, says that IPv6 tunnels route IPv6 packers via IPv4 infrastructure. I assume that's used as my ISP doesn't support IPv6 and internally I've disabled IPv6 on our network infrastructure and have experienced no issues.
Some background on why I chose to disable IPv6.
I've heard and read that IPv6 stacks aren't as mature as IPv4. The implication being IPv6 stacks are more likely to have vulnerabilities than their IPv4 counterparts. How accurate that is, I'm not sure (I'd love to hear opinions and see evidence for/ against) which brings me to my second point. If you're not using it, turn it off.
Every enterprise environment I've dealt with I have had to disable IPv6. I don't know the specifics but there was some sort of conflict with old Cisco networking equipment they were using.
Input from a friend:
I’d advise against disabling it tbh. Anycast 6-to-4 is a thing of the past (automatic tunnels) and happy eyeballs prevents most fuckery.
I've re posted this question to twitter and was immediately tweeted at by this bot...
You shouldn't really disable IPv6, it's the future of the internet. #DontDisableIPv6https://t.co/r74Slgaahu
— Don't Disable IPv6 (@DontDisableIPv6) February 12, 2019
When IPv6 stops causing issues for me or I am unable to contact an important site, I’ll turn it back on, but not before. I would hope that a couple of long standing vulnerabilities are finally put to bed by then.
Sent from my iPad
-Al-
On Feb 12, 2019, at 07:50, Thomas Schäfer [email protected] wrote:
The bot is right.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.
IPv6 is problematic (OMG no NAT??). But with the state of today's quasic-DNS, "next-gen firewalls", "captive networks" (we used to it an MITM&BE attack when decrypting/reencryping public-private key encryption was transparently possible... now its... um, Security. Trust it.), add the general strangeness of partially non-routable public IPv4 addresses, and: there's nothing better or worse in IPv6 than IPv4.
It's just literally, a lot. That's all.
