While debugging some issues in some system Claude refused to write test case because it broke terms of use.

Oh shit, all this fantastic technology is in hands of corporations and they get to decide what we’re allowed to use it for.

The availability of GitHub is still at 0% - it can't be reached over IPv6.

> not fully compatible with OpenBSD one

The OpenBSD NAT and scrub syntax, and af-to are available in FreeBSD 15.

Even with IPv6 you still might have stateful firewalls allowing only for outbound connection at both ends (e.g. a CPE a.k.a. “WiFi router”) and to establish communication you’d need to punch a hole in those firewalls.

That’s true we won’t get rid of hole-punching with IPv6. But at least it will get rid of TURN.

The hole punching is so much simpler because you don't need to guess your own address and port - you just know it

IPv6 still allows proper NAT (prefix translation), but even then finding your global address wouldn’t need TURN, just STUN, actually not even that, just a service like “What’s My IP.”

It does allow it in the sense that it's possible, and even useful in some scenarios, but then you're on a weird experimental network and not a normal one.

Yes, you are right, quite literally, as RFC 6296 is marked ‘experimental.’

Doesn't that assume that your machine is given its own world-routable (and unfiltered) v6 address?

That's how it works in ipv6. If your network doesn't give you an address, it's broken. We do not assume unfiltered since we are talking about hole punching.

How will it get rid of TURN? Can't IPv6 addresses still be firewalled by your carrier like they do already for IPv4?

I thought TURN was for symmetrical PAT, not for proper NAT (which just needs STUN for address determination) or full/restricted cone PATs (which need STUN for address and port determination, and then, in case of restricted cone, performs a hole punch).

Standard-conforming IPv6 at most allows prefix translation (i.e., proper NAT, not PAT), which wouldn’t need it.

> just like almost all transportation is done today via cars instead of horses.

That sounds very Usanian. In the meantime transportation in around me is done on foot, bicycle, bus, tram, metro, train and cars. There are good use cases for each method including the car. If you really want to use an automotive analogy, then sure, LLMs can be like cars. I've seen cities made for cars instead of humans, and they are a horrible place to live.

Signed, a person who totally gets good results from coding with LLMs. Sometimes, maybe even often.

It should always be at 0, because GitHub is unreachable over IPv6, which in 2025 should be considered an incident.

mobile adoption is high, desktop (residential and corporate) is still quite low.

I'm a big advocate for github to add ipv6 support , but let's not pretend it's critical for their business.

Aren't there serveral hosts now where IPv6 access is included but you have to pay for each attached IPv4? E.g. AWS and Hetzner

Yep

just a few hours ago we found a pretty nice residential desktop use case for proper v6 (with prefix delegation), due to no need for NAT the old router (2013) became less of a bottleneck!

Double check (I mean by remote port scan) that your firewall is working. I’ve seen routers with no IPv6 firewall . And it actually matters

I haven’t had a residential ISP that provided IPv6 yet.

"yeah but when I turn on ipv6 everything breaks"

I did traffic shaping per user for a few hundred users on 1GHz Pentium III on Linux. It can be done just fine.

> On what's now almost 10 year old hardware, we could drop 44Mpps of a volumetric DOS attack and still serve our nominal workload with no impact.

Was filtering done with pf, ipfw or some custom firewall?

> How do you avoid this

IPv6 of course.

> or is it just not important

Port knocking not a security feature anyway.

Making my web resources IPv6-only has solved the problem for me. I don’t consider this a solution for ever, but for now it’s apparently way too modern or complicated for the A-so-called-I companies.

In my experience managing a number of IPv6-only sites for clients, they still get crawled and abused, and this goes back years. If anything, it has gotten worse now with all the LLM/AI nonsense.