• psvrh@lemmy.ca
      link
      fedilink
      English
      arrow-up
      8
      ·
      27 days ago

      “There but for the grace of god go thee.”

      Or, to be less poetic, “don’t get cocky”.

      Hacks can happen to anyone. Better lessons to learn is “don’t enable or install what you don’t need” and “keep machines you don’t trust off your local network”

  • MehBlah@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    1
    ·
    27 days ago

    I tried to roll out ipv6 when I was sysadmin for a small ISP. ARIN gave me a /32 block with no fuss. I started handing them out only to discover most routers at the time couldn’t use them. Not much has changed. No one offers them and I just turned it off at my present job. None of my windows machine have the ipv6 stack enabled.

  • jordanlund@lemmy.world
    link
    fedilink
    English
    arrow-up
    29
    arrow-down
    38
    ·
    28 days ago

    Well, not ALL Windows machines…

    “Systems are not affected if IPv6 is disabled on the target machine.”

    I can’t remember the last time I saw an IPv6 machine…

    • Brkdncr@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      2
      ·
      28 days ago

      IPv6 is enabled by default on windows. Additionally, MS does no testing against machines with ipv6 turned off. People that go through the effort of turning it off may run into problems.

    • HarriPotero@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      28 days ago

      My ISP enabled native IPv6 for me a few months back. It’s pretty great. I don’t have any windows machines, but I doubt my wife has disabled it on hers.

      Anyway, our router is set up to drop incoming IPv6 traffic by default, sanely enough.

    • BearOfaTime@lemm.ee
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      5
      ·
      28 days ago

      It’s on by default with Win10 at least.

      I disable it on all machines I build. And use GP to ensure it stays disabled.

        • BearOfaTime@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          28 days ago

          There’s just no need for it on small networks. Just another thing running that can go wrong (as it did here).

          It also contributes to increased troubleshooting when networking is acting funny, because now you have 2 stacks to consider.

    • cbarrick@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      ·
      28 days ago

      Where I work, everything is on IPv6. Both the infrastructure for the software services that we run, and our own internal corporate network.

      My ISP also provides publicly routable IPv6 prefixes over DHCP. Any layman in my city with this ISP will be on IPv6 by default.

      I also use IPv6 for my LAN.

      Like, it’s just kind of the default in my neck of the woods…

      • Trainguyrom@reddthat.com
        link
        fedilink
        English
        arrow-up
        7
        ·
        28 days ago

        I have two different ISPs offering gigabit fiber to the home, neither offers IPv6 at all. One of thes years I’ll tunnel an IPv6 prefix or two onto my network to actually get some real world experience with…

        • Archer@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          26 days ago

          ISPs nowadays tend to be either having offered 6 for years or never offered it. Not much middle ground

        • aStonedSanta@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          28 days ago

          That’s strange. Mine dual routes. So we get both. I don’t know they generally tell you the ipv6 unless you ask though as most internal networks are still using primarily ipv4

  • bruhduh@lemmy.world
    link
    fedilink
    English
    arrow-up
    38
    ·
    28 days ago

    Yay, new Xbox jailbreak method, can’t wait for new modded warfare videos about it

  • GluWu@lemm.ee
    link
    fedilink
    English
    arrow-up
    13
    arrow-down
    2
    ·
    28 days ago

    I just updated and now my audio sounds like shit.

      • GluWu@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        ·
        28 days ago

        One restart post-update restarts changed it and helped, but something was still off. Took me like 30 minutes but it looks like my nvidia HDMI audio output got reset to a really low 16 bit sample rate. Got that set back to a decent 24 bit and its closer, but something is still off. I don’t think I had any settings/levels/enchanments.

        • ColeSloth@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          6
          ·
          28 days ago

          Sounds like windows changed your audio driver. I’d download the most recent audio driver available through nvidia, then uninstall your current audio driver in device manager and manually install nvidias.

  • LaggyKar@programming.dev
    link
    fedilink
    English
    arrow-up
    19
    arrow-down
    1
    ·
    28 days ago

    This would presumably mainly be an issue for computers open to the internet. So not so much for home PCs, unless the router’s firewall is opened up.

    • r00ty@kbin.life
      link
      fedilink
      arrow-up
      16
      ·
      28 days ago

      I’ve not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it’s a problem. Depending on what most routers do in terms of IPv6 firewalling.

      My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.

      In my experience, it’s a bit hit-and-miss whether they do or not.

      Now, if this works on privacy extension addresses, it’s a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.

      If it doesn’t work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.

      Here’s the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.

      • LaggyKar@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        ·
        28 days ago

        Harvesting IP addresses shouldn’t be a problem, since the firewall shouldn’t allow packets from a peer you haven’t talked to first. But true, if you can be attacked in response by a server you’re connecting to that would be bad.

      • LarmyOfLone@lemm.ee
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        27 days ago

        What about torrenting through a VPN with IPv6? Would that make you vulnerable to this exploit?

        • r00ty@kbin.life
          link
          fedilink
          arrow-up
          3
          ·
          27 days ago

          I think it depends on all the caveats I mentioned. If it could have worked with an outgoing connection, then someone with a bad client could execute it for sure. The VPN wouldn’t protect you.

      • Toribor@corndog.social
        link
        fedilink
        English
        arrow-up
        10
        ·
        28 days ago

        IPv6 firewalls should, by default, offer similar levels of security to NAT

        I think you’re probably right. We had decades of security experts saying that NAT is not a firewall and everyone on the planet treated it like one anyway. Now we’re overexposed for a no-NAT IPV6 internet.

    • RvTV95XBeo@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      ·
      28 days ago

      For a professional sysadmin’s home network? Maybe. For the average Joe who probably has their 12-year-old toaster still connected to their wifi? I wouldn’t bank on it.

      • Malfeasant@lemm.ee
        link
        fedilink
        English
        arrow-up
        2
        ·
        26 days ago

        I did that years ago, and they said basically “never”. Then a couple years later all of a sudden, there it was.