Taking down my site on purpose:

Maurycy's Blog

View Original ↗
AI 導讀 technology infrastructure 重要性 3/5

為了打破網路被舊標準綁架的三十年僵局,有工程師決定每月6日主動關閉網站的IPv4支援。

  • 32位元的IPv4位址早於2011年耗盡,導致我們被迫依賴容易引發封鎖的共用IP技術。
  • 128位元的IPv6標準已存在近30年,卻因使用者與網站端的互相妥協而遲遲無法普及。
  • 透過每月一日的強制停機或警告橫幅,網站管理者能主動施壓ISP推動基礎設施升級。

超過 30 年前制定的 128 位元 IPv6 標準至今仍未普及,導致我們每天上網都在忍受老舊技術帶來的延遲與誤鎖。為了打破這個僵局,一位技術部落格作者決定每月 6 號主動關閉網站的 IPv4 支援。

1980年代32位元IPv4設計與2011年的位址耗盡

早在網路發展初期,工程師為了解決不同電腦網路之間的資料路由問題,必須制定一套通用的編號系統。當時的業界在 1980 年代確立了採用 32 位元IPv4(網際網路通訊協定第四版)位址格式。舉例來說,伺服器的位址通常會被拆分成四個位元組,呈現如 65.109.172.162 的形式。在那個電腦體積龐大且價格極度昂貴的年代,32 位元所能提供的約 43 億個位址看起來已經非常充足。當時的設計者根本無法想像,未來的世界會出現數以百億計的連網裝置。

這種看似充裕的設計,讓早期的網路管理者能夠以「2的次方」大小的區塊,大致按照地理位置來分配 IP 位址。這樣的作法賦予了早期網際網路極佳的擴展性,因為路由器不需要記住每一台電腦的確切細節。當你的 ISP(網際網路服務供應商)網路看到目標位址時,它不需要知道 65.109.172.162 具體對應哪一台實體機器。路由器只需要知道,所有以 65.109 開頭的封包,都應該直接發送到芬蘭即可。然而,這種為了路由效率而犧牲空間的作法,意味著我們甚至無法完全利用那 43 億個位址空間。最終的結果是,全球的 IPv4 位址已經在 2011 年被徹底分配完畢。

共用IPv4引發的網站封鎖與Captcha挑戰

為了解決位址耗盡的危機,工程師開始將多台電腦隱藏在單一個 IP 位址背後。你的家庭網路中,幾乎所有的連網設備都必須透過相當複雜的 NAT(網路位址轉換,允許多設備共用外部IP)設定,來共用一個 IPv4 位址。可惜的是,隨著連網裝置數量爆發式成長,單靠家庭層級的轉換機制已經不敷使用。

近幾年來,各大 ISP 開始採取更激進的作法,將多個不同的客戶全部放在同一個 IP 位址背後。這種做法直接摧毀了使用者在家中架設網站或主機多人遊戲等服務的可能性。更糟糕的是,這類技術甚至嚴重干擾了普通人的日常上網活動。當你瀏覽網站時,經常莫名其妙被要求填寫 Captcha(全自動區分電腦與人類的測試),或者直接看到「你已被封鎖」的錯誤訊息,甚至網頁直接拒絕載入。

遭遇這種狀況時,通常不是你的裝置出了問題,而是共用該 IP 的其他人留下了不良紀錄。曾經使用過該位址的某個人,可能正在進行惡意行為,或者更常見的情況是:他們的裝置遭到駭客入侵,在不知情的情況下成為犯罪者傳輸流量的跳板。直接封鎖特定 IP 位址,是目前網站防範網路攻擊少數有效的方法之一。這也是在不要求每個訪客都註冊帳號的前提下,唯一能夠精準阻擋特定問題來源的技術手段。

1995年標準化的128位元IPv6架構優勢

面對這個日益嚴重的問題,解決方案其實非常直觀:既然 32 位元的位址空間已經不夠用,那就改用更長的位址格式。早在 1995 年,業界就已經完成了 IPv6(網際網路通訊協定第六版)的標準化作業。新標準採用了 128 位元的設計,長度整整是 IPv4 的四倍。這套系統能夠提供高達 340 兆兆兆個獨立位址,例如 2a01:04f9:c011:841a:0000:0000:0000:0001 就是一個典型的表示方式。

除了幾乎無限的數量之外,這些更長的位址還帶來了許多架構上的實質好處。開發者不再需要頻繁依賴虛擬主機技術來共用伺服器資源,整個網際網路的位址層級結構也能夠變得更加乾淨俐落。更重要的是,網路管理者可以直接將裝置的 MAC 位址(網路卡的硬體專屬識別碼)放入一個 /64 的子網路區塊中。這種機制允許系統進行無狀態且可預測的 IP 分配,大幅簡化了區域網路的管理難度與連線效率。

卡在使用者與網站端長達30年的升級無限迴圈

既然完美的解決方案已經存在將近 30 年,歷史甚至比早期的 Gopher(1991年問世的文件搜尋協定)還要悠久,為什麼問題至今沒有解決?關鍵在於整個網路生態系統陷入了一個難以打破的惡性循環。目前絕大多數的一般使用者,仍然沒有接入支援 IPv6 的網路環境。

因為大量終端使用者缺乏支援,商業網站為了確保流量與服務可及性,被迫繼續投入資源維持古老的 IPv4 相容性。當網站端妥協後,使用者在日常上網過程中,完全不會察覺到自己缺少了任何新技術的支援。既然上網體驗看似一切正常,消費者自然不會主動向他們的 ISP 抱怨並要求升級網路設備。這導致 ISP 缺乏更新基礎設施的商業動機,最終讓使用者的網路環境繼續停留在舊時代。這個死結讓 1980 年代做出的過時決策,持續讓現代人的網路連線變得更糟且更昂貴。

每月6日強制停用IPv4支援的實體抗議行動

為了協助打破這個停滯不前的循環,作者決定採取直接的行動:主動在自己的部落格網站上移除對 IPv4 的支援。考量到完全切斷多數讀者的存取權限做法過於極端,這項限制每個月只會生效一天。從今以後,每個月的 6 號將成為該網站專屬的「IPv6 日」。在每個月的這一天,任何試圖透過 IPv4 網路存取該網站的請求,都會被重新導向至一個特定的提示頁面。訪客只會看到一則訊息,明確告知他們目前使用的網路環境,竟然還不支援一項已經問世 30 年之久的基礎標準。

如果讀者真的非常需要在 6 號當天閱讀網站內容,最簡單的解決方案是改用智慧型手機連線。目前全球主要的行動通訊電信商,早就已經跟上時代升級了基礎設施。他們深知給予每支手機獨立的 IP 位址,能夠有效提升整體的網路效能與路由效率。

單一網站的短暫停機,對於龐大的網際網路而言確實微不足道。要讓這類抗議行動產生實質影響力,必須要有夠多的網站管理者共同響應。如果你的網站或服務能夠容忍大約 97% 的上線時間,強烈建議考慮加入這種每月一日的強制升級行動。若實體停機的代價對你的業務來說難以承受,退而求其次在網頁頂端加入一個警告橫幅,提醒訪客其網路環境過於老舊,也是一種推動標準普及的有效方式。

當網站妥協於向後相容,基礎設施就失去了升級動力;透過可控的停機抗議,或許是打破三十年技術停滯的必要手段。

Abstract

If you have multiple computers, you'll quickly run into the problem of having data on one but needing it on the other. Because of this, people have been connecting them together since the beginning. However, this created a classic problem: Each network used it's own addressing scheme, wire protocol, headers, etc, etc... If you wanted to get a file between two networks, you had to find a machine that was connected to both and manually forward it. To automatically route data between networks, we had to agree on a universal numbering scheme for computers. During the 1980, people settled on the 32-bit "IPv4" address. Here's my server's address (split into bytes): 65.109.172.162 Back then, computers were massive and extremely expensive, so 32-bits was plenty: After all, there's no way there would ever be billions of computers in the world... There was enough margin to assign addresses roughly geographically and in power of 2 sized blocks. This allowed the internet to be scalable because each router doesn't have to know the exact details of every computer: When your ISPs network sees my address, it doesn't have to know that what specific computer 65.109.172.162 is, just that everything starting with 65.109 should be sent to Finland. ... but does mean that we can't even have the full 32-bits of address space. We ran out around 2011. To keep the internet working, people started hiding multiple computers behind a single address. Odds are, every single machine on your home network has to share a single IPv4 address using a rather complex "NAT" setup. ... but even this is not enough. Recently, ISPs have started putting multiple customers behind a single address. This obviously creates problems if you want to host services from home (a website, multiplayer games, etc), but is also a problem for normie activities: It's common to get punished by a website for something you didn't do. If you've ever seen a "You've been blocked" message, gotten a Captcha every time on a specific site, or simply had it mysteriously refuse to load... there's a good chance this is what's happened. Someone who had the address before you was either doing something bad — or more likely — got hacked and was used as an unwitting proxy for a criminal's traffic. Blocking by IP address is the one effective way to deal with bad actors on the internet: It's the only way to block a particular person without requiring everyone to make an account. The solution is quite simple: If we've run out of addresses that fit in 32-bits... just use longer ones. This was first standardized all the way back in 1995 with IPv6 and 128-bit addresses: four times as long as IPv4. Here's how many unique addresses that allows: 340,282,366,920,938,463,463,374,607,431,768,211,456 That's quite a bit. Here's mine: 2a01:04f9:c011:841a:0000:0000:0000:0001 These larger addresses also have a lot of other benefits: There's less need for virtual hosting, the address hierarchy can be cleaner, and it's possible put MAC addresses in a /64 block for stateless (and predictable) IP assignement. Problem solved, right? No. Despite being around for 30 years (almost as old as gopher!), most people still do not have access to an IPv6 capable network: /* HTML tags, keywords, commands */ h-n {color: #F27;} /* Values */ h-v {color: #B8F;} /* CSS selectors, attribute/varable names, file names */ h-s {color: #AEE;} /* Comments */ h-c {color: #777;} h-e {color: #F6F;} 10 Users don't have IPv6 support 20 ... so websites are forced to support (ancient) IPv4. 30 ... and users don't notice they are missing anything. 40 ... and don't complain to their ISP 50 GOTO 10 Because of this, even though the solution has existed ~forever, bad decisions from 1980 continue to make your internet connection worse and more expensive. To help break out of this cycle, I've decided to remove IPv4 support on my site. Cutting off most of my readers is a bit hash, so it'll only be disabled for one day each month: The 6th will now be IPv6 day. Any attempts to access my site over IPv4 will yield a message telling you that your network still doesn't support a 30 year old standard. If you really want to access my site during the sixth, use your phone. All major cell carriers have long since caught up with the times (because giving each device it's own address improves performance). Obviously, one website going down is just a site going down. For this to work, a lot of people have to do it. If you have a website where 97% uptime is tolerable, please consider doing this. If downtime is too much for you, how about a banner that warns about IPv4? Related: /outdated.html: The message in question. /misc/v6day/: IPv6 only link. Avoid any suprises on May 6th. https://xkcd.com/865/: The one scenario where 128 bits is not enough.