Skip to main content
added 348 characters in body
Source Link
Nick Craver Mod
  • 630.1k
  • 9
  • 79
  • 87

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

(Edit) Adding additional things as our internal chat comes up with them to make this as helpful as possible to others:

  • GeoIP databases (we have a custom implementation for speed) would need to be written and tested. Memory usage and accuracy is also a concern there.
  • Proxy IPv6to6, 4to6 (and back again?) handling for X-FF would be new.

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

(Edit) Let me clarify something important: This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

(Edit) Let me clarify something important: This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

(Edit) Adding additional things as our internal chat comes up with them to make this as helpful as possible to others:

  • GeoIP databases (we have a custom implementation for speed) would need to be written and tested. Memory usage and accuracy is also a concern there.
  • Proxy IPv6to6, 4to6 (and back again?) handling for X-FF would be new.

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

(Edit) Let me clarify something important: This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue.

added 185 characters in body
Source Link
Nick Craver Mod
  • 630.1k
  • 9
  • 79
  • 87

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

(Edit) Let me clarify something important: This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

(Edit) Let me clarify something important: This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue.

added 59 characters in body
Source Link
Nick Craver Mod
  • 630.1k
  • 9
  • 79
  • 87

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier. That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

Honest answer? We haven't gotten to it yet. It's a non-trivial time sink and we just haven't had that chunk of time to spend on it yet. It's not a high priority, or we'd allocate the (large) amount of time this requires.

Off the top of my head, here's what needs doing:

  • IP allocations (we have the blocks from ARIN already)
  • Work on all 8 ISP connections to our data centers (BGP, etc.)
  • Research everyone who'd hit us for IPv6 (for firewall rules)
  • All firewall rules need to be duplicated in IPv6 form
  • Logging everywhere we record an IP would have to change
  • Rewriting any and all code with IPv4 format assumptions (logging)
  • Rewrite of X-Forwarded-For handling
  • Expanding database fields (and adding them) for IPv6 length (let's not even talk about IPv6to4)
  • Rewriting all of the mod dashboards/tooling that query based on IP
  • Rate limiting backend code (and time buckets)
  • CDN/Proxy setup (Fastly)
  • Load balancer bindings (front and backends)
  • Load balancer ACLs

...and it's really not worth using internally. Not at our size. So we're likely talking about a 6to4 transition at the door (HAProxy). Or we go IPv6 internally and make our lives much easier and harder at the same time (it definitely goes both ways). That has a whole other set of issues again with firewalls, routing, etc.

It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future.

Source Link
Nick Craver Mod
  • 630.1k
  • 9
  • 79
  • 87
Loading