• 1 Post
  • 303 Comments
Joined 11 months ago
cake
Cake day: August 9th, 2023

help-circle


  • Nuclear is nothing bog standard. If it was, it wouldn’t take 10 years. Almost every plant is a boutique job that requires lots of specialists. The Westinghouse AP1000 reactor design was meant to get around this. It didn’t.

    The experts can stay where they are: maintaining existing nuclear power.

    Renewables don’t take much skilled labor at all. It’s putting solar panels on racks in a field, or hoisting wind blades up a tower (crane operation is a specialty, but not on the level of nuclear engineering).


  • Then we just move the problem. Why should we do something that’s going to take longer and use more labor? Especially skilled labor.

    Money is an imperfect proxy for the underlying resources in many ways, but it about lines up in this case. To force the issue, there would have to be a compelling reason beyond straight money.

    That reason ain’t getting to 100% clean energy in a short time. There is another: building plants to use up existing waste rather than burying it.





  • No, you just pay out the nose up front.

    If I had money to invest in the energy sector, I don’t know why I should pick nuclear. It’s going to double its budget and take 10 years before I see a dime of return. Possibly none if it can’t secure funding for the budget overrun, as all my initial investment will be spent.

    A solar or wind farm will take 6-12 months and likely come in at or close to its budget. Why the hell would I choose nuclear?







  • You can get exactly the same benefit by blocking non-established/non-related connections on your firewall. NAT does nothing to help security.

    Edit: BTW–every time I see this response of “NAT can prevent external access”, I severely question the poster’s networking knowledge. Like to the level where I wonder how you manage to config a home router correctly. Or maybe it’s the way home routers present the interface that leads people to believe the two functions are intertwined when they aren’t.


  • Governments are not anyone’s issue other than other governments. If your threat model is state actors, you’re SOL either way.

    That’s a silly way to look at it. Governments can be spying on a block of people at once, or just the one person they actually care about. One is clearly preferable.

    Again, the obscurity benefit of NAT is so small that literally any cost outweighs it.

    I don’t see where you get a cost from it.

    • Firewall rules are more complicated
    • Firewall code is more complicated
    • Firewall hardware has to be beefier to handle it
    • NAT introduces more latency
    • CGNAT introduces even more latency
    • It introduces extra surface area for bugs in the firewall code. Some security related, some not. (I have one NAT firewall that doesn’t want to setup the hairpin correctly for some reason, meaning we have to do a bunch of workarounds using DNS).
    • Lots of applications have to jump through hoops to make it through NAT, such as VoIP services
    • Those hoops sometimes make things more susceptible to snooping; Vonage VoIP, for example, has to use a central server cluster to keep connections open to end users, which is the perfect point to install snooping (and this has happened)
    • . . . and that centralization makes the whole system more expensive and less reliable
    • A bunch of apps just never get built or deployed en masse because they would require direct addressing to work; stuff like a P2P instant messenger
    • Running hosted games with two people behind NAT and two people on the external network gets really complicated
    • . . . something the industry has “fixed” by having “live service” games. In other words, centralized servers.
    • TLS has a field for “Server Name Indication” (SNI) that sends the server name in plaintext. Without going far into the details, this makes it easier for the ISP to know what server you’re asking for, and it exists for reasons directly related to IPv4 sticking around because of NAT. Widespread TLS use would never have been feasible without this compromise as long as we’re stuck with IPv4.

    We forced decisions into a more centralized, less private Internet for reasons that can be traced directly to NAT.

    If you want to hide your hosts, just block non-established, non-related incoming connections at your firewall. NAT does not help anything besides extending IPv4’s life.



  • So instead we open up a bunch of other issues.

    With CGNAT, governments still spy on individual addresses when they want. Since those individual addresses now cover a whole bunch of people, they effectively spy on large groups, most of whom have nothing to do with whatever they’re investigating. At least with IPv6, it’d be targetted.

    NAT obscurity comes at a cost. Its gain is so little that even a small cost eliminates its benefit.



  • It wasn’t designed for a security purpose in the first place. So turn the question around: why does NAT make a network more secure at all?

    The answer is that it doesn’t. Firewalls work fine without NAT. Better, in fact, because NAT itself is a complication firewalls have to deal with, and complications are the enemy of security. The benefits of obfuscating hosts behind the firewall is speculative and doesn’t outweigh other benefits of end to end addressing.