Somewhere in your code
there is a column
fifteen characters wide.
It holds an IP address.
Somebody sized it
by counting the characters
in the longest address they could picture,
four numbers,
three dots.
Beside it lives a validator
that checks for exactly that shape,
and a rate limiter
that counts requests per address,
and an allowlist in a config file
written in the same four numbers.
All of it was correct
for the network
you learned on.
The network is moving.
Close to half the people
who reach Google
now arrive over IPv6,
by Google's own count.
Large mobile carriers
run their phones on IPv6 only,
and translate at the edge
for the old world.
Apple has required apps
to work on an IPv6 only network
since 2016.
And the old addresses
have become a thing you rent.
The big cloud providers
started charging by the hour
for every public IPv4 address
you hold.
Nothing about this
arrives as an outage.
It arrives as small wrongness.
A new address,
thirty nine characters long,
cut off by the column,
so the log shows a user
who does not exist.
A validator that rejects
a perfectly good customer
as malformed input.
A partner allowlist
that lets the office in
and refuses the phone
in the same person's hand.
And the rate limiter,
which is the quiet one.
With IPv6, a single household
is commonly given
more addresses
than the whole of the old internet.
Counting per address
now counts nothing.
Somebody can take a fresh address
for every request,
and your limit will watch
each one politely
as a first time visitor.
So stop treating an address
as a string with dots in it.
Store it in the type
your database has for addresses.
Parse it with the library,
never with a pattern you wrote.
Limit by the network prefix,
not by the single address.
Write allowlists as ranges
in both families.
Then find out for real.
Put a laptop on a network
with no IPv4 at all,
or tether it to a phone
on a carrier that runs that way,
and walk through your main flow.
Sign in. Pay. Upload.
Call the partner.
The failures you find
are already happening
to somebody,
on a network
you never tested from,
and none of them
will ever call it an outage.
– Serguey Asael Shinder
Top comments (0)