Hacker News new | past | comments | ask | show | jobs | submit
it should probably link to this: https://mullvad.net/en/blog/exit-ip-fingerprinting-between-v...

which is the blog post, rather than a list of exit servers

related to this post: https://news.ycombinator.com/item?id=48143880

That blog post is a perfect example of when RFC5737 should be used.

https://datatracker.ietf.org/doc/rfc5737/

Nice. But unfortunately these addresses are hard to remember and "nobody" recognizes them when reading examples. One of those "standards" that have been a great idea, but lack practical relevance.
> But unfortunately these addresses are hard to remember and "nobody" recognizes them when reading examples.

How does that matter? The point isn't that the reader should know that "oh, this is a reserved address". The point is that there should be no room for the address that's actually being used by someone to end up being used incorrectly just because it showed up in some random documentation.

Much like how you probably wouldn't be thrilled if your phone number was used as an example in some random documentation somewhere.

For me it's the opposite: I usually misremember 192.0.0.0/8 as being entirely private, so for 192.0.2.0/32, I usually assume that the example given is supposed to be a private v4 address/network.
Anyone who writes technical documentation about networking knows the key ranges, and at least TEST-NET-1 (192.0.2/24) is pretty easy to remember. You only gotta look it up a few times, instead of being sloppy and justifying so with “no one cares anyway”.

It partly because attitudes like that is why software is a mess. Too few people care about correct semantics, everyone is satisfied with whatever sticks. From lists for sets, to tag soup instead of markup, and so on - all the way to modern code slop.

</rant>

> But unfortunately these addresses are hard to remember and "nobody" recognizes them when reading examples.

Mmm.

It's pretty easy to put three IPv4 /24s on a sticky note on your monitor. I think it's not unfair to say that if one can remember every fact related to one's job, then one has a job with a very, very small scope.

Also, this is another great reason to use IPv6. The v6 documentation prefix is '2001:db8::/32'... plenty of space for example subnets and easy to remember.

On a side note, buttons icons on this page won't load without javascript. I cannot comprehend what would justify such decision.
Without justifying it, the reason is simple. They are using a front end framework (bootstrap) that many developers use/understand that also supports 99.9% of browsers.

Running a browser without javascript that you still want graphics to display (so not a screenreader or text-based-browser), is part of the .1% they are willing to disappoint.

Do I think it is overkill? Sure. Do I still use jQuery at work even though the vast majority of its once handy features are now baked into JS in the browser by default? Of course.

How do you jump straight from JS to screen reader or text based browser? What happened to HTML+CSS viewer? Isn't reading an RFC the perfect poster child for an activity that ought to consist of viewing a noninteractive document?
It’ll be a run-on effect of whatever framework they are using, and they very justifiably don’t want to bother catering to you. Having JS disabled in 2026 and complaining about sites not behaving is simply a performative act.
2015: It's a SPA blog because my employer forced me to do it that way, I didn't want it.

2026: It's a SPA blog because I very justifiably don't want to bother catering to you. Having JS disabled in 2026 and complaining about sites not behaving is simply a performative act.

>and they very justifiably don’t want to bother catering to you

Considering they are one of the very few sites and VPNs that allow sign up without JS your claim is verifiably false. They also collaborate with and develop there own tor browser fork which has the highest rate of non JS user.

It’s basic self defense. Who runs around the web in 2026 allowing random JS? Might as well be licking seats on the subway.
> Who runs around the web in 2026 allowing random JS?

Within a rounding error, 100% of people on the internet.

If you trust your browser it's fine, and if you don't then both CSS and SVG are significantly more risky.
This isn't true at all.

Anything SVG does maliciously, it does by containing JavaScript, so SVG's worst case is a subset of JS's.

Remind me again what the ratio of browser sandbox escapes coupled with full RCE is between JS, CSS, and SVG?
> then both CSS and SVG are significantly more risky.

how???

What "buttons icons"? When I set the "javascript.enabled" preference in Firefox 151 to "false" and reload the page for RFC 5737, I get a "Javascript disabled? Blah blah blah blah." complaint near the top of the page. I do not get

* the useless-to-me "document history" bar graph at the top

* the automatic switch to Dark Mode(TM) that I don't care about

* functional pull down menus at the very tippy top of the page that are entirely unrelated to RFCs that I give zero shits about

The "without javascript" version of the page seems to me to be otherwise identical. Amusingly, the "Email authors", "IPR", & etc buttons switch to the pages they reference notably faster with Javascript disabled.

What broken things were you seeing that I haven't mentioned? Were you using Chrom(e|ium)? Safari?

> I set the "javascript.enabled" preference in Firefox 151 to "false" and reload the page

Do it the other way around - disable javascript first, clear cache/open incognito (maybe close/open browser after that just for good measure), then go to the page.

If you load it with javascript first - buttons icons stay loaded after you disable it.

Are you in 2006 or 2026?
The page already contains link to both of these resources
right. but one of those resources contains much more context than the other, making it much more suitable for the submission link.
The post you preferred was submitted before. And had not much new information. The rollout was the news. The link was correct.
loading story #48279894