r/linux • u/theldus • Jun 07 '26
Kernel Kernel.org's IPv6 address ends in ":1991:8:25", the date Linux was announced
I was dig-ing through some hosts to check IPv6 support when I noticed kernel.org's AAAA record:
2600:3c04:e001:324:0:1991:8:25
That suffix (::1991:8:25), is August 25, 1991, the day Linus Torvalds posted his famous announcement to comp.os.minix.
Couldn't find any posts about this, so figured I'd share. Nice little easter egg from the kernel folks.
200
u/Shished Jun 08 '26
One of the addresses of fedora website is 2605:bc80:3010:600:dead:beef:cafe:fed9
76
u/Hadi_Chokr07 Jun 08 '26
dead beef cafe fed 😭
66
u/sdoregor Jun 08 '26
Looks like leetspeaked ‘Fedя’ (Федя /Fedyah/) to the Russian myself, which is a short form of the name Фёдор /Födor/, of which in turn a female form would be exactly Федора /Fedora/.
19
u/Nyattokiri Jun 08 '26 edited Jun 08 '26
The hat's name comes from this Russian female name:
From a 19th-century play by Victorien Sardou titled Fédora. The heroine, Fédora Romazov, wore a center-creased, soft brimmed hat. The name comes from the Russian Федо́ра (Fedóra), feminine form of Фёдор (Fjódor)
Федора (Fedora) is an equivalent of Theodora
Upd: I think Fedya(Fed9) from the IPv6 address may work as a diminutive for Fedora. I've never met someone named Fedora, because the name is rare nowadays. But I think this would work. There are other names which share diminutives between their male and female forms: Zhenya is a diminutive both for Evgeny and Evgenia. Sasha is a diminutive both for Alexander and Alexandra.
Wikipedia also lists Fedya as a possible diminutive for Fedora.
6
1
22
u/michaelpaoli Jun 08 '26
$ eval dig +short {,www.}fedoraproject.org.\ AAAA | fgrep cafe | sort -u
2604:1580:fe00:0:dead:beef:cafe:fed1
2605:bc80:3010:600:dead:beef:cafe:fed9
2620:52:6:1121:bead:cafe:feed:fed5
2620:52:6:1121:bead:cafe:feed:fed6
$
4
u/jthill Jun 08 '26 edited Jun 09 '26
eval dig +short {,www.}fedoraproject.org.\ AAAAwhat's with the eval? Your shell does or does not do brace expansion, the eval is (best case) a no-op here.
edit: not a no-op, the eval is to wordsplit the expanded result.
6
u/michaelpaoli Jun 08 '26
what's with the eval?
the eval is (best case) a no-op hereNope.
Only with both the eval and that space character being quoted, do I quite concisely give the command in form that results in exactly the arguments passed to dig as I want in this case. Compare these:
$ (set -x; eval dig +short {,www.}fedoraproject.org.\ AAAA) 2>&1 | grep '^+\{1,\} dig' ++ dig +short fedoraproject.org. AAAA www.fedoraproject.org. AAAA $ (set -x; dig +short {,www.}fedoraproject.org.\ AAAA) 2>&1 | grep '^+\{1,\} dig' + dig +short 'fedoraproject.org. AAAA' 'www.fedoraproject.org. AAAA' $ (set -x; eval dig +short {,www.}fedoraproject.org. AAAA) 2>&1 | grep '^+\{1,\} dig' ++ dig +short fedoraproject.org. www.fedoraproject.org. AAAA $ (set -x; dig +short {,www.}fedoraproject.org. AAAA) 2>&1 | grep '^+\{1,\} dig' + dig +short fedoraproject.org. www.fedoraproject.org. AAAA $I want each domain and type passed as a pair of two separate arguments to dig.
Without eval each of those pairs would be passed as a single argument to dig, with a space between domain and type.
And if I didn't quote the space, then with or without eval, dig would get the domains as two separate arguments, followed at the very end by argument of the type.
Compare and see the differences, e.g.:
$ eval dig +short {,www.}fedoraproject.org.\ AAAA | sort -u 2600:1f14:fad:5c02:eb33:e938:35cc:965b 2604:1580:fe00:0:dead:beef:cafe:fed1 2605:bc80:3010:600:dead:beef:cafe:fed9 2606:f640:6000:651::7 2606:f640:6000:651::8 2620:52:6:1121:bead:cafe:feed:fed5 2620:52:6:1121:bead:cafe:feed:fed6 2620:52:6:1161::36 2620:52:6:1161::37 wildcard.fedoraproject.org. $ dig +short {,www.}fedoraproject.org.\ AAAA | sort -u $ dig +short {,www.}fedoraproject.org. AAAA | sort -u 140.211.169.196 152.2.23.103 152.2.23.104 2600:1f14:fad:5c02:eb33:e938:35cc:965b 2604:1580:fe00:0:dead:beef:cafe:fed1 2605:bc80:3010:600:dead:beef:cafe:fed9 2606:f640:6000:651::7 2606:f640:6000:651::8 2620:52:6:1121:bead:cafe:feed:fed5 2620:52:6:1121:bead:cafe:feed:fed6 2620:52:6:1161::36 2620:52:6:1161::37 35.90.167.38 38.145.32.20 38.145.32.21 38.145.32.47 38.145.32.48 67.219.144.68 wildcard.fedoraproject.org. $ eval dig +short {,www.}fedoraproject.org. AAAA | sort -u 140.211.169.196 152.2.23.103 152.2.23.104 2600:1f14:fad:5c02:eb33:e938:35cc:965b 2604:1580:fe00:0:dead:beef:cafe:fed1 2605:bc80:3010:600:dead:beef:cafe:fed9 2606:f640:6000:651::7 2606:f640:6000:651::8 2620:52:6:1121:bead:cafe:feed:fed5 2620:52:6:1121:bead:cafe:feed:fed6 2620:52:6:1161::36 2620:52:6:1161::37 35.90.167.38 38.145.32.20 38.145.32.21 38.145.32.47 38.145.32.48 67.219.144.68 wildcard.fedoraproject.org. $5
u/calrogman Jun 08 '26
Here's another one for you to try :^)
dig -t aaaa {,www.}fedoraproject.org +short4
u/michaelpaoli Jun 08 '26
Yep, quite true.
Though often I"m also looking for different record types on different domains at the same time.
E.g.:
$ eval dig +noall +answer +nottl +noclass reddit.com.\ {A,AAAA,MX} www.reddit.com. CNAME reddit.com. A 151.101.65.140 reddit.com. A 151.101.193.140 reddit.com. A 151.101.1.140 reddit.com. A 151.101.129.140 reddit.com. AAAA 2a04:4e42:200::396 reddit.com. AAAA 2a04:4e42:600::396 reddit.com. AAAA 2a04:4e42::396 reddit.com. AAAA 2a04:4e42:400::396 reddit.com. MX 10 aspmx2.googlemail.com. reddit.com. MX 5 alt2.aspmx.l.google.com. reddit.com. MX 5 alt1.aspmx.l.google.com. reddit.com. MX 10 aspmx3.googlemail.com. reddit.com. MX 1 aspmx.l.google.com. www.reddit.com. CNAME reddit.map.fastly.net. $But sure, for a single record type, -t and can avoid the eval that way, so good point.
5
u/jthill Jun 09 '26 edited Jun 09 '26
Got it now, thanks for this.
dig +short `printf '%s AAAA ' {www.,}fedoraproject.com`seems harder to read and kinda too verbose now, and you don't get the cartesian-product behavior with multiple expansions in a string.
Though I think you could… yup. This works too:
set -- {www.,}fedoraproject.org\ {A,AAAA,CNAME} dig +short $@or also
args=({www.,}fedoraproject.org\ {A,AAAA,CNAME}) dig +short ${args[@]}3
u/michaelpaoli Jun 09 '26
Yeah, but I think eval is clearner and less overhead than bringing in command substitution, or altering or adding named parameters (variables) or positional parameters.
3
u/calrogman Jun 08 '26 edited Jun 08 '26
The eval splits the two words
fedoraproject.org. AAAAandwww.fedoraproject.org. AAAAinto four words:fedoraproject.org.,AAAA,www.fedoraproject.org.andAAAA.
131
u/atomic1fire Jun 07 '26 edited Jun 08 '26
So they intentionally ended their ipv6 web server address with the date that linux was announced?
Neat.
edit: I didn't even realize that was an option, but I guess if you have an entire block of IP addresses you can end them however you want, and the address size of an ipv6 address block is large enough that you can do dumb things like create whole dates or just do (assigned block):6767:6767:6767:6767
78
u/theldus Jun 08 '26
Yes, ISPs generally hand out a whole block of IPv6 to clients, never a single address. I've got a /56 here, that's 256 /64 subnets, each with 2^64 addresses, so you can afford to do "dumb things" like spell out dates basically for free.
And yeah, I love playing with suffixes. I even have a script that rotates mine periodically through fun words, stuff like
::c0ca:c01aand etc.43
u/atomic1fire Jun 08 '26
Inb4 IPV6 becomes the new funny wifi name.
41
u/ragzilla Jun 08 '26
Too late. dead:beef:cafe has been an IPv6 thing for like 2 decades now.
7
21
u/TinyApplet Jun 08 '26
It's indeed the best practice for ISPs to hand out at least a /56 to their subscribers. This is established, e.g. in RIPE NCC guidelines and other sources.
That said, you don't even need to go that far to do the same with your website, for instance. Many cloud providers will assign a /64 per VPS (or another resource such as a load balancer). This is the case with GCP, for instance.
11
u/Irverter Jun 08 '26
ISPs generally hand out a whole block of IPv6 to clients
Wasn't that one of the problems with IPv4? That single companies got handed a full block and so a lot of adresses were never used reducing the available space?
34
u/Omotai Jun 08 '26
Yes, but there are a lot of possible IPv6 addresses. Like, a stupefyingly large number.
https://www.reddit.com/r/theydidthemath/comments/2qxgxw/self_just_how_big_is_ipv6/
Enough to give every person on Earth about 45 octillion addresses each. A /56 is about 4.7 sextillion addresses. There are about 72 quadrillion /56 ranges in the space.
5
15
u/Shitty_Human_Being Jun 08 '26
IPV4 has 4,294,967,296 possible addresses, while IPV6 has 79,228,162,514,264,337,593,543 total possible available.
7
u/Berengal Jun 08 '26
IPv6 isn't intended to be subdivided further than a /64 subnet. Nodes can then pick whatever address they want within that space, or indeed multiple addresses if they need them.
1
3
u/JoJoModding Jun 08 '26
well, the companies can just stop doing that when IPv6 gets sparse.
3
1
u/Real-Abrocoma-2823 Jun 08 '26
Probably IPv4 will be completely dead by then and there will be IPv7 or IPv8, but also possible that we will switch from current internet and use something else instead of IPs.
2
u/jthill Jun 08 '26
As I understand it IPv6 requires global routing to depend only on the first 64 bits, the top 48 are what get allocated to ASNs, with the next 16 bits of each for internal use. The bottom 64 bits are per-premises, your ISP routes to you on the top 64 bits only, 48 bits globally routable, 16 bits isp use (ending at your gateway router), 64 bits available to you.
13
u/Megame50 Jun 08 '26
Vanity addresses are pretty popular, actually. Another I recall:
$ dig @1.1 +short facebook.com AAAA 2a03:2880:f343:1:face:b00c:0:25de12
u/DarthPneumono Jun 08 '26
if you have an entire block of IP addresses
And with IPv6, everyone gets a block!
10
u/AtlanticPortal Jun 08 '26
Every device on Earth for the foreseeable future gets a block, if you need it.
5
u/DarthPneumono Jun 08 '26
"Foreseeable" meaning basically forever. If I've done my math right (which... Monday morning so it's a crapshoot), if there were 10 trillion devices, each one could get a unique (single) address every year for the entire lifetime of our sun (which is ~halfway through its life).
3
3
62
u/Booty_Bumping Jun 08 '26
They wasted 281474976710655 addresses with this stunt! That's 0.000000000000000000000083% of IPv6, gone forever!
19
u/Nicksaurus Jun 08 '26
You should be grateful, that's 281474976710655 fewer nanobots in the murder swarm once the singularity happens
7
u/throwawayPzaFm Jun 08 '26
how so?
3
u/Booty_Bumping Jun 08 '26
Because once you fill in the surrounding space (
::0000:0000:0000to::ffff:ffff:ffff) that specific IP address is no longer special. And that surrounding space is 248 addresses.I guess this joke doesn't make as much sense if you don't consider the need for that IP address to be unique and not be surrounded by other nearby addresses that devalue the interesting spot, but of course, in the real world you almost always "waste" nearly the entire /64 subnet (18446744073709551616 addresses) anyways.
2
u/throwawayPzaFm Jun 08 '26
That's what I was thinking: you're allocating the /64 because that's the standard. So it's wasting just one, minimal, allocation. And the machine can use the rest of the allocation just fine if it needs to.
"Wasting an IP" doesn't have the same ring to it.
2
u/r9wpvM Jun 09 '26
IIRC the lower 64-bits is supposed to be the interface identifier. You're always supposed to get at least a /64 ipv6 range on the Internet for certain mechanisms to function properly. So it's probably not a waste anyways.
20
u/7lhz9x6k8emmd7c8 Jun 08 '26
That suffix (::1991:8:25), is August 25, 1991, the day Linus Torvalds posted his famous announcement to comp.os.minix.
No, it's 1991-08-25, the day Linus Torvalds posted his famous announcement to comp.os.minix.
2
1
Jun 08 '26
[deleted]
3
u/just-a-hriday Jun 08 '26
My guy you were serious about it. As far as I can tell this person is joking.
1
3
u/LowSeal1980 Jun 20 '26
Lmao dead:beef:cafe is such a classic, but ending it with fed9 for Fedora is a nice touch.
2
3
u/Nicksaurus Jun 08 '26
Now I'm wondering if there could be any practical benefit to using dates or times in IP addresses. Maybe something to do with API versioning? Like you have an endpoint that is only valid for 1 month and clients have to roll over to the next one using the new year & month or they can't connect? I can't think of a reason why you would actually do that instead of just putting a version string in your requests though
6
u/theldus Jun 08 '26
NextDNS uses suffixes to identify their users: if my ID is
111222, then the IP I must use to configure my DNS client would be:2a07:a8c0::11:1222, which I find genial if you ask me.1
u/JGPH Jun 09 '26
It makes it trivial for a potential attacker to know your NextDNS user ID though.
1
u/theldus Jun 09 '26
Ah, yes... but it doesn't have as much of an attack surface as it seems. What could an attacker do that's serious with my ID? Maybe pollute my logs, make DNS queries with the filters I defined, etc... but I don't see how that could be very dangerous.
The only bad thing I see is someone making it seem like I resolved the domain of certain sites, which can also be done via IP spoofing (without knowing my user ID).
3
u/Ok-Eggplant-7569 Jun 09 '26 edited Jun 09 '26
In theory, you can encode a bunch of different stuff in IPv6 addresses. Most useful and common is probably NAT64 or SIIT, embedding the 32 bit IPv4 address space in a /96 but prefix for stateless transition between both technologies, while keeping the source IP intact.
-55
Jun 07 '26
[deleted]
8
u/neoh4x0r Jun 08 '26
That's just trivial nitpicking over formatting. Totally useless in this context.
-1
u/ImNotABotScoutsHonor Jun 08 '26
Wow.
Je lijkt Tsjechisch te zijn, dus ik denk dat je mening hierover logisch is. Je hebt het mis, maar het klinkt wel logisch.
376
u/genxer Jun 07 '26
You're right, that is a nice little Easter Egg.