The Internet's Long Transition: Google Tips IPv6 Past 50 Percent

Google has officially reached 50 percent IPv6 adoption across its traffic, according to APNIC's blog — a milestone that has been decades in the making. IPv4, the original internet addressing system designed in the early 1980s, provided roughly 4.3 billion unique addresses. IPv6, its successor, offers 340 undecillion addresses, a figure so large it is effectively inexhaustible. The transition has nonetheless crawled forward for years, stalled by a classic economic coordination problem: ISPs saw no incentive to upgrade until major content providers supported IPv6, and content providers saw no incentive until ISPs did.

Google crossing the majority threshold shifts that calculus for network operators worldwide. Regional adoption, however, remains sharply uneven. Countries like Belgium and India reportedly exceed 70 percent IPv6 adoption, while large parts of Southeast Asia and Africa remain predominantly IPv4. The remaining bottleneck, according to observers in the Hacker News discussion, is residential ISP upgrade cycles rather than any technical barrier. Business networks, somewhat counterintuitively, tend to lag behind consumer networks because enterprise IT departments are more conservative about changes that could affect uptime.

There is also a performance dimension. IPv6 connections are often faster than their IPv4 equivalents — not because the protocol itself is inherently quicker, but because IPv6 traffic frequently takes more direct routes and eliminates the overhead of Network Address Translation, the workaround that has kept IPv4 viable long past its address-space limits. At scale, removing NAT layers produces measurable latency improvements.

Separately, a 2019 article titled 'Developers Don't Understand CORS' reached 226 points and 133 comments on Hacker News this week — remarkable longevity for a seven-year-old piece. CORS, or Cross-Origin Resource Sharing, is the browser mechanism controlling which web origins can make requests to which servers. The article's core argument is that most developers have the mental model inverted: CORS protects the user from malicious websites, enforced by the browser, not the server from malicious clients. The server merely declares its preferences. Comments from engineers with years of experience admitted they had held the wrong model for a long time, and the discussion attributed persistent confusion partly to browser error messages that fail to surface whether a preflight request failed, whether headers were wrong, or whether credentialed request handling was the culprit.