3 ms·

Sure, but this record goes to 127.0.0.1. How would I get the IP of your development server other than 127.0.0.1? When you request local.computer, it's not sen

by jonpugh 10y ago

Sure, but this record goes to 127.0.0.1. How would I get the IP of your development server other than 127.0.0.1? When you request local.computer, it's not sending me your IP, it's requesting one. Right? Public DNS for a private IP doesn't get me anything I don't already know, right?

smt88 10y ago
I'm not a security expert, so my answers are not going to be exhaustive and may be incorrect. The bottom line is that trusting someone else with the DNS records for a development server is pointless and comes with some risk. Use it yourself if you want, but there's no reason other people should trust their security to a stranger who may have poor security practices (insecure password for registrar's website, for example). I mentioned that public DNS is for networking only to point out that there's a mismatch here between the problem and the solution, but there are still attack vectors here. One vector would be your ability to intercept anything that's being sent to the development server by a browser or IDE, which could include debug information, API keys, fragments of the stack, or even chunks of source code. It depends on the tools the developer is using. > How would I get the IP of your development server other than 127.0.0.1? The client IP. Many default configurations of local servers will use or bridge port 80, which means external requests will be routed to the local development server. The client IP, as well as permissive firewall settings, would allow an attacker to access the development server. > When you request local.computer, it's not sending me your IP, it's requesting one. With a very low TTL, you could still get the client IP pretty reliably. This is how DNS rebinding attacks work.
- jonpugh 10y ago
  I never suggested using the domain for anything but web browser requests, not sure why anyone would need to use it to connect in any other way. So as long as users don't use it for connecting to their local server are they safe? Don't most people connect to local servers via Vagrant or docker shared volumes, anyway? Not sure why anyone would use it for accessing their local machine when there are existing methods for that. Thanks for the details.
  - 8thom 10y ago
    Another option is to use dynamic DNS service like - http://www.noip.com http://www.noip.com IIRC they also supports wildcard subdomains. I've recently started to add a local. record to the DNS of the project which points to the statically defined local Vagrant IP, as you often need to add dev and staging records anyway.

by jonpugh 10y ago

smt88 10y ago

I'm not a security expert, so my answers are not going to be exhaustive and may be incorrect. The bottom line is that trusting someone else with the DNS records for a development server is pointless and comes with some risk. Use it yourself if you want, but there's no reason other people should trust their security to a stranger who may have poor security practices (insecure password for registrar's website, for example). I mentioned that public DNS is for networking only to point out that there's a mismatch here between the problem and the solution, but there are still attack vectors here. One vector would be your ability to intercept anything that's being sent to the development server by a browser or IDE, which could include debug information, API keys, fragments of the stack, or even chunks of source code. It depends on the tools the developer is using. > How would I get the IP of your development server other than 127.0.0.1? The client IP. Many default configurations of local servers will use or bridge port 80, which means external requests will be routed to the local development server. The client IP, as well as permissive firewall settings, would allow an attacker to access the development server. > When you request local.computer, it's not sending me your IP, it's requesting one. With a very low TTL, you could still get the client IP pretty reliably. This is how DNS rebinding attacks work.

jonpugh 10y ago
I never suggested using the domain for anything but web browser requests, not sure why anyone would need to use it to connect in any other way. So as long as users don't use it for connecting to their local server are they safe? Don't most people connect to local servers via Vagrant or docker shared volumes, anyway? Not sure why anyone would use it for accessing their local machine when there are existing methods for that. Thanks for the details.
- 8thom 10y ago
  Another option is to use dynamic DNS service like - http://www.noip.com http://www.noip.com IIRC they also supports wildcard subdomains. I've recently started to add a local. record to the DNS of the project which points to the statically defined local Vagrant IP, as you often need to add dev and staging records anyway.