3 ms·

Can we all come together and encourage browser developers to fix their shit instead of blaming every service that makes reasonable assumptions about localhost.

Can we all come together and encourage browser developers to fix their shit instead of blaming every service that makes reasonable assumptions about localhost. I do think that Ethereum ought to authenticate it's JSON-RPC service, but not because of DNS rebinding.

shawnz 9y ago
Isn't it a pretty reasonable assumption that code running on your local computer will be able to access local unauthenticated resources?
- benchaney 9y ago
  Isn't it a reasonable assumption that you won't run untrusted code on your computer without sandboxing it properly?
  - shawnz 9y ago
    Sure, but in my experience most people's idea of sandboxing does not include whitelisting access to specific IPs.
    - benchaney 9y ago
      Sandboxing means preventing the code from accessing local resources. If that requires whitelisting acces to specific IPs then so be it (although in this case there are other possible solutions).
  - mikeash 9y ago
    Are we not doing multiuser systems anymore?
    - benchaney 9y ago
      Sure we are. What does that have to do with DNS rebinding?
      - mikeash 9y ago
        I don't think it has anything to do with DNS rebinding, but it seems like it would have a lot to do with having unauthenticated RPC services bound to localhost.
        benchaney 9y ago
        Well... > I do think that Ethereum ought to authenticate it's JSON-RPC service, but not because of DNS rebinding.
        mikeash 9y ago
        I'm a bit lost, because right before that you described it as "reasonable assumptions about localhost" when they don't seem at all reasonable to me.