3 ms·

Isn't it a pretty reasonable assumption that code running on your local computer will be able to access local unauthenticated resources?

• benchaney 9y ago
  Isn't it a reasonable assumption that you won't run untrusted code on your computer without sandboxing it properly?
  • shawnz 9y ago
    Sure, but in my experience most people's idea of sandboxing does not include whitelisting access to specific IPs.
    • benchaney 9y ago
      Sandboxing means preventing the code from accessing local resources. If that requires whitelisting acces to specific IPs then so be it (although in this case there are other possible solutions).
  • mikeash 9y ago
    Are we not doing multiuser systems anymore?
    • benchaney 9y ago
      Sure we are. What does that have to do with DNS rebinding?
      • mikeash 9y ago
        I don't think it has anything to do with DNS rebinding, but it seems like it would have a lot to do with having unauthenticated RPC services bound to localhost.
        • benchaney 9y ago
          Well... > I do think that Ethereum ought to authenticate it's JSON-RPC service, but not because of DNS rebinding.
          • mikeash 9y ago
            I'm a bit lost, because right before that you described it as "reasonable assumptions about localhost" when they don't seem at all reasonable to me.