10 ms·
It seems like an obvious measure would be for sites served outside the private-use or loopback ranges to be unable to request content from servers in private-us
by boomlinde 7y ago
It seems like an obvious measure would be for sites served outside the private-use or loopback ranges to be unable to request content from servers in private-use or loopback ranges.
> Did you know, some very large enterprise environments squat on public IP's for private intranet internally due to address space exhaustion (IPv4 anyway)?
Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look.
- linuxftw 7y agoMy preferred solution would be to disable javascript altogether. > Sucks to be them. If they've exhausted their private use IPv4 addresses, they can either rest comfortably knowing that NAT and IPv6 can solve their problem or they can ignore IETF recommendations and build a card house network that breaks if you give it a stern look. This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever.
- boomlinde 7y ago> My preferred solution would be to disable javascript altogether. My preferred solution would be not to use web browsers at all, but our preferred solutions are much harder to make a case for than a simple security policy. > This will only lead to organizations running IE7 (or whatever outdated IE version is most common now) forever. In general, let's let them make that choice, but this could be configurable in the browser in the same way Javascript and cookie policy exceptions are handled.