This change can't come soon enough. My only objection is that the rollout is way too slow, and the first step is only a baby step. What we have now is essential

This change can't come soon enough. My only objection is that the rollout is way too slow, and the first step is only a baby step. What we have now is essential a 0day situation. Unfortunately a lot of commenters completely misunderstand the proposal, as well as the attacks it is designed to mitigate. Here's a good paper describing the issue, "Attacking the internal network from the public Internet using a browser as a proxy": https://www.forcepoint.com/sites/default/files/resources/files/report-attacking-internal-network-en_0.pdf https://www.forcepoint.com/sites/default/files/resources/fil... The "HTTPS" part of Google's proposal is a bit of a red herring, as I said, only a baby step. It does not mean that your local services have to be https. It just means that public http sites can't make requests to local IP addresses.