3 ms·

Restricting such requests can be a good idea, but it should be user configurable (e.g. in case you want to redirect some requests to your own implementations),

Restricting such requests can be a good idea, but it should be user configurable (e.g. in case you want to redirect some requests to your own implementations), and whether or not it is allowed should have nothing to do with whether or not TLS is used (it means HTTP vs HTTPS, but really that is irrelevant to this issue, which is a different issue). Furthermore, if you do not explicitly type a localhost URL or IP address, it should also block access to stuff on localhost or local networks, again it should be user configurable though in case you want to enable specific cases.

mattowen_uk 5y ago
Ok, so I have a dynamic page hosted externally. It's set as my homepage on all my browsers. It's full of links to things I use. Some of those links are on my internal network, and are NOT https (seriously, for small things/apps you don't need it). If I understand this correctly, Chrome will now block me clicking on these links? I'm all for improving browser security, but as an end user, I should have the option to turn settings off that cause me a problem.
- southerntofu 5y ago
  > Some of those links are on my internal network (...) Chrome will now block me clicking on these links? Unless i missed something, you will still be able to click links. Chrome will block the original page from running queries without your consent to your local networks, eg. a javascript bit trying to find a vulnerable router/crapware on your local network.
- zzo38computer 5y ago
  > I'm all for improving browser security, but as an end user, I should have the option to turn settings off that cause me a problem. I agree. I will want to configure a lot of things. However, allowing finer configuration can also be helpful; you might not want to turn off that feature entirely. (For example, maybe if you want to assign that dynamic page to the local zone (if such a thing is possible; the article says something else, though) even if it isn't local, then it will be able to work such links.)

mattowen_uk 5y ago

Ok, so I have a dynamic page hosted externally. It's set as my homepage on all my browsers. It's full of links to things I use. Some of those links are on my internal network, and are NOT https (seriously, for small things/apps you don't need it). If I understand this correctly, Chrome will now block me clicking on these links? I'm all for improving browser security, but as an end user, I should have the option to turn settings off that cause me a problem.

southerntofu 5y ago
> Some of those links are on my internal network (...) Chrome will now block me clicking on these links? Unless i missed something, you will still be able to click links. Chrome will block the original page from running queries without your consent to your local networks, eg. a javascript bit trying to find a vulnerable router/crapware on your local network.
zzo38computer 5y ago
> I'm all for improving browser security, but as an end user, I should have the option to turn settings off that cause me a problem. I agree. I will want to configure a lot of things. However, allowing finer configuration can also be helpful; you might not want to turn off that feature entirely. (For example, maybe if you want to assign that dynamic page to the local zone (if such a thing is possible; the article says something else, though) even if it isn't local, then it will be able to work such links.)