3 ms·

>IP has no concept of “Internal IP addressees”. IPv4 has defined 10/8, 172.16/12, 192.168/16 as site-local (or internal). IPv6 has similar concept with fec0:/1

• tatersolid 4y ago
  Many organizations use “real” publicly routable addresses on their hosts for IPv4 (rare) and IPv6 (common), without NAT devices. Stateful firewalls don’t require the use of NAT.
• fulafel 4y ago
  Those v4 examples are really ambiguous addresses, orthogonal to local-ness. Same goes for ambiguous addresses used in CGNAT. More importantly, the complement: you don't know that a non-rfc1918 address isn't local. This is important because the latter is actually the definition the proposed "only allow non-local" use case would require. (Also fec00::/10 was deprecated 15+ years ago - there are still some special prefixes like ULA but for IPv6 their usage is marginal since there's no shortage of normal address space)
  • xxs 4y ago
    The argument was about having a concept, not ensuring any address is publicly available.
    • avianlyric 4y ago
      Only if you completely ignore the preceding discussion about same-origin policies, and how browsers can’t provide a guarantee that a host at particular IP address is a public system or an internal-only system. A host with an IP in a private range might always be internal, but a host with an IP in a public range isn’t always external. And as the stated goal is to avoid browsers being a trampoline to attack internal equipment, not being able to guarantee that a particular host is an internal host is problematic.