3 ms·

All apps + the web browser being able to communicate freely over a shared localhost interface is such a glaring security hole that I'm surprised both iOS and An

by paxys 1y ago

All apps + the web browser being able to communicate freely over a shared localhost interface is such a glaring security hole that I'm surprised both iOS and Android allow it. What even is a legitimate use case for an app starting a local web server?

dylan604 1y ago
Which begs the question why is this specific to Android? Why would Meta/Yandex not be doing this on iOS, or why did this study not report on iOS?
- mig39 1y ago
  Doesn't iOS prompt you to give apps permission to connect to your local network? "App would like to find and connect to devices on your local network" or something along those lines. I always hit the "no thanks" button.
  - paxys 1y ago
    In this case it's the web browser connecting to the network, so the permission is irrelevant.
    - deleted 1y ago
      [deleted]
JimDabell 1y ago
> What even is a legitimate use case for an app starting a local web server? There are apps on iOS that act as shared drives that you can attach via WebDAV. This requires listening on a port for inbound WebDAV (HTTP) requests.
- codedokode 1y ago
  They don't need to listen on localhost though.
johnny22 1y ago
I expose a LAN accessible status board from an app via HTTP. The app runs completely offline, thus I can't rely on something hosted on the public internet. My last electron app did effectively the same thing. I took the hosted version of my app and bundled in electron for offline usage with the bundled app being just a normal web application started by electron.
- camtarn 1y ago
  I'm not sure I get it. Why isn't the status board just part of the app itself - why does it need to be accessed via browser?
hamburglar 1y ago
A long time ago I used it to work around an iOS limitation that prevented apps from simultaneously streaming audio and caching it. You could give the media player a URL for a remote stream, but you couldn’t read the same stream. The alternative was to get the stream yourself and implement your own media player. I didn’t want to write my own media player, so I requested the stream myself in order to cache it, plus fed it back to the OS media player via localhost http. Total hack, but it worked great. I wonder if they ever took that code out. It’s got hundreds of millions of installs at this point.

by paxys 1y ago

dylan604 1y ago

Which begs the question why is this specific to Android? Why would Meta/Yandex not be doing this on iOS, or why did this study not report on iOS?

mig39 1y ago
Doesn't iOS prompt you to give apps permission to connect to your local network? "App would like to find and connect to devices on your local network" or something along those lines. I always hit the "no thanks" button.
- paxys 1y ago
  In this case it's the web browser connecting to the network, so the permission is irrelevant.
  - deleted 1y ago
    [deleted]

JimDabell 1y ago

> What even is a legitimate use case for an app starting a local web server? There are apps on iOS that act as shared drives that you can attach via WebDAV. This requires listening on a port for inbound WebDAV (HTTP) requests.

codedokode 1y ago
They don't need to listen on localhost though.

johnny22 1y ago

I expose a LAN accessible status board from an app via HTTP. The app runs completely offline, thus I can't rely on something hosted on the public internet. My last electron app did effectively the same thing. I took the hosted version of my app and bundled in electron for offline usage with the bundled app being just a normal web application started by electron.

camtarn 1y ago
I'm not sure I get it. Why isn't the status board just part of the app itself - why does it need to be accessed via browser?

hamburglar 1y ago

A long time ago I used it to work around an iOS limitation that prevented apps from simultaneously streaming audio and caching it. You could give the media player a URL for a remote stream, but you couldn’t read the same stream. The alternative was to get the stream yourself and implement your own media player. I didn’t want to write my own media player, so I requested the stream myself in order to cache it, plus fed it back to the OS media player via localhost http. Total hack, but it worked great. I wonder if they ever took that code out. It’s got hundreds of millions of installs at this point.