15 ms·

A proposal to restrict sites from accessing a users’ local network

680 points by doener 1y ago

owebmaster 1y ago
I propose restricting android apps, not websites.
- jeroenhd 1y ago
  Android apps need UDP port binding to function. You can't do QUIC without UDP. Of course you can (should) restrict localhost bound ports to the namespaces of individual apps, but there is no easy solution to this problem at the moment. If you rely on users having to click "yes", then you're just making phones harder to use because everyone still using Facebook or Instagram will just click whatever buttons make the app work. On the other hand, I have yet to come up with a good reason why arbitrary websites need to set up direct connections to devices within the local network. There's the IPv6 argument against the proposed measures, which requires work to determine if an address is local or global, but that's also much more difficult to enumerate than the IPv4 space that some websites try to scan. That doesn't mean IPv4 address shouldn't be protected at all, either. Even with an IPv6-shaped hole, blocking local networks (both IPv4 and local IPv6) by default makes sense for websites originating from outside. IE did something very similar to this decades ago. They also had a system for displaying details about websites' privacy policies and data sharing. It's almost disheartening to see we're trying to come up with solutions to these problems again.
- bmacho 1y ago
  Android apps obviously shouldn't be able to just open or read a global communication channel on your device. But this applies to websites too.
sroussey 1y ago
I guess this would help Meta’s sneaking identification code sharing between native apps and websites with their sdk on them from communicating serendipitously through localhost, particularly on Android. [0] https://www.theregister.com/2025/06/03/meta_pauses_android_tracking_tech/ https://www.theregister.com/2025/06/03/meta_pauses_android_t...
- will4274 1y ago
  surreptitiously
ronsor 1y ago
Do note that since the removal of NPAPI plugins years ago, locally-installed software that intends to be used by one or more public websites has to run an HTTP server on localhost. It would be really annoying if this use case was made into an unreasonable hassle or killed entirely. (Alternatively, browser developers could've offered a real alternative, but it's a bit late for that now.)
- donnachangstein 1y ago
  [flagged]
  - afavour 1y ago
    > Googlers present a solution no one is asking for, I'm asking for it. Random web sites have no business poking around my internal network.
    - moralestapia 1y ago
      >I'm asking for it. Proof? Link to issue? Mailing list? Anything? I think you just made that up.
      - ImPostingOnHN 1y ago
        > Proof? ... Anything? I saw them ask for it in the post you're responding to. I am also asking for it right now. That's 2 people asking for it so far. > Link to issue? Mailing list? That is not necessary.
        moralestapia 1y ago
        Wow, so Google is sitting on a time machine that can see the future. Amazing!
        ImPostingOnHN 1y ago
zelon88 1y ago
I understand the idea behind it and am still kinda chewing on the scope of it all. It will probably break some enterprise applications and cause some help desk or group policy/profile headaches for some. It would be nice to know when a site is probing the local network. But by the same token, here is Google once again putting barriers on self sufficiency and using them to promote their PaaS goals. They'll gladly narc on your self hosted application doing what it's supposed to do, but what about the 23 separate calls to Google CDN, ads, fonts, ect that every website has your browser make? I tend to believe the this particular functionality is no longer of any use to Google, which is why they want to deprecate it to raise the barrier of entry for others.
- iforgotpassword 1y ago
  Idk, I like the idea of my browser warning me when a random website I visit tries to talk to my network. if there's a legitimate reason I can still click yes. This is orthogonal to any ads and data collection.
  - Henchman21 1y ago
    I have this today from macOS. To me it feels more appropriate to have the OS attempt to secure running applications.
    - happyopossum 1y ago
      No you don’t - you get a single permission prompt for the entire browser. You definitely don’t get any permission-site permission options from the OS
      - Henchman21 1y ago
        Ah I misunderstood, thank you
- Henchman21 1y ago
  I agree that any newly proposed standards for the web coming from Google should be met with a skeptical eye — they aren’t good stewards IMO and are usually self-serving. I’d be interested in hearing what the folks at Ladybird think of this proposal.
foota 1y ago
The alternative proposal sounds much nicer, but unfortunately was paused due to concerns about devices not being able to support it. I guess once this is added maybe the proposed device opt in mechanism could be used for applications to cooperatively support access without a permission prompt?
mystifyingpoi 1y ago
I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".
- donnachangstein 1y ago
  [flagged]
  - zaptheimpaler 1y ago
    I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.
    - donnachangstein 1y ago
      [flagged]
      - hollerith 1y ago
        The whole browser is a massive security leak. What genius thought it was a good idea for the web page I visit in the morning to get the weather forecast to be able to run arbitrary code and to communicate with arbitrary hosts on my local network?
    - duskwuff 1y ago
      Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.
      - donnachangstein 1y ago
AStonesThrow 1y ago
Chris Siebenmann weighs in with thoughts on: Browers[sic] can't feasibly stop web pages from talking to private (local) IP addresses (2019) https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLocalIPs https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLoca...
- kccqzy 1y ago
  The split horizon DNS model mentioned in that article is to me insane. Your DNS responses should not change based on what network you are connected to. It breaks so many things. For one, caching breaks because DNS caching is simplistic and is only cached with a TTL: no way to tell your OS to associate a DNS cached response to a network. I understand why some companies want this, but doing it on the DNS level is a massive hack. If I were the decision maker I would break that use case. (Chrome probably wouldn't though.)
  - parliament32 1y ago
    > Your DNS responses should not change based on what network you are connected to. GeoDNS and similar are very broadly used by services you definitely use every day. Your DNS responses change all the time depending on what network you're connecting from. Further: why would I want my private hosts to be resolvable outside my networks? Of course DNS responses should change depending on what network you're on.
    - kccqzy 1y ago
      > but if you're inside our network perimeter and you look up their name, you get a private IP address and you have to use this IP address to talk to them In the linked article using the wrong DNS results in inaccessibility. GeoDNS is merely a performance concern. Big difference. > why would I want my private hosts Inaccessibility is different. We are talking about accessible hosts requiring different IP addresses to be accessed in different networks.
      - dwattttt 1y ago
gostsamo 1y ago
What is so hard in blocking apps on android from listening on random ports without permission?
- zb3 1y ago
  It's not only about android, it's about exploiting local services too..
- jeroenhd 1y ago
  The same thing that makes blocking ports on iOS and macOS so hard: there's barely any firewall on these devices by default, and the ones users may find cause more problems than users will ever think they solve. Listening on a specific port is one of the most basic things software can possibly do. What's next, blocking apps from reading files? Plus, this is also about blocking your phone's browser from accessing your printer, your router, or that docker container you're running without a password.
  - elric 1y ago
    That doesn't seem right. Can't speak to macOS, but on Android every application is sandboxed. Restricting its capabilities is trivial. Android apps certainly ARE blocked from reading files, except for some files in its storage and files the user grants it access to. Adding two Android permissions would fix this entire class of exploits: "run local network service", and "access local network services" (maybe with a whitelist).
pacifika 1y ago
Internet Explorer solved this with their zoning system right? https://learn.microsoft.com/en-us/previous-versions/troubleshoot/browsers/security-privacy/ie-security-zones-registry-entries https://learn.microsoft.com/en-us/previous-versions/troubles...
- donnachangstein 1y ago
  Ironically, Chrome partially supported and utilized IE security zones on Windows, though it was not well documented.
  - pacifika 1y ago
    Oh yeah forgot about that, amazing.
- nailer 1y ago
  Honestly I just assumed a modern equivalent existed. That it doesn’t is ridiculous. Local network should be a special permission like the camera or microphone.
- bux93 1y ago
  Although those were typically used to give ActiveX controls on the intranet unfettered access to your machine because IT put it in the group policy. Fun days.
hulitu 1y ago
> A proposal to restrict sites from accessing a users' local network A proposal to treat webbrowsers as malware ? Why would a webbrowser connect to a socket/internet ?
- loumf 1y ago
  The proposal is directed at the websites in the browser (using JS, embedded images or whatever), not the code that implements the browser.
AdmiralAsshat 1y ago
uBlock / uMatrix does this by default, I believe. I often see sites like Paypal trying to probe 127.0.0.1. For my "security", I'm sure...
- potholereseller 1y ago
  It appears to not have been enabled by default on my instance of uBlock; it seems a specific filter list is used to implement this [0]; that filter was un-checked; I have no idea why. The contents of that filter list are here [1]; notice that there are exceptions for certain services, so be sure to read through the exceptions before enabling it. [0] Filter Lists -> Privacy -> Block Outsider Intrusion into Lan [1] <https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/...>
  - reyqn 1y ago
    This filter broke twitch for me. I had to create custom rules for twitch if I wanted to use it with this filter enabled.
    - apazzolini 1y ago
      Would you mind sharing those custom rules?
profmonocle 1y ago
Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large. A better definition of "local IP" would be whether the IP is in the same subnet as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.
- kccqzy 1y ago
  The article spends a lot of effort defining the words "local" and "private" here. It then says: > Note that local -> local is not a local network request So your use case won't be affected.
  - ale42 1y ago
    The computer I use at work (and not only mine, many many of them) has a public IP address. Many internal services are on 10.0.0.0/8. How is this being taken into account?
    - kccqzy 1y ago
      As far as I understand that doesn't matter. What matters is the frame's origin and the request.
    - jaywee 1y ago
      Ideally, in an organization this should be a centrally pushed group policy defining CIDRs. Like, at home, I have 10/8 and public IPv6 addresses.
    - numpad0 1y ago
      10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are all private addresses per RFC1918 and documents superseding it(5735?). If it's like 66.249.73.128/27 or 164.13.12.34/12, those are "global" IP. 1: https://www.rfc-editor.org/rfc/rfc1918 https://www.rfc-editor.org/rfc/rfc1918 2: https://www.rfc-editor.org/rfc/rfc5735 https://www.rfc-editor.org/rfc/rfc5735 3: https://en.wikipedia.org/wiki/Private_network https://en.wikipedia.org/wiki/Private_network
skybrian 1y ago
While this will help to block many websites that have no business making local connections at all, it's still very coarse-grained. Most websites that need this permission only need to access one local server. Granting them access to everything violates the principle of least privilege. Most users don't know what's running on localhost or on their local network, so they won't understand the risk.
- nine_k 1y ago
  A comprehensive implementation would be a firewall. Which CIDRs, which ports, etc. I wish there were an API to build such a firewall, e.g. as a part of a browser extension, but also a simple default UI allowing to give access to a particular machine (e.g. router), to the LAN, to a VPN, based on the routing table, or to "private networks" in general, in the sense Windows ascribes to that. Also access to localhost separately. The site could ask one of these categories explicitly.
  - kuschku 1y ago
    > I wish there were an API to build such a firewall, e.g. as a part of a browser extension, There was in Manifest V2, and it still exists in Firefox. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... That's the API Chrome removed with Manifest V3. You can still log all web requests, but you can't block them dynamically anymore.
  - skybrian 1y ago
    I think something like Tailscale is the way to go here.
- paxys 1y ago
  > Most users don't know what's running on localhost or on their local network, so they won't understand the risk. Yes, which is why they also won't understand when the browser asks if you'd like to allow the site to visit http://localhost:3146 http://localhost:3146 vs http://localhost:8089 http://localhost:8089. A sensible permission message ("allow this site to access resources on your local network") is better than technical mumbo jumbo which will make them just click "yes" in confusion.
hello_computer 1y ago
just the fact that this comes from google is a hard pass for me. they sell so many adwords scams that they clearly do not give a damn about security. “security” from google is just another one of their trojan horses.
- fn-mote 1y ago
  Don't post shallow dismissals. The same company runs Project Zero, which has a major positive security impact. [1]: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/
  - hello_computer 1y ago
    project zero is ZERO compared to the millions of little old ladies around the world getting scammed through adwords. only security big g cares about is its own. they have the tools to laser-in on and punish the subtlest of wrongthink on youtube, yet it’s just too tall of an order to focus the same laser on tech support scammers…
    - saintleonardo 1y ago
      [dead]
themikesanto 1y ago
Google loves wreaking havoc on web standards. Is there really anything anyone can do about it at this point? The number of us using alternative browsers are a drop in the bucket when compared to Chrome's market share.
- charcircuit 1y ago
  Google open source the implementation of them which any other browser is free to use.
nickcw 1y ago
This has the potential to break rclone's oauth mechanism as it relies on setting the redirect URL to localhost so when the oauth is done rclone (which is running on your computer) gets called. I guess if the permissions dialog is sensibly worded then the user will allow it. I think this is probably a sensible proposal but I'm sure it will break stuff people are relying on.
- 0xCMP 1y ago
  IIUC this should not break redirects. This only affects: (1) fetch/xmlhttprequests (2) resources linked to AND loaded on a page (e.g. images, js, css, etc.) As noted in another comment this doesn't work unless the server responding provides proper CORS headers allowing the content to be loaded by the browser in that context: so for any request to work the server is either wide open (cors: *) or are cooperating with the requesting code (cors: website.co). The changes prevent communication without user authorization.
AshamedCaptain 1y ago
I do not understand. Doesn't same-origin prevent all of these issues? Why on earth would you extend some protection to resources based on IP address ranges? It seems like the most dubious criteria of all.
- fn-mote 1y ago
  I think you're mistaken about this. Use case 1 in the document and the discussion made it clear to me.
  - AshamedCaptain 1y ago
    Browsers allow launching HTTP requests to localhost in the same way they allow my-malicious-website.com to launch HTTP requests to say mail.google.com . They can _request_ a resource but that's about it -- everything else, even many things you would expect to be able to do with the downloaded resource, are blocked by the same origin policy. [1] Heck, we have a million problems already where file:/// websites cannot access resources from http://localhost http://localhost , and viceversa. So what's the attack vector exactly? Why it would be able to attack a local device but not attack your Gmail account ( with your browser happily sending your auth cookies) or file:///etc/passwd ? The only attack I can imagine is that _the mere fact_ of a webserver existing on your local IP is a disclosure of information for someone, but ... what's the attack scenario here again? The only thing they know is you run a webserver, and maybe they can check if you serve something at a specified location. Does this even allow identifying the router model you use? Because I can think of a bazillion better ways to do it -- including the simple "just assume is the default router of the specific ISP from that address". [1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o... In fact, [1] literally says > [Same-origin policy] prevents a malicious website on the Internet from running JS in a browser to read data from [...] a company intranet (which is protected from direct access by the attacker by not having a public IP address) and relaying that data to the attacker.
    - AnthonyMouse 1y ago
zajio1am 1y ago
This seems like a silly solution, considering we are in the middle of IPv6 transition, where local networks use public addresses.
- jeroenhd 1y ago
  Even IPv6 has local devices. Determining whether that's a /64 or a /56 network may need some work, but the concept isn't all that different. Plus, you have ::1 and fe80::, of course.
- mbreese 1y ago
  Even in this case, it could be useful to limit the access websites have to local servers within your subnet (/64, etc), which might be a better way to define the “local” network. (And then corporate/enterprise managed Chrome installs could have specific subnets added to the allow list)
- MBCook 1y ago
  So because IPv6 exists we shouldn’t even try? It’s insane to me that random internet sites can try to poke at my network or local system for any purpose without me knowing and approving it. With all we do for security these days this is such a massive hole it defies belief. Ever since I first saw an enterprise thing that just expected end users to run a local utility (really embedded web server) for their website to talk to I’ve been amazed this hasn’t been shut down.
- rerdavies 1y ago
  Whatever happened to IPv6 site-local and link local address ranges (address ranges that were specifically defined as address ranges that would not cross router or WAN boundaries? They were in the original IPv6 standards, but don't seem to be implemented or supported. Or at least they aren't implemented or supported by my completely uconfigurable home cable router povided by my ISP.
  - fulafel 1y ago
    IPv6 in normal ethernet/wlan like uses requires link-local to for functioning neighbour discovery (equivalent for v4's ARP) so it's very likely it works. Not meant for normal application usage though. Site local was phased out in favour of ULA etc. But if you're not using global addresses you're probably doing it wrong. Global addressing doesn't mean you're globally reachable, confusing addressing vs reachability is the source of a lot of misunderstandings. You can think of it as "everyone gets their own piece of unique address space, not routed unless you want it to be".
parliament32 1y ago
Won't this break every local-device oauth flow?
thesdev 1y ago
Off-topic: Is the placement of the apostrophe right in the title? Should it be "a users' local network" (current version) or "a user's local network"?
- IshKebab 1y ago
  It should be "from accessing a user's local network", or "from accessing users' local networks".
  - AndriyKunitsyn 1y ago
    Why do you think so? How is "a users' local network" significantly different from "a children's book"?
paxys 1y ago
It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaults), facebook.com or google.com or literally anyone else could be accessing it right now. Heck think of everything people deploy unauthed on their home network because they trust their router's firewall. Does every one of them have the correct CORS configuration?
- thaumasiotes 1y ago
  > Does every one of them have the correct CORS configuration? I would guess it's closer to 0% than 0.1%.
- reassess_blind 1y ago
  The local server has to send Access-Control-Allow-Origin: * for this to work, right? Are there any common local web servers or services that use that as the default? Not that it’s not concerning, just wondering.
  - meindnoch 1y ago
    No, simple requests [1] - such as a GET request, or a POST request with text/plain Content-Type - don't trigger a CORS preflight. The request is made, and the browser may block the requesting JS code from seeing the response if the necessary CORS response header is missing. But by that point the request had already been made. So if your local service has a GET endpoint like http://localhost:8080/launch_rockets http://localhost:8080/launch_rockets, or a POST endpoint, that doesn't strictly validate the body Content-Type, then any website can trigger it. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
    - reassess_blind 1y ago
numpad0 1y ago
Personally I had completely forgotten that anyone and anything can do this right now. TLDR, IIUC, right now, random websites can try accessing contents on local IPs. You can try to blind load e.g. http://192.168.0.1/cgi-bin/login.cgi http://192.168.0.1/cgi-bin/login.cgi from JavaScript, iterating through a gigantic malicious list of such known useful URLs, then grep and send back whatever you want to share with advertisers or try POSTing backdoors to printer update page. No, we don't need that. Of course, OTOH, many webapps today use localhost access to pass tokens and to talk to cooperating apps, but you only need access to 127.0.0.0/8 for that which is harder to abuse, so that range can be default exempted. Disabling this, as proposed, does not affect your ability to open http://192.168.0.1/login.html http://192.168.0.1/login.html, as that's just another "web" site. If JS on http://myNAS.local/search-local.html http://myNAS.local/search-local.html wants to access http://myLaptop.local:8000/myNasDesktopAppRemotingApi http://myLaptop.local:8000/myNasDesktopAppRemotingApi, only then you have to click some buttons to allow it. Edit: uBlock Origin has filter for it[1]; was unchecked in mine. 1: https://news.ycombinator.com/item?id=44184799 https://news.ycombinator.com/item?id=44184799
- MBCook 1y ago
  > so that range can be default exempted I disagree. I know it’s done, but I don’t think that makes it safe or smart. Require the user to OK it and require the server to send a header with the one _exact_ port it will access. Require that the local server _must_ use CORS and allow that server. No website not loaded from localhost should ever be allowed to just hit random local/private IPs and ports without explicit permission.
- reassess_blind 1y ago
  The server has to allow cross origin requests for it to return a response though, right?
gnarbarian 1y ago
I don't like the implications of this. say you want to host a game that has a lan play component. that would be illegal.
Lu2025 1y ago
[flagged]
rerdavies 1y ago
I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal is going to have problems on IPv6-only networks. I have an struggled with this issue in the past. I have an IoT application whose websever wants to reject any requests from a non-local address. After failing to find a way to distinguish IPv6 local addresses, I ended up redirecting IPv6 requests to the local IPv4 address. And that was the end of that. I feel like I would be in a better position to raise concerns if I could confirm that my understanding is correct: that there is no practical way for an application to determine whether an IPv6 address is link- or site-local. I did experiment with IPv6 "link local" addresses, but these seem to be something else altogether different (for use by routers rather than general applications),and don't seem to work for regular application use. There is some wiggle room provided by including .local address as local servers. But implementation of .local domains seems to be inconsistent across various OSs at present. Raspberry PI OS, for example, will do mDNS resolution of "some_address" but not of "someaddress.local"; Ubuntu 24.04 will resolve "someaddress.local", but not "someaddress". And neither will resolve "someaddress.local." (which I think was recommended at one point, but is now deprecated and non-functional). Which does seems like an issue worth raising. And it frustrates the HECK out of me that nobody will allow use of privately issued certs for local network addresses. The "no https for local addresses" thing needs to be fixed.
- donnachangstein 1y ago
  > Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming this garbage. Creating a nonstandard, arbitrary security boundary based on CIDR subnets as an HTTP extension is completely bonkers. As for your application, you're going about it all wrong. Just assume your application is public-facing and design your security with that in mind. Too many applications make this mistake and design saloon-door security into their "local only" application which results in overreaction such as the insanity that is the topic of discussion here. ".local" is reserved for mDNS and is in the RFC, though this is frequently and widely ignored.
otherayden 1y ago
This seems like such a no-brainer, I’m shocked this isn’t already something sites need explicit permission to do
cwilby 1y ago
Is it just me or am I not seeing any example that isn't pure theory? And if it is just me, fine I'll jump in - they should also make it so that users have to approve local network access three times. I worry about the theoretical security implications that come after they only approve local network access once.
xyst 1y ago
Advertising firms hate this.
phkahler 1y ago
This should not be possible in the first place. There is no legitimate reason for it. Having users grant "concent" is just a way to make it more OK, not to stop it.
- auxiliarymoose 1y ago
  There are definitely legitimate reasons—for example, a browser-based CAD system communicating with a 3D mouse.
naikrovek 1y ago
Why can browsers do the kinds of things they do at all? Why does a web browser need USB or Bluetooth support? They don’t.0 Browsers should not be the universal platform. They’ve become the universal attack vector.
- auxiliarymoose 1y ago
  With WebUSB, you can program a microcontroller without needing to install local software. With Web Bluetooth, you can wirelessly capture data from + send commands to that microcontroller. As a developer, these standards prevent you from needing to maintain separate implementations for Windows/macOS/Linux/Android. As a user, they let you grant and revoke sandbox permissions in a granular way, including fully removing the web app from your computer. Browsers provide a great cross-platform sandbox and make it much easier to develop secure software across all platforms. WebUSB and Web Bluetooth are opt-in when the site requests a connection/permission, as opposed to unlimited access by default for native apps. And if you don't want to use them, you can choose a browser that doesn't implement those standards. What other platform (outside of web browsers) is a good alternative for securely developing cross-platform software that interacts with hardware?
  - naikrovek 1y ago
    I’m ok with needing non-browser software for those things. > Browsers provide a great cross-platform sandbox and make it much easier to develop secure software across all platforms. Sure, until advertising companies find ways around and through those sandboxes because browser authors want the browsers be capable of more, in the name of a cross platform solution. The more a browser can do, the more surface area the sandbox has. (An advertising company makes the most popular browser, by the way.) > What other platform (outside of web browsers) is a good alternative for securely developing cross-platform software that interacts with hardware? There isn’t one, other than maybe video game engines, but it doesn’t matter. OS vendors need to work to make cross-platform software possible; it’s their fault we need a cross-platform solution at all. Every OS is a construct, and they were constructed to be different for arbitrary reasons. A good app-permission model in the browser is much more likely to happen, but I don’t see that really happening, either. “Too inconvenient for users [and our own in-house advertisers/malware authors]” will be the reason. MacOS handles permissions pretty well, but it could do better. If something wants local network permission, the user gets prompted. If the user says no, those network requests fail. Same with filesystem access. Linux will never have anything like this, nor will Windows, but it’s what security looks like, probably. Users will say yes to those prompts ultimately, because as soon as users have the ability to say “no” on all platforms, sites will simply gate site functionality behind the granting of those permissions because the authors of those sites want that data so badly. The only thing that is really going to stop behavior like this is law, and that is NEVER going to happen in the US. So, short of laws, browsers themselves must stop doing stupid crap like allowing local network access from sites that aren’t on the local network, and nonsense stuff like WebUSB. We need to give up on the idea that anyone can be safe on a platform when we want that platform to be able to do anything. Browsers must have boundaries. Operating systems should be the police, probably, and not browsers. Web stuff is already slow as hell, and browsers should be less capable, not more capable for both security reasons and speed reasons.
neuroelectron 1y ago
Cia isn't going to like this. I bet that google monopoly case suddenly reaches a new resolution.
socalgal2 1y ago
I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose App should only be able to see Bose devices, nothing else. The CVS (pharmacy app) should only be able to connect to CVS devices, whatever those are. All I know is the app asked for permission. I denied it. I might even prefer if it had to register the device ids and then the user would be prompted, the same way camera access/gps access is prompted. Via the OS, it might see a device that the CVS.app registered for in its manifest. The OS would popup "CVS app would like to connect to device ABC? Just this once, only when the app is running, always" (similar to the way iOS handles location) By id, I mean some prefix that a company registers for its devices. bose.xxx, app's manifest says it wants to connect to "bose.*" and OS filters. Similarly for USB and maybe local network devices. Come up with an id scheme, have the OS prevent apps form connecting to anything not that id. Effectively, don't let apps browser the network, usb, bluetooth.
- totetsu 1y ago
  Like the github 3rd party application integration. "ABC would like to see your repositories, which ones do you want to share?"
  - kuschku 1y ago
    Does that UI actually let you choose? IME it just tells me what orgs & repos will be shared, with no option to choose.
- 3eb7988a1663 1y ago
  I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS. I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.
G_o_D 1y ago
Cors doesnt stop POST request also not fetch with 'no-cors'supplied in javascript its that you cant read response that doesnt mean request is not sent by browser Then again local app can run server with proxy that adds adds CORS headers to the proxied request and you can access any site via js fetch/xmlhttprequest interface, even extension is able to modify headers to bypass cors Cors bypassing is just matter of editing headers whats really hard to or impossible to bypass in CSP rules, Now facebook app itself is running such cors server proxy even without it an normal http or websocket server is enought to send metrics Chrome already has flag to prevent locahost access still as said websocket can be used Completely banning localhost is detrimental Many users are using self hosted bookmarking, note app, pass managers like solutions that rely on local server
Pxtl 1y ago
Honestly I think cross-site requests were a mistake. Tracking cookies, hacks, XSS attacks, etc. My relationship is with your site. If you want to outsource that to some other domain, do that on your servers, not in my browser.
- AStonesThrow 1y ago
  Cross-site requests have been built in to the design of the WWW since the beginning. The whole idea of hyperlinking from one place to another, and amalgamating media from multiple sites into a single page, is the essence of the World Wide Web that Tim Berners-Lee conceived at CERN, based on the HyperCard stacks and Gopher and Wais services that had preceded it. Of course it was only later that cookies and scripting and low-trust networks were introduced. The WWW was conceived as more of a "desktop publishing" metaphor, where pages could be formatted and multimedia presentations could be made and served to the public. It was later that the browser was harnessed as a cross-platform application delivery front-end. Also, many sites do carefully try to guard against "linking out" or letting the user escape their walled gardens without a warning or disclaimer. As much as they may rely on third-party analytics and ad servers, most web masters want the users to remain on their site, interacting with the same site, without following an external link that would end their engagement or web session.
  - Pxtl 1y ago
    I'm aware of that but obviously there's a huge difference between the user clicking a link and navigating to a page on another domain and the site making that request on the user's behalf for a blob of JS.
  - elric 1y ago
    CORS != hyperlinks. CORS is about random websites in your browser accessing other domains without your say-so. Websites doing stuff behind your back does feel antithetical to Tim Berners Lee's ideals...
- elric 1y ago
  The mistake was putting CORS on the server side. It should have been part of the browser. "Facebook.com wants to access foo.example.com: y/n?" But then we would have had to educate users, and ad peddlers would have lost revenue.
moktonar 1y ago
The web is currently just “controlled code execution” on your device. This will never work if not done properly. We need a real “web 3.0” where web apps can run natively and containerized, but done correctly, where they are properly sandboxed. This will bring performance and security.
- graemep 1y ago
  The underlying problem is that we are trying to run untrusted code safel, with very few restrictions on its capabilities.
  - klabb3 1y ago
    Disagree. Untrusted code was thought to be a meaningful term 20-30 years ago when you ran desktop OSs with big name software like Microsoft Word and Adobe, and games. What happened in reality is that this fence had false positives (ie Meta being one of your main adversaries) and an enormous amount of false negatives (all indie or small devs that would have their apps classified as viruses). The model we need isn’t a boolean form of trust, but rather capabilities and permissions on a per-app, per-site or per-vendor basis. We already know this, but it’s incredibly tricky to design, retrofit and explain. Mobile OSs did a lot here, even if they are nowhere near perfect. For instance, they allow apps (by default even) to have private data that isn’t accessible from other apps on the same device. Whether the code runs in an app or on a website isn’t actually important. There is no fundamental reason for the web to be constrained except user expectations and the design of permission systems.
b0a04gl 1y ago
[dead]
fulafel 1y ago
A browser can't tell if a site is on the local network. Ambiguous addresses may not be on the local network and conversely a local network may use global addresses especially with v6.
Hnrobert42 1y ago
Ironic given that on my Mac, Chrome always asks to find other devices on my network by Firefox never does.
eternityforest 1y ago
I really hope this gets implemented, and more importantly, I really hope they have the ability to access an HTTP local site from an HTTPS domain. There are so many excellent home automation and media/entertainment use cases for something like this.
qwertox 1y ago
Proposing this in 2025. While probably knowing about this problem since Chrome was released (2008). Why not treat any local access as if it were an access to a microphone?
- A4ET8a8uTh0_v2 1y ago
  I would love for someone with more knowledge to opine on this, because, to me, it seems like it would actually be the most sane default state.
- dadrian 1y ago
  That is literally what this proposal is suggesting.
G_o_D 1y ago
Browser should just allow per-site settings or global allow/deny all to allow deny permission to localhost So thats user will be in control cant just write a extension that blocks access to domains based on origin So user can just add facebook.com as origin to block all facebook* sites from sending any request to any registered url in these case localhost/127.0.0.1 domains DNR api allows blocking based on initiatorDomains
rs186 1y ago
Why is this a Chrome thing, not an Android thing? I get that this could happen on any OS, and the proposal is from browser maker's perspective. But what about the other side of things, an app (not necessarily browser) talking to arbitrary localhost address?
- will4274 1y ago
  Basically any inter-process communication (IPC). https://en.wikipedia.org/wiki/Inter-process_communication https://en.wikipedia.org/wiki/Inter-process_communication . There are fancier IPC mechanisms, but none as widely supported as just sending arbitrary data over a socket. It wouldn't surprise me if e.g. this is how Chrome processes communicate with each other.
geekodour 1y ago
Just wanted to confirm something, this only works for HTTP right? browser dont allow arbitrary TCP reqs right?
jenny91 1y ago
On a quick look, isn't this a bit antithetical to the concept of the internet as a decentralized and hierarchical system? You have to route through the public internet to interoperate with the rest of the public internet?
calibas 1y ago
Choose one: Web browsers use sandboxing to keep you safe. Web browsers can portscan your local network.
qbane 1y ago
IIRC Flash has a similar design. One Flash app can access the internet, or local network, but not both.
Joel_Mckay 1y ago
Thus ignoring local private web servers, and bypassing local network administered zone policy. Seems like a sleazy move to draw down even more user DNS traffic data, and a worse solution than the default mitigation policy in NoScript =3
bmacho 1y ago
One of the very few security inspired restrictions I can wholeheartedly agree with. I don't want random websites be able to read my localhost. I hope it gets accepted and implemented sooner than later. OTOH it would be cool if random websites were able to open up and use ports on my computer's network, or even on my LAN, when granted permission of course. Browser-based file- and media sharing between my devices, or games if multi-person.
- avidiax 1y ago
  > OTOH it would be cool if random websites were able to open up and use ports on my computer's network That's what WebRTC does. There's no requirement that WebRTC is used to send video and audio as in a Zoom/Meet call. That's how WebTorrent works. https://webtorrent.io/faq https://webtorrent.io/faq
  - deleted 1y ago
    [deleted]
elansx 1y ago
As sooner this happens, the better.
bethekidyouwant 1y ago
make this malicious website and show me that it works. I have doubts.
junkblocker 1y ago
Relevant Firefox extension - https://addons.mozilla.org/en-US/firefox/addon/behave/ https://addons.mozilla.org/en-US/firefox/addon/behave/
grahamj 1y ago
I don’t see this mentioned anywhere but Safari on iOS already does this. If you try to access a local network endpoint you’ll be asked to allow it by Safari, and the permission is per-site.
spr-alex 1y ago
The existing PNA is easily defeated for bugs that can be triggered with standard cross origin requests. For example PNA does nothing to stop a website from exploiting some EOL devices I have with POST requests and img tags. This is a much better approach.
benob 1y ago
Isn't it time for disallowing browsers to connect to anything outside same origin pages except for actual navigation? Servers can do all the hard work of gathering content from here and there.
- globular-toast 1y ago
  Is it possible to do this today with browser extensions? I ran noscript 10 years ago and it was really tough. Kinda felt like being gaslit constantly. I could go back, only enabling sites selectively, but it's not going to work for family. Wondering if just blocking cross origin requests would be more feasible.
1vuio0pswjnm7 1y ago
Explainer by non-Googler Is the so-called "modern" web browser too large and complex I never asked for stuff like "websockets"; I have to disable it, why I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources It is relatively small, fast and reliable; very useful It can read larger HTML files that make so-called "modern" web browsers choke It does not support online ad services The companies like Google that force ads on www users are known for creating problems for www users and then proposing solutions to them; why not just stop creating the problems
- HumanOstrich 1y ago
  Going back to text-only browsers is not the solution.
- 1vuio0pswjnm7 1y ago
  Text-only browsers are not a "solution". That is not the point of the comment. Such simpler clients are not a problem. The point is that gigantic, overly complex "browsers" designed for surveillance and advertising are the problem. They are not a solution.
- 1vuio0pswjnm7 1y ago
  Perhaps the best thing about the text-only browser I use is that I, the www user, can edit and compile it quickly and easily. Whereas with the so-called "modern" browser, designed by committee,, all control over changes to fix issues rests with so-called "tech" companies that cater and are beholden to onlline advertising, namely, the commercial exploitatioon of the www user as an ad target. Generally,^1 with so-called "modern" browsers, the "right to repair" is meaningless. Only a handful of companies make "repairs". 1. Exceptions usuallly try to match the complexity of the so-called "modern" browser, not reduce it. Generally, "features" are copied, not removed. The www user is not expected to compille the source code nor edit it to their liking.
andromaton 1y ago
This used to cause malicious sites to reboot home internet routers around 2013.
udev4096 1y ago
Deny any incoming requests using ufw or nftables. Only allow outbound requests by default
angst 1y ago
i suppose i can live with this as long as the browser will explicitly ask me to enable that permission they are talking about adding and not just silently deny it...

680 points by doener 1y ago

owebmaster 1y ago

I propose restricting android apps, not websites.

jeroenhd 1y ago
Android apps need UDP port binding to function. You can't do QUIC without UDP. Of course you can (should) restrict localhost bound ports to the namespaces of individual apps, but there is no easy solution to this problem at the moment. If you rely on users having to click "yes", then you're just making phones harder to use because everyone still using Facebook or Instagram will just click whatever buttons make the app work. On the other hand, I have yet to come up with a good reason why arbitrary websites need to set up direct connections to devices within the local network. There's the IPv6 argument against the proposed measures, which requires work to determine if an address is local or global, but that's also much more difficult to enumerate than the IPv4 space that some websites try to scan. That doesn't mean IPv4 address shouldn't be protected at all, either. Even with an IPv6-shaped hole, blocking local networks (both IPv4 and local IPv6) by default makes sense for websites originating from outside. IE did something very similar to this decades ago. They also had a system for displaying details about websites' privacy policies and data sharing. It's almost disheartening to see we're trying to come up with solutions to these problems again.
bmacho 1y ago
Android apps obviously shouldn't be able to just open or read a global communication channel on your device. But this applies to websites too.

sroussey 1y ago

I guess this would help Meta’s sneaking identification code sharing between native apps and websites with their sdk on them from communicating serendipitously through localhost, particularly on Android. [0] https://www.theregister.com/2025/06/03/meta_pauses_android_tracking_tech/ https://www.theregister.com/2025/06/03/meta_pauses_android_t...

will4274 1y ago
surreptitiously

ronsor 1y ago

Do note that since the removal of NPAPI plugins years ago, locally-installed software that intends to be used by one or more public websites has to run an HTTP server on localhost. It would be really annoying if this use case was made into an unreasonable hassle or killed entirely. (Alternatively, browser developers could've offered a real alternative, but it's a bit late for that now.)

donnachangstein 1y ago
[flagged]
- afavour 1y ago
  > Googlers present a solution no one is asking for, I'm asking for it. Random web sites have no business poking around my internal network.
  - moralestapia 1y ago
    >I'm asking for it. Proof? Link to issue? Mailing list? Anything? I think you just made that up.
    - ImPostingOnHN 1y ago
      > Proof? ... Anything? I saw them ask for it in the post you're responding to. I am also asking for it right now. That's 2 people asking for it so far. > Link to issue? Mailing list? That is not necessary.
      - moralestapia 1y ago
        Wow, so Google is sitting on a time machine that can see the future. Amazing!
        ImPostingOnHN 1y ago

zelon88 1y ago

I understand the idea behind it and am still kinda chewing on the scope of it all. It will probably break some enterprise applications and cause some help desk or group policy/profile headaches for some. It would be nice to know when a site is probing the local network. But by the same token, here is Google once again putting barriers on self sufficiency and using them to promote their PaaS goals. They'll gladly narc on your self hosted application doing what it's supposed to do, but what about the 23 separate calls to Google CDN, ads, fonts, ect that every website has your browser make? I tend to believe the this particular functionality is no longer of any use to Google, which is why they want to deprecate it to raise the barrier of entry for others.

iforgotpassword 1y ago
Idk, I like the idea of my browser warning me when a random website I visit tries to talk to my network. if there's a legitimate reason I can still click yes. This is orthogonal to any ads and data collection.
- Henchman21 1y ago
  I have this today from macOS. To me it feels more appropriate to have the OS attempt to secure running applications.
  - happyopossum 1y ago
    No you don’t - you get a single permission prompt for the entire browser. You definitely don’t get any permission-site permission options from the OS
    - Henchman21 1y ago
      Ah I misunderstood, thank you
Henchman21 1y ago
I agree that any newly proposed standards for the web coming from Google should be met with a skeptical eye — they aren’t good stewards IMO and are usually self-serving. I’d be interested in hearing what the folks at Ladybird think of this proposal.

foota 1y ago

The alternative proposal sounds much nicer, but unfortunately was paused due to concerns about devices not being able to support it. I guess once this is added maybe the proposed device opt in mechanism could be used for applications to cooperatively support access without a permission prompt?

mystifyingpoi 1y ago

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

donnachangstein 1y ago
[flagged]
- zaptheimpaler 1y ago
  I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.
  - donnachangstein 1y ago
    [flagged]
    - hollerith 1y ago
      The whole browser is a massive security leak. What genius thought it was a good idea for the web page I visit in the morning to get the weather forecast to be able to run arbitrary code and to communicate with arbitrary hosts on my local network?
  - duskwuff 1y ago
    Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.
    - donnachangstein 1y ago

AStonesThrow 1y ago

Chris Siebenmann weighs in with thoughts on: Browers[sic] can't feasibly stop web pages from talking to private (local) IP addresses (2019) https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLocalIPs https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLoca...

kccqzy 1y ago
The split horizon DNS model mentioned in that article is to me insane. Your DNS responses should not change based on what network you are connected to. It breaks so many things. For one, caching breaks because DNS caching is simplistic and is only cached with a TTL: no way to tell your OS to associate a DNS cached response to a network. I understand why some companies want this, but doing it on the DNS level is a massive hack. If I were the decision maker I would break that use case. (Chrome probably wouldn't though.)
- parliament32 1y ago
  > Your DNS responses should not change based on what network you are connected to. GeoDNS and similar are very broadly used by services you definitely use every day. Your DNS responses change all the time depending on what network you're connecting from. Further: why would I want my private hosts to be resolvable outside my networks? Of course DNS responses should change depending on what network you're on.
  - kccqzy 1y ago
    > but if you're inside our network perimeter and you look up their name, you get a private IP address and you have to use this IP address to talk to them In the linked article using the wrong DNS results in inaccessibility. GeoDNS is merely a performance concern. Big difference. > why would I want my private hosts Inaccessibility is different. We are talking about accessible hosts requiring different IP addresses to be accessed in different networks.
    - dwattttt 1y ago

gostsamo 1y ago

What is so hard in blocking apps on android from listening on random ports without permission?

zb3 1y ago
It's not only about android, it's about exploiting local services too..
jeroenhd 1y ago
The same thing that makes blocking ports on iOS and macOS so hard: there's barely any firewall on these devices by default, and the ones users may find cause more problems than users will ever think they solve. Listening on a specific port is one of the most basic things software can possibly do. What's next, blocking apps from reading files? Plus, this is also about blocking your phone's browser from accessing your printer, your router, or that docker container you're running without a password.
- elric 1y ago
  That doesn't seem right. Can't speak to macOS, but on Android every application is sandboxed. Restricting its capabilities is trivial. Android apps certainly ARE blocked from reading files, except for some files in its storage and files the user grants it access to. Adding two Android permissions would fix this entire class of exploits: "run local network service", and "access local network services" (maybe with a whitelist).

pacifika 1y ago

Internet Explorer solved this with their zoning system right? https://learn.microsoft.com/en-us/previous-versions/troubleshoot/browsers/security-privacy/ie-security-zones-registry-entries https://learn.microsoft.com/en-us/previous-versions/troubles...

donnachangstein 1y ago
Ironically, Chrome partially supported and utilized IE security zones on Windows, though it was not well documented.
- pacifika 1y ago
  Oh yeah forgot about that, amazing.
nailer 1y ago
Honestly I just assumed a modern equivalent existed. That it doesn’t is ridiculous. Local network should be a special permission like the camera or microphone.
bux93 1y ago
Although those were typically used to give ActiveX controls on the intranet unfettered access to your machine because IT put it in the group policy. Fun days.

hulitu 1y ago

> A proposal to restrict sites from accessing a users' local network A proposal to treat webbrowsers as malware ? Why would a webbrowser connect to a socket/internet ?

loumf 1y ago
The proposal is directed at the websites in the browser (using JS, embedded images or whatever), not the code that implements the browser.

AdmiralAsshat 1y ago

uBlock / uMatrix does this by default, I believe. I often see sites like Paypal trying to probe 127.0.0.1. For my "security", I'm sure...

potholereseller 1y ago
It appears to not have been enabled by default on my instance of uBlock; it seems a specific filter list is used to implement this [0]; that filter was un-checked; I have no idea why. The contents of that filter list are here [1]; notice that there are exceptions for certain services, so be sure to read through the exceptions before enabling it. [0] Filter Lists -> Privacy -> Block Outsider Intrusion into Lan [1] <https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/...>
- reyqn 1y ago
  This filter broke twitch for me. I had to create custom rules for twitch if I wanted to use it with this filter enabled.
  - apazzolini 1y ago
    Would you mind sharing those custom rules?

profmonocle 1y ago

Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large. A better definition of "local IP" would be whether the IP is in the same subnet as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.

kccqzy 1y ago
The article spends a lot of effort defining the words "local" and "private" here. It then says: > Note that local -> local is not a local network request So your use case won't be affected.
- ale42 1y ago
  The computer I use at work (and not only mine, many many of them) has a public IP address. Many internal services are on 10.0.0.0/8. How is this being taken into account?
  - kccqzy 1y ago
    As far as I understand that doesn't matter. What matters is the frame's origin and the request.
  - jaywee 1y ago
    Ideally, in an organization this should be a centrally pushed group policy defining CIDRs. Like, at home, I have 10/8 and public IPv6 addresses.
  - numpad0 1y ago
    10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are all private addresses per RFC1918 and documents superseding it(5735?). If it's like 66.249.73.128/27 or 164.13.12.34/12, those are "global" IP. 1: https://www.rfc-editor.org/rfc/rfc1918 https://www.rfc-editor.org/rfc/rfc1918 2: https://www.rfc-editor.org/rfc/rfc5735 https://www.rfc-editor.org/rfc/rfc5735 3: https://en.wikipedia.org/wiki/Private_network https://en.wikipedia.org/wiki/Private_network

skybrian 1y ago

While this will help to block many websites that have no business making local connections at all, it's still very coarse-grained. Most websites that need this permission only need to access one local server. Granting them access to everything violates the principle of least privilege. Most users don't know what's running on localhost or on their local network, so they won't understand the risk.

nine_k 1y ago
A comprehensive implementation would be a firewall. Which CIDRs, which ports, etc. I wish there were an API to build such a firewall, e.g. as a part of a browser extension, but also a simple default UI allowing to give access to a particular machine (e.g. router), to the LAN, to a VPN, based on the routing table, or to "private networks" in general, in the sense Windows ascribes to that. Also access to localhost separately. The site could ask one of these categories explicitly.
- kuschku 1y ago
  > I wish there were an API to build such a firewall, e.g. as a part of a browser extension, There was in Manifest V2, and it still exists in Firefox. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... That's the API Chrome removed with Manifest V3. You can still log all web requests, but you can't block them dynamically anymore.
- skybrian 1y ago
  I think something like Tailscale is the way to go here.
paxys 1y ago
> Most users don't know what's running on localhost or on their local network, so they won't understand the risk. Yes, which is why they also won't understand when the browser asks if you'd like to allow the site to visit http://localhost:3146 http://localhost:3146 vs http://localhost:8089 http://localhost:8089. A sensible permission message ("allow this site to access resources on your local network") is better than technical mumbo jumbo which will make them just click "yes" in confusion.

hello_computer 1y ago

just the fact that this comes from google is a hard pass for me. they sell so many adwords scams that they clearly do not give a damn about security. “security” from google is just another one of their trojan horses.

fn-mote 1y ago
Don't post shallow dismissals. The same company runs Project Zero, which has a major positive security impact. [1]: https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/
- hello_computer 1y ago
  project zero is ZERO compared to the millions of little old ladies around the world getting scammed through adwords. only security big g cares about is its own. they have the tools to laser-in on and punish the subtlest of wrongthink on youtube, yet it’s just too tall of an order to focus the same laser on tech support scammers…
  - saintleonardo 1y ago
    [dead]

themikesanto 1y ago

Google loves wreaking havoc on web standards. Is there really anything anyone can do about it at this point? The number of us using alternative browsers are a drop in the bucket when compared to Chrome's market share.

charcircuit 1y ago
Google open source the implementation of them which any other browser is free to use.

nickcw 1y ago

This has the potential to break rclone's oauth mechanism as it relies on setting the redirect URL to localhost so when the oauth is done rclone (which is running on your computer) gets called. I guess if the permissions dialog is sensibly worded then the user will allow it. I think this is probably a sensible proposal but I'm sure it will break stuff people are relying on.

0xCMP 1y ago
IIUC this should not break redirects. This only affects: (1) fetch/xmlhttprequests (2) resources linked to AND loaded on a page (e.g. images, js, css, etc.) As noted in another comment this doesn't work unless the server responding provides proper CORS headers allowing the content to be loaded by the browser in that context: so for any request to work the server is either wide open (cors: *) or are cooperating with the requesting code (cors: website.co). The changes prevent communication without user authorization.

AshamedCaptain 1y ago

I do not understand. Doesn't same-origin prevent all of these issues? Why on earth would you extend some protection to resources based on IP address ranges? It seems like the most dubious criteria of all.

fn-mote 1y ago
I think you're mistaken about this. Use case 1 in the document and the discussion made it clear to me.
- AshamedCaptain 1y ago
  Browsers allow launching HTTP requests to localhost in the same way they allow my-malicious-website.com to launch HTTP requests to say mail.google.com . They can _request_ a resource but that's about it -- everything else, even many things you would expect to be able to do with the downloaded resource, are blocked by the same origin policy. [1] Heck, we have a million problems already where file:/// websites cannot access resources from http://localhost http://localhost , and viceversa. So what's the attack vector exactly? Why it would be able to attack a local device but not attack your Gmail account ( with your browser happily sending your auth cookies) or file:///etc/passwd ? The only attack I can imagine is that _the mere fact_ of a webserver existing on your local IP is a disclosure of information for someone, but ... what's the attack scenario here again? The only thing they know is you run a webserver, and maybe they can check if you serve something at a specified location. Does this even allow identifying the router model you use? Because I can think of a bazillion better ways to do it -- including the simple "just assume is the default router of the specific ISP from that address". [1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o... In fact, [1] literally says > [Same-origin policy] prevents a malicious website on the Internet from running JS in a browser to read data from [...] a company intranet (which is protected from direct access by the attacker by not having a public IP address) and relaying that data to the attacker.
  - AnthonyMouse 1y ago

zajio1am 1y ago

This seems like a silly solution, considering we are in the middle of IPv6 transition, where local networks use public addresses.

jeroenhd 1y ago
Even IPv6 has local devices. Determining whether that's a /64 or a /56 network may need some work, but the concept isn't all that different. Plus, you have ::1 and fe80::, of course.
mbreese 1y ago
Even in this case, it could be useful to limit the access websites have to local servers within your subnet (/64, etc), which might be a better way to define the “local” network. (And then corporate/enterprise managed Chrome installs could have specific subnets added to the allow list)
MBCook 1y ago
So because IPv6 exists we shouldn’t even try? It’s insane to me that random internet sites can try to poke at my network or local system for any purpose without me knowing and approving it. With all we do for security these days this is such a massive hole it defies belief. Ever since I first saw an enterprise thing that just expected end users to run a local utility (really embedded web server) for their website to talk to I’ve been amazed this hasn’t been shut down.
rerdavies 1y ago
Whatever happened to IPv6 site-local and link local address ranges (address ranges that were specifically defined as address ranges that would not cross router or WAN boundaries? They were in the original IPv6 standards, but don't seem to be implemented or supported. Or at least they aren't implemented or supported by my completely uconfigurable home cable router povided by my ISP.
- fulafel 1y ago
  IPv6 in normal ethernet/wlan like uses requires link-local to for functioning neighbour discovery (equivalent for v4's ARP) so it's very likely it works. Not meant for normal application usage though. Site local was phased out in favour of ULA etc. But if you're not using global addresses you're probably doing it wrong. Global addressing doesn't mean you're globally reachable, confusing addressing vs reachability is the source of a lot of misunderstandings. You can think of it as "everyone gets their own piece of unique address space, not routed unless you want it to be".

parliament32 1y ago

Won't this break every local-device oauth flow?

thesdev 1y ago

Off-topic: Is the placement of the apostrophe right in the title? Should it be "a users' local network" (current version) or "a user's local network"?

IshKebab 1y ago
It should be "from accessing a user's local network", or "from accessing users' local networks".
- AndriyKunitsyn 1y ago
  Why do you think so? How is "a users' local network" significantly different from "a children's book"?

paxys 1y ago

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaults), facebook.com or google.com or literally anyone else could be accessing it right now. Heck think of everything people deploy unauthed on their home network because they trust their router's firewall. Does every one of them have the correct CORS configuration?

thaumasiotes 1y ago
> Does every one of them have the correct CORS configuration? I would guess it's closer to 0% than 0.1%.
reassess_blind 1y ago
The local server has to send Access-Control-Allow-Origin: * for this to work, right? Are there any common local web servers or services that use that as the default? Not that it’s not concerning, just wondering.
- meindnoch 1y ago
  No, simple requests [1] - such as a GET request, or a POST request with text/plain Content-Type - don't trigger a CORS preflight. The request is made, and the browser may block the requesting JS code from seeing the response if the necessary CORS response header is missing. But by that point the request had already been made. So if your local service has a GET endpoint like http://localhost:8080/launch_rockets http://localhost:8080/launch_rockets, or a POST endpoint, that doesn't strictly validate the body Content-Type, then any website can trigger it. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
  - reassess_blind 1y ago

numpad0 1y ago

Personally I had completely forgotten that anyone and anything can do this right now. TLDR, IIUC, right now, random websites can try accessing contents on local IPs. You can try to blind load e.g. http://192.168.0.1/cgi-bin/login.cgi http://192.168.0.1/cgi-bin/login.cgi from JavaScript, iterating through a gigantic malicious list of such known useful URLs, then grep and send back whatever you want to share with advertisers or try POSTing backdoors to printer update page. No, we don't need that. Of course, OTOH, many webapps today use localhost access to pass tokens and to talk to cooperating apps, but you only need access to 127.0.0.0/8 for that which is harder to abuse, so that range can be default exempted. Disabling this, as proposed, does not affect your ability to open http://192.168.0.1/login.html http://192.168.0.1/login.html, as that's just another "web" site. If JS on http://myNAS.local/search-local.html http://myNAS.local/search-local.html wants to access http://myLaptop.local:8000/myNasDesktopAppRemotingApi http://myLaptop.local:8000/myNasDesktopAppRemotingApi, only then you have to click some buttons to allow it. Edit: uBlock Origin has filter for it[1]; was unchecked in mine. 1: https://news.ycombinator.com/item?id=44184799 https://news.ycombinator.com/item?id=44184799

MBCook 1y ago
> so that range can be default exempted I disagree. I know it’s done, but I don’t think that makes it safe or smart. Require the user to OK it and require the server to send a header with the one _exact_ port it will access. Require that the local server _must_ use CORS and allow that server. No website not loaded from localhost should ever be allowed to just hit random local/private IPs and ports without explicit permission.
reassess_blind 1y ago
The server has to allow cross origin requests for it to return a response though, right?

gnarbarian 1y ago

I don't like the implications of this. say you want to host a game that has a lan play component. that would be illegal.

Lu2025 1y ago

[flagged]

rerdavies 1y ago

I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal is going to have problems on IPv6-only networks. I have an struggled with this issue in the past. I have an IoT application whose websever wants to reject any requests from a non-local address. After failing to find a way to distinguish IPv6 local addresses, I ended up redirecting IPv6 requests to the local IPv4 address. And that was the end of that. I feel like I would be in a better position to raise concerns if I could confirm that my understanding is correct: that there is no practical way for an application to determine whether an IPv6 address is link- or site-local. I did experiment with IPv6 "link local" addresses, but these seem to be something else altogether different (for use by routers rather than general applications),and don't seem to work for regular application use. There is some wiggle room provided by including .local address as local servers. But implementation of .local domains seems to be inconsistent across various OSs at present. Raspberry PI OS, for example, will do mDNS resolution of "some_address" but not of "someaddress.local"; Ubuntu 24.04 will resolve "someaddress.local", but not "someaddress". And neither will resolve "someaddress.local." (which I think was recommended at one point, but is now deprecated and non-functional). Which does seems like an issue worth raising. And it frustrates the HECK out of me that nobody will allow use of privately issued certs for local network addresses. The "no https for local addresses" thing needs to be fixed.

donnachangstein 1y ago
> Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming this garbage. Creating a nonstandard, arbitrary security boundary based on CIDR subnets as an HTTP extension is completely bonkers. As for your application, you're going about it all wrong. Just assume your application is public-facing and design your security with that in mind. Too many applications make this mistake and design saloon-door security into their "local only" application which results in overreaction such as the insanity that is the topic of discussion here. ".local" is reserved for mDNS and is in the RFC, though this is frequently and widely ignored.

otherayden 1y ago

This seems like such a no-brainer, I’m shocked this isn’t already something sites need explicit permission to do

cwilby 1y ago

Is it just me or am I not seeing any example that isn't pure theory? And if it is just me, fine I'll jump in - they should also make it so that users have to approve local network access three times. I worry about the theoretical security implications that come after they only approve local network access once.

xyst 1y ago

Advertising firms hate this.

phkahler 1y ago

This should not be possible in the first place. There is no legitimate reason for it. Having users grant "concent" is just a way to make it more OK, not to stop it.

auxiliarymoose 1y ago
There are definitely legitimate reasons—for example, a browser-based CAD system communicating with a 3D mouse.

naikrovek 1y ago

Why can browsers do the kinds of things they do at all? Why does a web browser need USB or Bluetooth support? They don’t.0 Browsers should not be the universal platform. They’ve become the universal attack vector.

auxiliarymoose 1y ago
With WebUSB, you can program a microcontroller without needing to install local software. With Web Bluetooth, you can wirelessly capture data from + send commands to that microcontroller. As a developer, these standards prevent you from needing to maintain separate implementations for Windows/macOS/Linux/Android. As a user, they let you grant and revoke sandbox permissions in a granular way, including fully removing the web app from your computer. Browsers provide a great cross-platform sandbox and make it much easier to develop secure software across all platforms. WebUSB and Web Bluetooth are opt-in when the site requests a connection/permission, as opposed to unlimited access by default for native apps. And if you don't want to use them, you can choose a browser that doesn't implement those standards. What other platform (outside of web browsers) is a good alternative for securely developing cross-platform software that interacts with hardware?
- naikrovek 1y ago
  I’m ok with needing non-browser software for those things. > Browsers provide a great cross-platform sandbox and make it much easier to develop secure software across all platforms. Sure, until advertising companies find ways around and through those sandboxes because browser authors want the browsers be capable of more, in the name of a cross platform solution. The more a browser can do, the more surface area the sandbox has. (An advertising company makes the most popular browser, by the way.) > What other platform (outside of web browsers) is a good alternative for securely developing cross-platform software that interacts with hardware? There isn’t one, other than maybe video game engines, but it doesn’t matter. OS vendors need to work to make cross-platform software possible; it’s their fault we need a cross-platform solution at all. Every OS is a construct, and they were constructed to be different for arbitrary reasons. A good app-permission model in the browser is much more likely to happen, but I don’t see that really happening, either. “Too inconvenient for users [and our own in-house advertisers/malware authors]” will be the reason. MacOS handles permissions pretty well, but it could do better. If something wants local network permission, the user gets prompted. If the user says no, those network requests fail. Same with filesystem access. Linux will never have anything like this, nor will Windows, but it’s what security looks like, probably. Users will say yes to those prompts ultimately, because as soon as users have the ability to say “no” on all platforms, sites will simply gate site functionality behind the granting of those permissions because the authors of those sites want that data so badly. The only thing that is really going to stop behavior like this is law, and that is NEVER going to happen in the US. So, short of laws, browsers themselves must stop doing stupid crap like allowing local network access from sites that aren’t on the local network, and nonsense stuff like WebUSB. We need to give up on the idea that anyone can be safe on a platform when we want that platform to be able to do anything. Browsers must have boundaries. Operating systems should be the police, probably, and not browsers. Web stuff is already slow as hell, and browsers should be less capable, not more capable for both security reasons and speed reasons.

neuroelectron 1y ago

Cia isn't going to like this. I bet that google monopoly case suddenly reaches a new resolution.

socalgal2 1y ago

I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose App should only be able to see Bose devices, nothing else. The CVS (pharmacy app) should only be able to connect to CVS devices, whatever those are. All I know is the app asked for permission. I denied it. I might even prefer if it had to register the device ids and then the user would be prompted, the same way camera access/gps access is prompted. Via the OS, it might see a device that the CVS.app registered for in its manifest. The OS would popup "CVS app would like to connect to device ABC? Just this once, only when the app is running, always" (similar to the way iOS handles location) By id, I mean some prefix that a company registers for its devices. bose.xxx, app's manifest says it wants to connect to "bose.*" and OS filters. Similarly for USB and maybe local network devices. Come up with an id scheme, have the OS prevent apps form connecting to anything not that id. Effectively, don't let apps browser the network, usb, bluetooth.

totetsu 1y ago
Like the github 3rd party application integration. "ABC would like to see your repositories, which ones do you want to share?"
- kuschku 1y ago
  Does that UI actually let you choose? IME it just tells me what orgs & repos will be shared, with no option to choose.
3eb7988a1663 1y ago
I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS. I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.

G_o_D 1y ago

Cors doesnt stop POST request also not fetch with 'no-cors'supplied in javascript its that you cant read response that doesnt mean request is not sent by browser Then again local app can run server with proxy that adds adds CORS headers to the proxied request and you can access any site via js fetch/xmlhttprequest interface, even extension is able to modify headers to bypass cors Cors bypassing is just matter of editing headers whats really hard to or impossible to bypass in CSP rules, Now facebook app itself is running such cors server proxy even without it an normal http or websocket server is enought to send metrics Chrome already has flag to prevent locahost access still as said websocket can be used Completely banning localhost is detrimental Many users are using self hosted bookmarking, note app, pass managers like solutions that rely on local server

Pxtl 1y ago

Honestly I think cross-site requests were a mistake. Tracking cookies, hacks, XSS attacks, etc. My relationship is with your site. If you want to outsource that to some other domain, do that on your servers, not in my browser.

AStonesThrow 1y ago
Cross-site requests have been built in to the design of the WWW since the beginning. The whole idea of hyperlinking from one place to another, and amalgamating media from multiple sites into a single page, is the essence of the World Wide Web that Tim Berners-Lee conceived at CERN, based on the HyperCard stacks and Gopher and Wais services that had preceded it. Of course it was only later that cookies and scripting and low-trust networks were introduced. The WWW was conceived as more of a "desktop publishing" metaphor, where pages could be formatted and multimedia presentations could be made and served to the public. It was later that the browser was harnessed as a cross-platform application delivery front-end. Also, many sites do carefully try to guard against "linking out" or letting the user escape their walled gardens without a warning or disclaimer. As much as they may rely on third-party analytics and ad servers, most web masters want the users to remain on their site, interacting with the same site, without following an external link that would end their engagement or web session.
- Pxtl 1y ago
  I'm aware of that but obviously there's a huge difference between the user clicking a link and navigating to a page on another domain and the site making that request on the user's behalf for a blob of JS.
- elric 1y ago
  CORS != hyperlinks. CORS is about random websites in your browser accessing other domains without your say-so. Websites doing stuff behind your back does feel antithetical to Tim Berners Lee's ideals...
elric 1y ago
The mistake was putting CORS on the server side. It should have been part of the browser. "Facebook.com wants to access foo.example.com: y/n?" But then we would have had to educate users, and ad peddlers would have lost revenue.

moktonar 1y ago

The web is currently just “controlled code execution” on your device. This will never work if not done properly. We need a real “web 3.0” where web apps can run natively and containerized, but done correctly, where they are properly sandboxed. This will bring performance and security.

graemep 1y ago
The underlying problem is that we are trying to run untrusted code safel, with very few restrictions on its capabilities.
- klabb3 1y ago
  Disagree. Untrusted code was thought to be a meaningful term 20-30 years ago when you ran desktop OSs with big name software like Microsoft Word and Adobe, and games. What happened in reality is that this fence had false positives (ie Meta being one of your main adversaries) and an enormous amount of false negatives (all indie or small devs that would have their apps classified as viruses). The model we need isn’t a boolean form of trust, but rather capabilities and permissions on a per-app, per-site or per-vendor basis. We already know this, but it’s incredibly tricky to design, retrofit and explain. Mobile OSs did a lot here, even if they are nowhere near perfect. For instance, they allow apps (by default even) to have private data that isn’t accessible from other apps on the same device. Whether the code runs in an app or on a website isn’t actually important. There is no fundamental reason for the web to be constrained except user expectations and the design of permission systems.

b0a04gl 1y ago

[dead]

fulafel 1y ago

A browser can't tell if a site is on the local network. Ambiguous addresses may not be on the local network and conversely a local network may use global addresses especially with v6.

Hnrobert42 1y ago

Ironic given that on my Mac, Chrome always asks to find other devices on my network by Firefox never does.

eternityforest 1y ago

I really hope this gets implemented, and more importantly, I really hope they have the ability to access an HTTP local site from an HTTPS domain. There are so many excellent home automation and media/entertainment use cases for something like this.

qwertox 1y ago

Proposing this in 2025. While probably knowing about this problem since Chrome was released (2008). Why not treat any local access as if it were an access to a microphone?

A4ET8a8uTh0_v2 1y ago
I would love for someone with more knowledge to opine on this, because, to me, it seems like it would actually be the most sane default state.
dadrian 1y ago
That is literally what this proposal is suggesting.

G_o_D 1y ago

Browser should just allow per-site settings or global allow/deny all to allow deny permission to localhost So thats user will be in control cant just write a extension that blocks access to domains based on origin So user can just add facebook.com as origin to block all facebook* sites from sending any request to any registered url in these case localhost/127.0.0.1 domains DNR api allows blocking based on initiatorDomains

rs186 1y ago

Why is this a Chrome thing, not an Android thing? I get that this could happen on any OS, and the proposal is from browser maker's perspective. But what about the other side of things, an app (not necessarily browser) talking to arbitrary localhost address?

will4274 1y ago
Basically any inter-process communication (IPC). https://en.wikipedia.org/wiki/Inter-process_communication https://en.wikipedia.org/wiki/Inter-process_communication . There are fancier IPC mechanisms, but none as widely supported as just sending arbitrary data over a socket. It wouldn't surprise me if e.g. this is how Chrome processes communicate with each other.

geekodour 1y ago

Just wanted to confirm something, this only works for HTTP right? browser dont allow arbitrary TCP reqs right?

jenny91 1y ago

On a quick look, isn't this a bit antithetical to the concept of the internet as a decentralized and hierarchical system? You have to route through the public internet to interoperate with the rest of the public internet?

calibas 1y ago

Choose one: Web browsers use sandboxing to keep you safe. Web browsers can portscan your local network.

qbane 1y ago

IIRC Flash has a similar design. One Flash app can access the internet, or local network, but not both.

Joel_Mckay 1y ago

Thus ignoring local private web servers, and bypassing local network administered zone policy. Seems like a sleazy move to draw down even more user DNS traffic data, and a worse solution than the default mitigation policy in NoScript =3

bmacho 1y ago

One of the very few security inspired restrictions I can wholeheartedly agree with. I don't want random websites be able to read my localhost. I hope it gets accepted and implemented sooner than later. OTOH it would be cool if random websites were able to open up and use ports on my computer's network, or even on my LAN, when granted permission of course. Browser-based file- and media sharing between my devices, or games if multi-person.

avidiax 1y ago
> OTOH it would be cool if random websites were able to open up and use ports on my computer's network That's what WebRTC does. There's no requirement that WebRTC is used to send video and audio as in a Zoom/Meet call. That's how WebTorrent works. https://webtorrent.io/faq https://webtorrent.io/faq
- deleted 1y ago
  [deleted]

elansx 1y ago

As sooner this happens, the better.

bethekidyouwant 1y ago

make this malicious website and show me that it works. I have doubts.

junkblocker 1y ago

Relevant Firefox extension - https://addons.mozilla.org/en-US/firefox/addon/behave/ https://addons.mozilla.org/en-US/firefox/addon/behave/

grahamj 1y ago

I don’t see this mentioned anywhere but Safari on iOS already does this. If you try to access a local network endpoint you’ll be asked to allow it by Safari, and the permission is per-site.

spr-alex 1y ago

The existing PNA is easily defeated for bugs that can be triggered with standard cross origin requests. For example PNA does nothing to stop a website from exploiting some EOL devices I have with POST requests and img tags. This is a much better approach.

benob 1y ago

Isn't it time for disallowing browsers to connect to anything outside same origin pages except for actual navigation? Servers can do all the hard work of gathering content from here and there.

globular-toast 1y ago
Is it possible to do this today with browser extensions? I ran noscript 10 years ago and it was really tough. Kinda felt like being gaslit constantly. I could go back, only enabling sites selectively, but it's not going to work for family. Wondering if just blocking cross origin requests would be more feasible.

1vuio0pswjnm7 1y ago

Explainer by non-Googler Is the so-called "modern" web browser too large and complex I never asked for stuff like "websockets"; I have to disable it, why I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources It is relatively small, fast and reliable; very useful It can read larger HTML files that make so-called "modern" web browsers choke It does not support online ad services The companies like Google that force ads on www users are known for creating problems for www users and then proposing solutions to them; why not just stop creating the problems

HumanOstrich 1y ago
Going back to text-only browsers is not the solution.
1vuio0pswjnm7 1y ago
Text-only browsers are not a "solution". That is not the point of the comment. Such simpler clients are not a problem. The point is that gigantic, overly complex "browsers" designed for surveillance and advertising are the problem. They are not a solution.
1vuio0pswjnm7 1y ago
Perhaps the best thing about the text-only browser I use is that I, the www user, can edit and compile it quickly and easily. Whereas with the so-called "modern" browser, designed by committee,, all control over changes to fix issues rests with so-called "tech" companies that cater and are beholden to onlline advertising, namely, the commercial exploitatioon of the www user as an ad target. Generally,^1 with so-called "modern" browsers, the "right to repair" is meaningless. Only a handful of companies make "repairs". 1. Exceptions usuallly try to match the complexity of the so-called "modern" browser, not reduce it. Generally, "features" are copied, not removed. The www user is not expected to compille the source code nor edit it to their liking.

andromaton 1y ago

This used to cause malicious sites to reboot home internet routers around 2013.

udev4096 1y ago

Deny any incoming requests using ufw or nftables. Only allow outbound requests by default

angst 1y ago

i suppose i can live with this as long as the browser will explicitly ask me to enable that permission they are talking about adding and not just silently deny it...