4 ms·
Christ Almighty I hate our industry practice of binding to some inscrutable port number on localhost. Unix domain sockets aren't that hard! They're secure again
by quotemstr 7mo ago
Christ Almighty I hate our industry practice of binding to some inscrutable port number on localhost. Unix domain sockets aren't that hard! They're secure against all sorts of attacks and more convenient to boot. Instead of connecting to a number, you connect to a file. An ordinary file, with an ordinary name you can mv, chmod, and rm. Boring on a good way.
So why doesn't everyone run local services over Unix sockets?
The only problems: 1) web browsers don't support AF_UNIX URI scheme, and 2) ancient versions of Java don't have built-in APIs for AF_UNIX sockets.
That's it. For these trivial reasons, we've beat our head against arbitrary opaque numbers for decades.
And so, for want of a nail, the Unix was lost.
- formerly_proven 7mo ago> So why doesn't everyone run local services over Unix sockets? > The only problems: 3) 40 years of Windows not supporting UDS.
- quotemstr 7mo agoYeah, that too. Windows supports them nowadays too, just to be clear. I think we're still bottlenecked, right now, on #1 and #2 in the form of Java 8 refusing to die.
- formerly_proven 7mo agoYeah, doing the math it's actually only 33 years of not supporting AF_UNIX, but that's not really right either, since those versions of Windows didn't support any sockets. I guess the technically correct answer then is that Windows didn't support UDS for 26 years. Which is still enough for most portable software to go "eh, localhost is fine*" * resolving localhost is actually a pretty bad idea (yet very common) and it's way more robust to listen directly on a numeric address.
- 0x457 7mo agoSome random daemon binding to 3000 because it's the express default drives me nuts. I either do a Unix socket, a pick any random port if it has to bind on a port.