Re: [PATCH] web: default to INADDR_ANY instead of INADDR_LOOPBACK

[Maxime Devos <maximedevos@telenet.be>]

[-- Attachment #1.1.1.1: Type: text/plain, Size: 1355 bytes --]

On 22-07-2022 02:44, Aleix Conchillo Flaqué wrote:

> ping. easy one but might be more controversial.
>
> On Wed, Feb 2, 2022 at 4:26 PM Aleix Conchillo Flaqué 
> <aconchillo@gmail.com> wrote:
>
>     Using INADDR_ANY instead of INADDR_LOOPBACK makes it convenient when
>     starting the web server inside containers
>
I don't see what containers have to do with anything? If you want it to 
access the Internet, just don't do a network container (don't create a 
new network namespace).  Or to reduce access, do create a new network 
namespace but set up port forwarding (which I would expect to work with 
loopback).
>
>     without the need to having to
>     specify INADDR_ANY all the time.
>
I don't recommend this as a default, as it opens up potential security 
problems (some programs open a web server for local communication on the 
computer). INADDR_LOOPBACK is a safe default, anyone needing something 
else and knowing their use is safe can easily override to INADDR_ANY.

> This is the default in most libraries and languages.
Is ad populum. Plenty of bad choices have been made in the past, see 
e.g. all the CVEs, so I don't think this is a good argument. (It is an 
argument if you are switching to INADDR_ANY for _consistency_, but the 
patch appears to be for other purposes.)

Greetings,
Maxime.


[-- Attachment #1.1.1.2: Type: text/html, Size: 2725 bytes --]

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 929 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]