From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: =?UTF-8?Q?Aleix_Conchillo_Flaqu=C3=A9?= Newsgroups: gmane.lisp.guile.devel Subject: Re: [PATCH] web: default to INADDR_ANY instead of INADDR_LOOPBACK Date: Fri, 22 Jul 2022 10:16:51 -0700 Message-ID: References: <20220203002638.34504-1-aconchillo@gmail.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000a95a6f05e4680068" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="29284"; mail-complaints-to="usenet@ciao.gmane.io" Cc: guile-devel To: Greg Troxel Original-X-From: guile-devel-bounces+guile-devel=m.gmane-mx.org@gnu.org Fri Jul 22 19:17:23 2022 Return-path: Envelope-to: guile-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oEwHC-0007Mq-R1 for guile-devel@m.gmane-mx.org; Fri, 22 Jul 2022 19:17:22 +0200 Original-Received: from localhost ([::1]:50482 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oEwHB-00032K-RG for guile-devel@m.gmane-mx.org; Fri, 22 Jul 2022 13:17:21 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:42418) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oEwGv-00030D-3t for guile-devel@gnu.org; Fri, 22 Jul 2022 13:17:05 -0400 Original-Received: from mail-vs1-xe30.google.com ([2607:f8b0:4864:20::e30]:39924) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oEwGt-0002pa-Dl for guile-devel@gnu.org; Fri, 22 Jul 2022 13:17:04 -0400 Original-Received: by mail-vs1-xe30.google.com with SMTP id c3so4899648vsc.6 for ; Fri, 22 Jul 2022 10:17:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4mW3BLLLRf6rDbvtTavyxyDaRLTLxRhcYWNaA4+8hh4=; b=QfFEqHSGOLnmNPmekC2ZETNPp6Z84MkuwhHCGnJhVvloyzYVzcbfAvtV6SM8hz+6i3 TvRE+wCK6sJM+qntqDlm32ccwdP0J9gNPoZ7Jk/87EcIc6HYurFEi6Yn0Pie/NiLUiWx XqNdkQ72i9FllvjkOaScyY+Plvr0Vuu/z8dcXtbCfzqCYU2DhDX0ntYlIcvAFXmZQaxg 3s81eXuhrC/XjCM3k6VBkZ3Kl3RVtilrfkPB/h+fmlMIxFk5er0lPEvi8l5SOYOfbhcV R7gyswwuFwbzXmEftFxXefy1zqZbH+S4BsrrDuO7W/gDCvekuhwiIwDd9vUQZzkOaqm6 1DUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4mW3BLLLRf6rDbvtTavyxyDaRLTLxRhcYWNaA4+8hh4=; b=uyLt524ejmduCcfhSwvuk/oDymI94GhslW54xIBKUEMjLWC/PdOyk/pkl+Nm+Outje vlfLUOCxbAiWWrTQCmvEB3kUtkmjrnskkkJVC5YMsgAM9A1CNvq6U70qpFt64X58hOys xiBdMw5u45oqvYLAfFeJCXcj5cFdY2R3MY1QGSAAA0yivQ3Db14jXIx8asyH7GshsEen r0nD5YTnXCijoAzbno+ba2UcIiUbFJ9iCNnXNk25ITioxhNJkAERGWCOMQ0CamGCPH3S LTOSWrTSRTTqEtsPN3KpNygzABlNQub8P/nOawjJYucAzuvguuehDTpJ18vtBASlynkk sQKQ== X-Gm-Message-State: AJIora/+N6bxkcHpQ0T8KjwnFDSWM9Fc5gyJQoGfUyP1wLinM7O+9R4l rGnZoUxvAAlP1avp5SgEyv2SuUkEifQn9VML+KJH+ttD X-Google-Smtp-Source: AGRyM1u1ElSp8R+u9W5b8+qezkSSOU440DqMQdONsuMQt/2OgXoy9TOaA+o1M5QgSu7r9i7LRyPuaSJWWsHaeyHtWrU= X-Received: by 2002:a67:1a06:0:b0:358:418f:b8a1 with SMTP id a6-20020a671a06000000b00358418fb8a1mr329070vsa.56.1658510222382; Fri, 22 Jul 2022 10:17:02 -0700 (PDT) In-Reply-To: Received-SPF: pass client-ip=2607:f8b0:4864:20::e30; envelope-from=aconchillo@gmail.com; helo=mail-vs1-xe30.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guile-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Developers list for Guile, the GNU extensibility library" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guile-devel-bounces+guile-devel=m.gmane-mx.org@gnu.org Original-Sender: "guile-devel" Xref: news.gmane.io gmane.lisp.guile.devel:21268 Archived-At: --000000000000a95a6f05e4680068 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 22, 2022 at 4:45 AM Greg Troxel wrote: > > Aleix Conchillo Flaqu=C3=A9 writes: > > >> Using INADDR_ANY instead of INADDR_LOOPBACK makes it convenient when > >> starting the web server inside containers without the need to having t= o > >> specify INADDR_ANY all the time. This is the default in most libraries > >> and languages. > > I may be an outlier, but I don't think we should optimize for > containers. I think that by default, most things that can reasonably > just listen on localhost should and those that want wider scope can > configure them (which should be easy and apparently is). > > It seems this was an earlier conscious choice, from reading the patched > docs. > > Agree about the container comment. As I said on the other email, I have no idea why I wrote container there since I never run Guile in a container. >> This doesn't break backwards compatibility since INADDR_LOOPBACK is also > >> included in INADDR_ANY. > > It does break compat because the previous way had a security property > that this one doesn't. This is fundamentally a disagreement about what > "works" means. Some people think works primarily means "when I click X > I see Y" and others thinks works primarily means "security properties > (that nothing bad happens" are upheld". > Makes sense as well. Thank you for your input! Best, Aleix --000000000000a95a6f05e4680068 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Jul 22, 2022 at 4:45 AM Greg Troxel <gdt@lexort.com> wrote:

Aleix Conchillo Flaqu=C3=A9 <aconchillo@gmail.com> writes:

>> Using INADDR_ANY instead of INADDR_LOOPBACK makes it convenient wh= en
>> starting the web server inside containers without the need to havi= ng to
>> specify INADDR_ANY all the time. This is the default in most libra= ries
>> and languages.

I may be an outlier, but I don't think we should optimize for
containers.=C2=A0 I think that by default, most things that can reasonably<= br> just listen on localhost should and those that want wider scope can
configure them (which should be easy and apparently is).

It seems this was an earlier conscious choice, from reading the patched doc= s.


Agree about the container comment. = As I said on the other email, I have no idea why I wrote container there si= nce I never run Guile in a container.

>> This doesn't break backwards compatibility since INADDR_LOOPBA= CK is also
>> included in INADDR_ANY.

It does break compat because the previous way had a security property
that this one doesn't.=C2=A0 This is fundamentally a disagreement about= what
"works" means.=C2=A0 Some people think works primarily means &quo= t;when I click X
I see Y" and others thinks works primarily means "security proper= ties
(that nothing bad happens" are upheld".

=
Makes sense as well. Thank you for your input!

<= div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-serif= ">Best,

Aleix
--000000000000a95a6f05e4680068--