Re: [PATCH] web: default to INADDR_ANY instead of INADDR_LOOPBACK

[Maxime Devos]

On 22-07-2022 02:44, Aleix Conchillo Flaqué wrote:

ping. easy one but might be more controversial.

On Wed, Feb 2, 2022 at 4:26 PM Aleix Conchillo Flaqué <aconchillo@gmail.com> wrote:

Using INADDR_ANY instead of INADDR_LOOPBACK makes it convenient when
starting the web server inside containers

    I don't see what containers have to do with anything? If you want it
    to access the Internet, just don't do a network container (don't
    create a new network namespace).  Or to reduce access, do create a
    new network namespace but set up port forwarding (which I would
    expect to work with loopback).

without the need to having to
specify INADDR_ANY all the time.

I don't recommend this as a default, as it opens up potential security problems (some programs open a web server for local communication on the computer). INADDR_LOOPBACK is a safe default, anyone needing something else and knowing their use is safe can easily override to INADDR_ANY.

> This is the default in most libraries and
>         languages.
      Is ad populum. Plenty of bad choices have been made in the past,
      see e.g. all the CVEs, so I don't think this is a good argument. 
      (It is an argument if you are switching to INADDR_ANY for
      _consistency_, but the patch appears to be for other purposes.)

Greetings,
Maxime.

OpenPGP_0x49E3EE22191725EE.asc
Description: OpenPGP public key

OpenPGP_signature
Description: OpenPGP digital signature