News for hackers. Stuff that matters.

A comment on Why Is This Website Port Scanning Me?. Parent comment

Re:Why Is This Website Port Scanning Me? by oplav on Wednesday May 20, 2020 @10:59AM (#23247626)
If the user decides to run a service on their intranet or localhost with a wide open CORS policy, isn't that their choice?

Forgoing CORS and making all inter domain requests user opt-in would make the web experience a lot worse, IMO. Making all intranet or localhost requests user opt-in seems less disruptive.

[ Parent | on HN ]
Re:Why Is This Website Port Scanning Me? by souterrain on Wednesday May 20, 2020 @11:38AM (#23248162)
However, TCP sockets can't publish CORS policies.

In the case of scanning, a CORS denial can still reveal information about the user's internal network, as a CORS denial is a different result than a network timeout or a TCP RST.

[ Parent | on HN ]