Re:.INTERNAL is now reserved for private-use applications
by im3w1l on Saturday August 10, 2024 @05:32AM
(#41208352)
localhost is pretty special in that it's like the only domain typically defined in a default /etc/hosts.
Re:.INTERNAL is now reserved for private-use applications
by thayne on Saturday August 10, 2024 @12:13PM
(#41210465)
No, you can't. Besides the /etc/hosts point mentioned in the sibling, localhost is often hard-coded to use 127.0.0.1 without doing an actual DNS lookup.
Re:.INTERNAL is now reserved for private-use applications
by JonathonW on Saturday August 10, 2024 @12:20PM
(#41210508)
> One can resolve "localhost" (even via an upstream resolver) to an arbitrary IP address. At least on my Linux system "localhost" only seems to be specially treated by systemd-resolved (with a cursory attempt I didn't succeed in getting it to use an upstream resolver for it).
The secure context spec [1] addresses this-- localhost should only be considered potentially trustworthy if the agent complies with specific name resolution rules to guarantee that it never resolves to anything except the host's loopback interface.
[1] https://w3c.github.io/webappsec-secure-contexts/#localhost
So it's not a rock-hard guarantee that traffic to localhost never leaves your system. It would be unconventional and uncommon for it to, though, except for the likes of us who like to ssh-tunnel all kinds of things on our loopback interfaces :-)
The sweet spot of security vs convenience, in the case of browsers and awarding "secure origin status" for .internal, could perhaps be on a dynamic case by case basis at connect time:
- check if it's using a self-signed cert - offer TOFU procedure if so - if not, verify as usual
Maaaaybe check whether the connection is to an RFC1918 private range address as well. Maybe. It would break proxying and tunneling. But perhaps that'd be a good thing.
This would just be for browsers, for the single purpose of enabling things like serviceworkers and other "secure origin"-only features, on this new .internal domain.