[deleted]
I can see your local web servers
131–140 of 198 posts
Re: I can see your local web servers
#132Earlier quoted context omitted.
The thing to do is not run a web browser on that machine. Run the servers in a VM.
But this seems to be able to see servers accessible to the local machine, so if my Dev server in a VM is accessible from my browser, it's accessible to any webpage in my browser?
The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?
Re: I can see your local web servers
#133Earlier quoted context omitted.
Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with , you just get a broken and/or blank page. I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users. (Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encoun…
I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.
Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.
Re: I can see your local web servers
#134Funny enough, the site is reporting port 3000 to be running a web server. It is not - according do nmap and my knowledge. Any ideas on this?
If like me you saw the bright red text "If you see any results like localhost:3000 is available!" as meaning :3000 was actually available, it's just an example. The yellow box above seems to be where the results would actually be.
I must admit, it was exactly this. I read the text without using my brain properly.
Please accept my sincere apologies.
Re: I can see your local web servers
#135When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?
Re: I can see your local web servers
#136I wonder if you could use the websocket API to scan for other (non-http) open ports.
Re: I can see your local web servers
#137Earlier quoted context omitted.
But this seems to be able to see servers accessible to the local machine, so if my Dev server in a VM is accessible from my browser, it's accessible to any webpage in my browser?
The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?
not really, no. i still don't see what the reverse proxy or the VM are bringing to the table here. If i'm understanding the necessary CORS config here, it's to simply not send any access-control-allow-origin header, which does not require a VM or reverse proxy, most HTTP services do that by default.
simply being accessed through a reverse proxy instead of directly doesn't add any additional security
Re: I can see your local web servers
#138"If you see any results like 192.168.0.4:3000 is available!, you should tell your colleague to secure whatever she has running on that port" Someone's going to access this page at $BIGCORP with an overly trigger-happy IDS and get a fun morning meeting with IT to un-quarantine their machine.
Yup, excited for the meeting. Haven't seen those guys in a while. Was expecting to learn some security techniques, instead got essentially port scanned :)
Whereas I'm learning that my network is fairly secure against this type of port scanning.
Re: I can see your local web servers
#139Earlier quoted context omitted.
Sure, but it helps and it is cheap. I also don't use a common subnet and enjoy uMatrix. Obscurity is a viable strategy as part of a layered defence. ;)
True. My main problem is that blocking WebRTC blocks some very interesting methods to "re-decentralize" the web, which are only viable if most people don't have it disabled.
This is a classic conflict that I’ve observed a lot. Similarly, widespread SSL pinning and app sandboxing makes it difficult to reverse engineer opaque outgoing traffic. It might be more secure, but you also cannot easily inspect what data a sandboxed, cert-pinning service is sending to the outside world.
I think it’s probably something like “security, privacy, anonymity... pick two.”
Re: I can see your local web servers
#140Earlier quoted context omitted.
If it's got CORS enabled you can do a hell of a lot more than ping your server.
Wait, what? I think you means the opposite. If it's got CORS enabled, then you can't do anything unless the request is originating from the relevant domain. Anyway, do not rely on firewalls (and CORS is a firewall) as the sole security measure. Do not create unauthenticated endpoints unless you want everybody to use them.
To elaborate, I meant a permissive CORS policy, which is what I see most often.