If you want analogies, this is like walking into a bank to do business and the security guard checking to see if you're wearing a mask.
People are good at inventing analogies that support their point of view.
Why Is This Website Port Scanning Me?
251–260 of 448 posts
Re: Why Is This Website Port Scanning Me?
#252> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…
I think it's a bit more like going on to a shop and trying to open all the doors, cupboards and drawers to see which ones are locked ;)
That's a bad analogy. It wrong because you can see what doors, cupboards and drawers are available for the public. Doors that are in-reach but that shouldn't be used by the public have signs like "restricted access" or "employees only". You can't do that with the internet. You can't see that a port is not available to you until you try it.
If you want to continue using that analogy, then you have to consider that everybody is blind and deaf, and checking to see what's locked is the only way to know if something is available.
Re: Why Is This Website Port Scanning Me?
#253Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…
> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…
>You’ve never used a web-app chat client?
BOSH? Awkward, but it works without websockets.
Re: Why Is This Website Port Scanning Me?
#254Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…
> Opening a WebSocket to netcat dumps out a HTTP request, so it seems unlikely that you'd be able to talk with anything that doesn't talk HTTP and WebSockets. AFAIK this is only partly true, if the web server does not support the websocket protocol, you cannot connect to it [0]. So if I am understanding this correctly, WebSockets only support a small subset of HTTP and it should therefore not be possible to use them…
But you still have to make sure all programs bound to local ports handle WebSocket requests gracefully.
Binding to 127.0.0.1 is a nicely cross-platform way to do inter-process communication (I've done so in the past to mitigate JVM startup/warmup issues).
I've never written this code defensively, because if you run programs that throw random shit at locally-bound ports, that's your responsibility. The web community has decided it's a good idea to give arbitrary websites that capability. It's true that the 'random shit' may only take the form of WebSocket requests, but this is only a minor comfort.
From my perspective, this needs to be locked down.
edit: On second thought, you have always been able to trigger similar requests by e.g. just setting the src attribute of an image: Opera aside, browsers apparently never implemented proper cross-network protections. So from now on, I'll be extra careful to make sure all my servers can handle unexpected, potentially malicious HTTP requests even when bound to 127.0.0.1.
That said, I still do think this is something that needs fixing on the browser-side.
Re: Why Is This Website Port Scanning Me?
#255Earlier quoted context omitted.
I think it's a bit more like going on to a shop and trying to open all the doors, cupboards and drawers to see which ones are locked ;)
That's a bad analogy. It wrong because you can see what doors, cupboards and drawers are available for the public. Doors that are in-reach but that shouldn't be used by the public have signs like "restricted access" or "employees only". You can't do that with the internet. You can't see that a port is not available to you until you try it. If you want to continue using that analogy, then you have to consider that eve…
Hmm, then how about going to the changing room area and trying every door instead of waiting for the guy to tell you which one to go to?
Re: Why Is This Website Port Scanning Me?
#256Earlier quoted context omitted.
I see irony in all this web functionality. Back in the 90's if you wanted an ohms law calculator you had to go download a poorly written program from some random website. Network admins started locking down what you could download, run, and install due to security problems. Flash became a hit and they started piling on features in the browser so you could run things dynamically without having to download something. F…
The browser is basically the reinvention of the operating system. Its huge advantage is that it's built on the assumption that the user is trusted and the code isn't. In contrast most operating systems are designed on the assumption that code is absolutely trusted, but the user isn't. That's why rights management in Windows is concerned with who's allowed to access which file, while rights management in Firefox is co…
> Its huge advantage is that it's built on the assumption that the user is trusted and the code isn't. In contrast most operating systems are designed on the assumption that code is absolutely trusted, but the user isn't.
It's not necessarily an advantage, it's just a different threat model. An OS is protecting against an attacker already having access to the system (whether physically or over network.) The assumption is that the system is working properly and it's the operator that is malicious.
For the browser, the assumption is that the operator is working properly, but the systems they will be accessing are malicious.
The browser security measures are like a guard at the castle gate, allowing or preventing people from entering. The OS security is like locks on the doors inside the castle so that only people with the right keys can get into various protected rooms.
Both are necessary because they're preventing different things (access to the system vs. access once you're already inside the system.)
Re: Why Is This Website Port Scanning Me?
#257> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…
I think it's a bit more like going on to a shop and trying to open all the doors, cupboards and drawers to see which ones are locked ;)
Isn't that the wrong analogy?
In this case, eBay is the shop, and I'm the customer. It's like walking into eBay and when I walk in I have to empty out all of my pockets and open my phone screen to show them that no one is telling me what to shop for (VNC).
Re: Why Is This Website Port Scanning Me?
#258Earlier quoted context omitted.
You can't cross compile anything other than crypto miners or how does it not help anything else?
Most of the other uses are pointless. I don't need WebRTC for chat, because IRC is still working just fine. I don't need WebRTC for video calls, because Skype is still working just fine. I don't need WebRTC and WebAssembly for online gaming, because I have Steam to install games locally. Plus latency and performance of games emscripten-ed to wasm tends to be atrocious. So the only uses where I have seen the new Web*…
Plenty of downvotes, but no productive suggestion of what use-case would be best served with WebRTC ...
Re: Why Is This Website Port Scanning Me?
#259Is there a setting or something in either chrome or FF to block websites from being able to port scan you?
Supposedly you can disable websockets in Firefox by setting network.websocket.max-connections in about:config to 0.
Re: Why Is This Website Port Scanning Me?
#260Earlier quoted context omitted.
That's a bad analogy. It wrong because you can see what doors, cupboards and drawers are available for the public. Doors that are in-reach but that shouldn't be used by the public have signs like "restricted access" or "employees only". You can't do that with the internet. You can't see that a port is not available to you until you try it. If you want to continue using that analogy, then you have to consider that eve…
Hmm, then how about going to the changing room area and trying every door instead of waiting for the guy to tell you which one to go to?
I made this edit to the post you replied to. You probably missed it:
> If you want to continue using that analogy, then you have to consider that everybody is blind and deaf, and checking to see what's locked is the only way to know if something is available.
About this:
> instead of waiting for the guy to tell you which one to go to?
How does that translate to TCP/IP? What is "the guy" representing? The way I see it, there is no guy.