Subject: [sunset4] let 'localhost' be localhost

From: Erik Nygren <[email-masked]>
Date: Mon, 17 Oct 2016 12:19:44 -0400

In the hopes of allowing devices to some day drop their IPv4 stacks, one
thing we will need to keep an eye out for is any behavior that encourages
hard-coding 127.0.0.1 or ::1 rather than using a "localhost" abstraction.
In the W3C WebAppSec Secure Context discussion, there has been concern that
"localhost" shouldn't be a "secure context" (unlike 127.0.0.1 and ::1) due
to resolvers not always returning localhost.  I worry that this could
result in increased use of "127.0.0.1" (such as by web pages containing
URLs instructing clients to talk to a localhost resource service).

Mike West has written up a "let localhost be localhost" draft to cover this:

     https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-02

I'm sure feedback is quite welcome (and I wonder if sunset4 might be one
reasonable place to pick up this work?).

Some background:
https://github.com/w3c/webappsec-secure-contexts/issues/43

- Erik

---

From: "Marc Blanchet" <[email-masked]>
Date: Mon, 17 Oct 2016 13:51:10 -0400

> reasonable place to pick up this work?).

interesting issue. It certainly relates to name resolution not behaving 
the way it should.

But yes, sunset4 make sense to pick up this work.

would one of you two be in Seoul? If yes, we could carve up 5-10 minutes 
in the agenda for that topic.

Marc.

> _______________________________________________
> sunset4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sunset4

---

From: Mark Andrews <[email-masked]>
Date: Tue, 18 Oct 2016 10:53:53 +1100

I would argue that sunset4 doesn't have the depth of expertise to
do this properly.  That the issues are much more nuanced than the
draft makes out.

I would argue that there needs to be the equivalent of a local DNS
server for the zone localhost.  More than A and AAAA records need
to be able to be returned.

I would argue that the root zone needs a insecure delegation for
localhost.

I would argue that the input string "localhost" needs to be treated
as absolute.  i.e. search lists don't apply.

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]