TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Deprecate 0.0.0.0 for Private Network Access

60 点作者 campuscodi10 个月前

6 条评论

diggan10 个月前
&gt; Chrome&#x27;s PNA protection can be bypassed using the IP address 0.0.0.0 to access services listening on the localhost on macOS and Linux.<p>It seems they&#x27;re saying if you have a service listening to localhost (private), Chrome is supposed to not resolve 0.0.0.0 (public) to localhost, yet it currently does so.<p>So seems to me they&#x27;re solving a security bug. But if I got this right, it&#x27;s surprising how it got like that in the first place, doesn&#x27;t make sense in any scenario I can think of to resolve 0.0.0.0 to localhost? Why would a browser try to resolve 0.0.0.0 to anything in the first place?
评论 #41184408 未加载
评论 #41184572 未加载
评论 #41184383 未加载
评论 #41187758 未加载
p1mrx10 个月前
No mention of [::]? Maybe they&#x27;ll discover that one in a couple years.
aa_is_op10 个月前
Related: <a href="https:&#x2F;&#x2F;www.oligo.security&#x2F;blog&#x2F;0-0-0-0-day-exploiting-localhost-apis-from-the-browser" rel="nofollow">https:&#x2F;&#x2F;www.oligo.security&#x2F;blog&#x2F;0-0-0-0-day-exploiting-local...</a>
评论 #41184690 未加载
评论 #41185787 未加载
jesprenj10 个月前
Shouldn&#x27;t they instead add 0.0.0.0&#x2F;8 to the list of private networks, because it&#x27;s possible that 0.0.0.0&#x2F;8 might be private?
评论 #41187612 未加载
amluto10 个月前
I can’t tell from reading the Chrome page (<a href="https:&#x2F;&#x2F;developer.chrome.com&#x2F;blog&#x2F;private-network-access-preflight&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developer.chrome.com&#x2F;blog&#x2F;private-network-access-pre...</a>) or the linked WICG draft: do these new protections apply to the usual CORS-bypassing requests: form submissions and ordinary navigation?
archo10 个月前
pls excuse my aged brain, now with a new blood clot.<p>IIRC adding 0.0.0.0 0.0.0.0 to your hosts file helps ???<p>On macOS;<p>% ping 0.0.0.0 PING 0.0.0.0 (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ping: sendto: Socket is not connected Request timeout for icmp_seq 1 ping: sendto: Socket is not connected Request timeout for icmp_seq 2 ping: sendto: Socket is not connected Request timeout for icmp_seq 3<p>% ping 0 PING 0 (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected<p>ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ping: sendto: Socket is not connected Request timeout for icmp_seq 1 ping: sendto: Socket is not connected Request timeout for icmp_seq 2 ping: sendto: Socket is not connected Request timeout for icmp_seq 3 ping: sendto: Socket is not connected<p>Is this correct ???
评论 #41193855 未加载