Address types [LWN.net]

Address types

Posted Jul 24, 2026 9:12 UTC (Fri) by mbunkus (subscriber, #87248)
In reply to: Address types by farnz
Parent article: Firefox 153 released

Spot on.

I'd even go one step further and argue that "private" or "local" doesn't even have any real meaning wrt. security. Just because it runs on the same layer 2 broadcast domain doesn't mean it should be trusted. Just because it runs in the same physical or virtual machine doesn't mean it should be trusted. And yes, this includes the loopback interface[1].

Security has meaning in specific contexts & under well-stated conditions. It can mean that you trust "local" machines in the same "private" subnet enough to allow ssh connections from them, because you control all of them & the underlying network hardware, but that's a policy decision by assigning semantics to the property "source IP subnet". Those semantics aren't inherent or automatically detectable.

[1] There have been way too many instances of incredibly sensitive programs such as anti-virus tools have a port open on 127.0.0.1 & trusted connections from it, only to be exploited by malware running in your browser or elsewhere on your host.

to post comments

Security of "private" or "local" addresses

Posted Jul 24, 2026 9:33 UTC (Fri) by farnz (subscriber, #17727) [Link] (1 responses)

In the browser context, the meaning is reversed from what you're saying - which is the "BeyondCorp" position of "everything must be treated as exposed to attackers anyway, so why not set things up such that you don't trust the local network more than the wider Internet?.

Browsers want to treat the local network as less trusted than the wider Internet, on the basis that it's more likely that someone has unintentionally trusted the local network than that they've unintentionally trusted the wider Internet.

Security of "private" or "local" addresses

Posted Jul 24, 2026 10:27 UTC (Fri) by knewt (subscriber, #32124) [Link]

Isn't it actually the opposite of this? It's still that you're not trusting the wider Internet here, right?

The way the new restrictions work, iirc, is that a website from a 'less trusted' address space is not allowed to talk to devices from a 'more trusted' address space unless you give specific permission.

So a 'remote' website that wants to do so - eg, a device/iot management page that wants to talk directly to the device from within your browser, or the plex.tv web app talking directly to your local media server - is not trusted to talk to the local device by default.

And iirc it also goes local -> localhost. So in the common situation nowadays of having software running on your local machine that uses a web management interface as the UI, listening only on localhost, some random website - even a website running on another local machine - can't access that without you giving it permission.