Re: [DNSOP] Status of "let localhost be localhost"?

Ted Lemon <mellon@fugue.com> Wed, 02 August 2017 20:27 UTC

From: Ted Lemon <mellon@fugue.com>
Message-Id: <F19EC009-0301-4C23-BC27-FFF021C77C02@fugue.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_F2F41092-B93E-4544-A6E4-3DE1B038F04A"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Wed, 02 Aug 2017 16:27:45 -0400
In-Reply-To: <20170802180221.n7ezh5yzr5cuxklz@mycre.ws>
Cc: Mike West <mkwst@google.com>, Richard Barnes <rlb@ipv.sx>, dnsop <dnsop@ietf.org>, Jacob Hoffman-Andrews <jsha@eff.org>, william manning <chinese.apricot@gmail.com>
To: Robert Edmonds <edmonds@mycre.ws>
References: <05e469cf-1325-89fc-4a81-661f8647e869@eff.org> <CAKXHy=ctB=LZkX9j=8-Jy0NkTAs2tAesa4gmFhfp94O5=9U4TA@mail.gmail.com> <1dbb47a4-c6e2-97d2-a1d7-ce6c65a4042a@eff.org> <CACfw2hiX7U74n9+defcYiD7jLKZeLhtLM6WP5YM_WuAoA8ecYQ@mail.gmail.com> <CAL02cgRg6k7=b7berKr9J+9aL8PTS81nJ_yXQO8QTYqgiqXSbg@mail.gmail.com> <6B25B24C-4C80-4A04-BF27-2306F4A77EF6@fugue.com> <CAL02cgQ2z9Fze-Q2QWQ=+PHJEO_S3bTaq1fPJ6XSEwFUQ=ftvw@mail.gmail.com> <CAKXHy=eV0OBW+S308rdiHZ523foOgxYNB3i07RkeFJiTjMYQEQ@mail.gmail.com> <D9568E51-3C48-4BA3-9797-3F7756E857C9@fugue.com> <20170802180221.n7ezh5yzr5cuxklz@mycre.ws>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/dYC5Ayc8_M1NfkBdTn5RGGOab5g>
Subject: Re: [DNSOP] Status of "let localhost be localhost"?
Precedence: list

On Aug 2, 2017, at 2:02 PM, Robert Edmonds <edmonds@mycre.ws> wrote:
> draft-west-let-localhost-be-localhost-03 upgrades the requirements in
> RFC 6761 §6.3 to make them much stricter, for all applications,
> converting SHOULDs to MUSTs, etc. So we're not arguing about whether
> localhost "should" be treated specially, but whether it MUST be treated
> specially, by all applications. Can the W3C not impose stricter
> requirements on browser developers even if 6761 doesn't impose mandatory
> treatment for "localhost"?

It should be MUST in both cases.   But writing that in an RFC doesn't make it so.   Bear in mind when you look at the W3C document that it is talking about what would be ideal, not what is actually present in browsers.

As an app developer worried about security footprint, I would be wiser to be cautious and use ::1 or 127.0.0.1, rather than using localhost and relying on the name resolution infrastructure.   But the use case that I would be most skeptical about is using localhost in a URL.   I think that should be MUST NOT.   Apparently there is not wholehearted agreement on this topic, however... :)

[DNSOP] Status of "let localhost be localhost"? Jacob Hoffman-Andrews
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Jacob Hoffman-Andrews
Re: [DNSOP] Status of "let localhost be localhost… Mark Andrews
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… william manning
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Joe Abley
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Joe Abley
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Tony Finch
Re: [DNSOP] Status of "let localhost be localhost… Paul Vixie
Re: [DNSOP] Status of "let localhost be localhost… Jacob Hoffman-Andrews
Re: [DNSOP] Status of "let localhost be localhost… Robert Edmonds
Re: [DNSOP] Status of "let localhost be localhost… Matthew Pounsett
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Jacob Hoffman-Andrews
Re: [DNSOP] Status of "let localhost be localhost… George Michaelson
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Mark Andrews
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… John Levine
[DNSOP] Fwd: Status of "let localhost be localhos… william manning
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Erik Nygren
Re: [DNSOP] Status of "let localhost be localhost… Stuart Cheshire
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Robert Edmonds
Re: [DNSOP] Status of "let localhost be localhost… Ray Bellis
Re: [DNSOP] Status of "let localhost be localhost… Peter van Dijk
Re: [DNSOP] Status of "let localhost be localhost… John Levine
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Paul Hoffman
Re: [DNSOP] Status of "let localhost be localhost… Richard Barnes
Re: [DNSOP] Status of "let localhost be localhost… Paul Hoffman
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Paul Vixie
Re: [DNSOP] Status of "let localhost be localhost… Jacob Hoffman-Andrews
Re: [DNSOP] Status of "let localhost be localhost… Tony Finch
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Paul Hoffman
Re: [DNSOP] Status of "let localhost be localhost… Tony Finch
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Mike West
Re: [DNSOP] Status of "let localhost be localhost… Ted Lemon
Re: [DNSOP] Status of "let localhost be localhost… Warren Kumari
Re: [DNSOP] Status of "let localhost be localhost… John Levine
Re: [DNSOP] Status of "let localhost be localhost… Mark Andrews
Re: [DNSOP] Status of "let localhost be localhost… John R Levine