Re: [DNSOP] Status of "let localhost be localhost"?

[Richard Barnes <[e-mail]>]

On Wed, Aug 2, 2017 at 9:10 AM, Ted Lemon <[e-mail]> wrote:

> On Aug 2, 2017, at 9:02 AM, Richard Barnes <[e-mail]> wrote:
>
> But of course having IP addresses in URLs is both a PITA for developers
> and an anti-pattern more generally.
>
>
> While true, I would argue that this is actually a problem.   E.g., I
> actually literally cannot surf to a link-local URL without having a DNS
> record for it, because http://[
> <http://%5Bfe80::1806:ec37:3d5f:9580%25en0%5D/>fe80::1806:ec37:3d5f:
> 9580%en0]/ <http://%5Bfe80::1806:ec37:3d5f:9580%25en0%5D/> has an
> interface identifier in it, and modern browsers consider this an
> anti-pattern, I guess.   And you don't want to put link-local addresses in
> DNS, even if it made sense to do so, so what is one to do?   I'm not
> convinced that this anti-pattern is the wrong anti-pattern, but here we
> have two examples of it being problematic, in the least.
>
> If "localhost" were properly defined to be loopback, then applications
> could just hard-wire resolution, and not depend on the good graces of the
> platform resolver.  As, for example, Firefox does with ".onion" today:
>
>
> Right.   But there was actually a long discussion on why that's
> problematic when we were doing the .onion RFC.   The reason is that one
> can't count on any particular piece of application software correctly
> interpreting the rightmost label.   We can write RFCs encouraging it, but
> if I am writing a URL into a piece of HTML, I have no idea whether the
> thing that interprets the HTML will or will not do the right thing.
>

The point you're missing here is that the application is both the thing
relying on the definition of "localhost" and the thing empowered to enforce
the RFC.  If the application doesn't care whether "localhost" resolves to
anything special, then it can pass it to the platform and take its
chances.  If it does, it can hard-wire it to loopback.


> We just accept that as a risk with .onion because we don't have a better
> option, but for localhost we definitely do have a better option.   That's
> all I'm saying.
>

Using IP addresses is not a better option.

--Richard