6 ms·

Can you define "local network"? Probably not. Most large enterprises own publicly-routable IP space for internal use. Internal doesn't mean 192.168.0.0/24. foo.

Can you define "local network"? Probably not. Most large enterprises own publicly-routable IP space for internal use. Internal doesn't mean 192.168.0.0/24. foo.corp.example.com could resolve to 9.10.11.12 and still be local. What about IPv6? It's a nonsense argument fraught with corner cases.

mystifyingpoi 1y ago
Not to be snarky, but that's a good example of "perfect being the enemy of good". You are totally right that there are corner cases, sure. But that doesn't stop us from tackling the low hanging fruit first. Which is, as you say, localhost and LAN (if present).
duskwuff 1y ago
> Can you define "local network"? Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. If your network is large enough that it consists of multiple routed network segments, and you don't have any ACLs between those segments, then yeah, you won't be fully protected by this browser feature. But you aren't protected right now either, so nothing's getting worse, it's just not getting better for your specific use case.
- donnachangstein 1y ago
  > Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. Fantastic. Well, Google doesn't agree The proposal defines it along RFC1918 address space boundaries. The spitballing back and forth in the GitHub issues about which imaginary TLDs they will or won't also consider "local" is absolutely horrifying.
  - deleted 1y ago
    [deleted]
  - account42 1y ago
    Cool so it will protect 99.999% of home networks. Compared to 0% which are protected now. Sounds great!
eschaton 1y ago
It should not even be able to communicate with the local network at all, it’s a goddamn web page. It should be restricted to just communicate with the server that hosts it and that’s it.
emushack 1y ago
They define it the explainer this was originally based on: (https://github.com/WICG/private-network-access/blob/main/explainer.md https://github.com/WICG/private-network-access/blob/main/exp...) Quote: We extend the RFC 1918 concept of private IP addresses to build a model of network privacy. Concretely, there are 3 kinds of private network requests: public -> private public -> local private -> local

mystifyingpoi 1y ago

Not to be snarky, but that's a good example of "perfect being the enemy of good". You are totally right that there are corner cases, sure. But that doesn't stop us from tackling the low hanging fruit first. Which is, as you say, localhost and LAN (if present).

duskwuff 1y ago

> Can you define "local network"? Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. If your network is large enough that it consists of multiple routed network segments, and you don't have any ACLs between those segments, then yeah, you won't be fully protected by this browser feature. But you aren't protected right now either, so nothing's getting worse, it's just not getting better for your specific use case.

donnachangstein 1y ago
> Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. Fantastic. Well, Google doesn't agree The proposal defines it along RFC1918 address space boundaries. The spitballing back and forth in the GitHub issues about which imaginary TLDs they will or won't also consider "local" is absolutely horrifying.
- deleted 1y ago
  [deleted]
- account42 1y ago
  Cool so it will protect 99.999% of home networks. Compared to 0% which are protected now. Sounds great!

eschaton 1y ago

It should not even be able to communicate with the local network at all, it’s a goddamn web page. It should be restricted to just communicate with the server that hosts it and that’s it.

emushack 1y ago

They define it the explainer this was originally based on: (https://github.com/WICG/private-network-access/blob/main/explainer.md https://github.com/WICG/private-network-access/blob/main/exp...) Quote: We extend the RFC 1918 concept of private IP addresses to build a model of network privacy. Concretely, there are 3 kinds of private network requests: public -> private public -> local private -> local