On Thu, 19 Jan 2006 11:00:58 -0500, "Joseph Geretz"
>When did 127.0.0.1 become different than localhost?
>I think this happened around the same time as SP2 when Microsoft got the
>idea that it might be a good idea for them to get into the Security /
>Firewall business. NOT!!!!
Actually, they HAVE to be there, and it's WAY overdue!
Imagine you move into a new neighborhood, and, eager to please, you
tell all your neighbors; "drop in whenever you feel like it, here are
keys to the house, don't be a stranger".
After a while, you start to notice things going missing around the
house, then cigarette butts and used syringes lying around, and
finally when you find human turds in the sink do you realise you need
some security clue after all.
But you don't want to offend your "friends", so you make excuses even
as you try to regain your privacy; "sorry you have to knock on the
door, I lost the key and had to change the locks and only have one
that fits, don't be a stranger, you're still welcome, but knock first"
So it was when MS brought out IE4 to compete with Netscape. It was
"Hell, if Netscape lets you drop cookies and JavaScript your visitors'
PCs, we'll give you even stronger tools like ActiveX so you can like
totally OWN their PCs! Develop for IE today!!"
Now SP2 is trying to stuff Pandora back in the box.
>Why the @#@^$#^&&* does 127.0.0.1 produce a
>different effect in certain circumstances than localhost?
IE's security model works as a set of zone contexts; Restricted,
Internet, Intranet, Trusted and My Computer (local HD). Before, My
Computer zone was wide open; if you'd made it as far as the local HD,
you could do what you like. SP2 changes that slightly; there's an
awareness that because it's so easy to attain access to this zone, one
has to limit what can be done in this zone too.
Asyou say, whatever zone policy applies to localhost should apply to
127.0.0.1 too, so the variance is worrying. Either there's no
localhost=127.0.0.1 in the HOSTS file, or you may have hit some other
hassle. I know that SP2 has created problems where 127.0.0.x (where x
is not 1) were no longer treated as localhost, breaking some printers.
>For example, I've got a Visual Studio Web project which defines the path to
>the project file as http://localhost/MyApp/MyApp.csproj. This works on my
>workstation, but when I ported this over to another developer's workstation,
>Visual Studio was unable to open the project. After fiddling around with
>this for some time, I discovered that http://127.0.0.1/MyApp/MyApp.csproj
>would work on that workstation. What is this about? Aren't localhost and
>127.0.0.1 supposed to be the same thing?
I think they are "the same thing" only by vrtue of a definition
usually found in HOSTS. HOSTS is comonly attacked by malware and thus
may often be renamed away or wiped, so it would be introducing a
needless fragility to rely on localhost when you could use 127.0.0.1
>How can I loosen up (security?) restrictions on that box so that
>localhost access will work?
You don't - especially if developing sware for use on arbitrary PCs.
You don't want to say "our software requires you to drop your knickers
and bend over", nor do you want to create a fragility that has your
service agents wading through "how to check that localhost is defined
in HOSTS" on every "it doesn't work" support call :-)
>---------- ----- ---- --- -- - - - -
Don't pay malware vendors - boycott Sony
>---------- ----- ---- --- -- - - - -
Similar Threads
