Project server should only bind to localhost by default #143

In the documentation you point out that the project server is insecure.

For the commonest case (wanting to test on machine running the project server) this could be largely mitigated by having it bind only to localhost.

Of course, it would then be useful to allow it to be reconfigured for other uses (classroom, collaboration &c.).

Is this hard or otherwise undesirable?

In the documentation you point out that the project server is insecure. For the commonest case (wanting to test on machine running the project server) this could be largely mitigated by having it bind only to localhost. Of course, it would then be useful to allow it to be reconfigured for other uses (classroom, collaboration &c.). Is this hard or otherwise undesirable?

You can expect that this will remain biased toward my view of the “commonest” case: I often like to run the project server and view the site on machines nearby (e.g., iPhone, virtualized Windows, etc)

That said, it’s easy to adjust the project server’s behavior with the #:listen-ip argument to restrict the server to localhost. I suppose there would be three choices:

Introduce a new setup value to control this.
Introduce a new switch for raco pollen start to control this.
Both.

You can expect that this will remain biased toward my view of the “commonest” case: I often like to run the project server and view the site on machines nearby (e.g., iPhone, virtualized Windows, etc) That said, it’s easy to adjust the project server’s behavior with the [`#:listen-ip` argument](https://github.com/mbutterick/pollen/blob/master/pollen/private/project-server.rkt#L37) to restrict the server to `localhost`. I suppose there would be three choices: 1. Introduce a new `setup` value to control this. 2. Introduce a new switch for `raco pollen start` to control this. 3. Both.

Making a setup value seemed like overkill. If you do raco pollen start --local then the project server will be restricted to localhost.

Making a `setup` value seemed like overkill. If you do `raco pollen start --local` then the project server will be restricted to localhost.

Thanks for the switch and for documenting it.

However, it is the wrong way round: the server is insecure by default. Yes, this is documented, but that's not an excuse. Bugs in the server or elsewhere could cause the local user serious problems that are impossible if the server is listening only on a localhost address, and it's also easier, with this being the default behavior, to do it by mistake, e.g. with a typo.

Please think again!

Thanks for the switch and for documenting it. However, it is the wrong way round: the server is insecure by default. Yes, this is documented, but that's not an excuse. Bugs in the server *or elsewhere* could cause the local user serious problems that are impossible if the server is listening only on a localhost address, and it's also easier, with this being the default behavior, to do it by mistake, e.g. with a typo. Please think again!

Bugs in the server or elsewhere could cause the local user serious problems

What would be a common, practical case where this specific risk arises?

> Bugs in the server or elsewhere could cause the local user serious problems What would be a common, practical case where this specific risk arises?

I don't think that is the right way to think about security. Security flaws often involve uncommon and impractical cases.

However, I'm thinking of for example leaking a file in the same directory containing confidential information, or bugs in, say, racket, glibc and/or the kernel that allow a remote exploit. (In other words, an exploit to which one would be exposed if one were using the server entirely "properly". But again, I think that is something one should have to think and type to do, not think and type not to do.)

I don't think that is the right way to think about security. Security flaws often involve uncommon and impractical cases. However, I'm thinking of for example leaking a file in the same directory containing confidential information, or bugs in, say, racket, glibc and/or the kernel that allow a remote exploit. (In other words, an exploit to which one would be exposed if one were using the server entirely "properly". But again, I think that is something one should have to think and type to do, not think and type *not* to do.)

I appreciate your views. Perhaps I will revisit this issue in the future. For now, I’m satisfied with how it works.

Thanks for listening!

Labels Milestones

Project server should only bind to localhost by default #143