Re: More top-secret BS commits with hidden bug reports

[Mitchell Stoltz]

Rip Toren wrote:


> The connection goes either to the outside world, or localhost. How about
> a security popup (and associated preference settings (allow, question,
> deny)) concerning connection to the local host (localhost,
> 127.0.0.1,myIP,etc). Then the user would be in some control when a page
> attempted to use the somewhat priveleged state of having the socketpeer
> being the local host.
> 


The exploit doesn't necessarily involve localhost - the attacker could 
be trying to connect to some other machine, perhaps behind the user's 
firewall.
   -Mitch