Top all-time · #9726
HTTP
Personal blog · http.jameshfisher.comprogrammingwebsecurity
HTTP is a personal blog at http.jameshfisher.com about programming, web and security. Since 2019, 7 different Hacker News readers have linked it 8 times, most often “I can see your local web servers”. No feed was found, so read it on the site itself.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN commenters link James Fisher's posts about websites reaching local web servers from the browser, including CORS behaviour and a demo that probes common localhost ports, tied to the Zoom camera vulnerability.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- I can see your local web servers6 people · 7 mentions · first linked 2019-05-27
What Hacker News says?
It appears CORS _is_ supported to localhost according to this website. If you have an open local server running this will detect it. http://http.jameshfisher.com/2019/05/26/i-can-see-your-local...
Comment linking /2019/05/26/i-can-see-your-local-web-servers/
on “Vulnerability in the Mac Zoom client allows malicious websites to enable camera”Submitted I can see your local web servers as a story · 652 points
HN discussionThanks for the info! I still don't fully understand _why_ they had to do this hack if they own the localhost server. They could just set CORS to be '*' and lax their CSP. Then they would be able to get data with JS. For example this website can see any localserver on your network with open CORS since it appears they laxed their CSP. http://http.jameshfisher.com/2019/05/26/i-can-see-your-local...
Comment linking /2019/05/26/i-can-see-your-local-web-servers/
on “Vulnerability in the Mac Zoom client allows malicious websites to enable camera”Submitted I can see your local web servers as a story · 7 points
HN discussionYep. This[0] post[1] from a few months ago touched on this with more discussion. [0] http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... [1] https://news.ycombinator.com/item?id=20028108
Comment linking /2019/05/26/i-can-see-your-local-web-servers/
on “Vulnerability in the Mac Zoom client allows malicious websites to enable camera”They do... [Error] Failed to load resource: Origin http://http.jameshfisher.com is not allowed by Access-Control-Allow-Origin. (localhost, line 0)
Comment linking /
on “I can see your local web servers”It's not scanning only port 3000: const portsToTry = [ 80, 81, 88, 3000, 3001, 3030, 3031, 3333, 4000, 4001, 4040, 4041, 4444, 5000, 5001, 5050, 5051, 5555, 6000, 6001, 6060, 6061, 6666, 7000, 7001, 7070, 7071, 7777, 8000, 8001, 8080, 8081, 8888, 9000, 9001, 9090, 9091, 9999, ]; view-source: http://http.jameshfisher.com/2019/05/26/i-can-see-your-local... :125
Comment linking /2019/05/26/i-can-see-your-local-web-servers/
on “I can see your local web servers”>The web is obviously strongly based around a security model where a website ultimately can't do much in terms of information access Recently posted on HN: http://http.jameshfisher.com/2019/05/26/i-can-see-your-local...
Comment linking /2019/05/26/i-can-see-your-local-web-servers/
on “Vim/Neovim Arbitrary Code Execution via Modelines”