Hacker News Reader

Comment by Dwedit | Hacker News Reader

Hey browser makers, please allow file:// URLS to actually be able to load other files in the same directory without giving a CORS error. You can't even run a JS file from the same directory! That's what's really killing "local first".

View on HN

As usual, this sounds great for the nice players.

Unfortunately that means if you download an html file and double click on it then it can send anything in your downloads folder to anywhere else.

Download HTML file (and dependencies), open local file, local JS requests from internet, and CORS error. Why can it not work like this?

> local JS requests from internet

I really don't understand what this means.

If you load a file using the “file” protocol, it shouldn’t be able to load other resources (JS from the internet) with non-file protocols to protocols (http, https, etc.) to non null-string domains. because that would violate cross origin request sharing (CORS).

I too like local HTML and would love to see it restored without requiring a local server. If I spin up a local Webrick to serve anything from my file system, I’m no better off (except maybe that it’s scoped to a particular directory and children).

People expect to be able to download an HTML file and for it still to be able to load an image with an external URL. If it can do that, it can exfiltrate (eg js can put data loaded from a local file in the src for an image on a external server).

When I save an HTML page, the browser downloads other resources the page wants. This is how it should work for The Average User. Saving just the HTML should be the exception for more technical users.

or just separete what are "document" and what are "application", already, and don´t mix them up. i would not even mind if there was a separate "docjs" - JS code for which only the document is visible and only can do stuff upon it, and the "appjs" which can do all of the wild js stuff which our great browser vendors come up with. this way, in various cases, you can turn off the potentially harmful appjs, while keep the docjs for validating forms, change layout, implementing tinymce, etc...

IMO the problem rooted in co-mingling documents and applications on a web page / in a HTML file. let the user save documents in .html: then it should not be able to do any harm - it's a digital sheet of paper! and web applications in, say, .hta: then he should not expect any more isolatedness then for a downloaded .exe or .sh file; and the user client program should treat it with due care when downloading, eg. by put it in a separate subfolder, set SELinux context, etc...

Luckily, starting a local HTTP server for development is more-or-less a one-liner for a long time, in most OSes (maybe even Windows might ship with Python nowadays?):

    python -m http.server 8080

If if you're stuck with python2

    python -m SimpleHTTPServer 8080

At least this doesn't introduce the security issues you'd see with any file:// resource being able to load other file:// resources

It's not perfect either:

https://docs.python.org/3/library/http.server.html#http-serv...

You should also add a `--bind 127.0.0.1` so you don't expose the site to everyone on your network.

Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.

That should really be the default behavior.

Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000`

To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`

It also bypasses firewall (ufw on ubuntu)

Yes and no, it's modifying the NAT table and so traffic will not be subjected to inbound rules where you would normally add an "allow HTTPS"-style rule: https://docs.docker.com/engine/network/packet-filtering-fire...

In what way is that "No"? The docs say:

> Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

So docker is "effectively" ignoring your firewall in the case of ufw. I don't see how it can be considered to not ignoring your firewall when it ignores the rules you've setup.

NAT rules are still firewall (netfilter, iptables - note the plural) territory, ufw is a frontend for iptables to simplify creating rules.

Does Docker violate the principle of least surprise? Yes. Was I bitten by this behavior? Definitely. Does it bypass the firewall? No.

I dunno. If I use UFW on Ubuntu, I use it as a firewall, and applications that ignores my firewall, I'd consider them to be ignoring my firewall, regardless if the details say that it's still using NAT rules so technically it's just ignoring one firewall/something not called a firewall, even though it ignores the firewall you've setup.

To be frank, it kind of feels like the kind of technical nitpick argument I'd read from a Docker Inc employee trying to somehow defend ignoring the user's firewall.

The end result is that you setup rules in UFW, and Docker ignores them.

> (maybe even Windows might ship with Python nowadays?)

Windows doesn't ship with Python, but it does have a silly thing where if you type python in a command shell of your choice it will try to auto-install python. (When it works it is kind of magic, when it doesn't work it's a pain to debug the PATH problem.)

It's not exactly a one-liner, but in an off-the-shelf Windows install it is a short script to create a simple static file web server inside PowerShell.

Also there are npm and deno packages/CLIs that are easy to install/run for one-liners if you want to install something more "web native" than Python. `npx http-server` is an easy one-liner with any recent Node install.

I have made a notebook environment inside a single html file. You have to map dependencies in an importmap to blob URLs and it works. I have a single file website online. And you can click download to play with it locally

https://tomlarkworthy.moldable.app/index.html

You can turn off network and the download works.

Very nice, written up anywhere?

still a WIP but I will write it up properly soon.

Can this be a self-contained alarm and journaling app for cellphones?

Because I can't think of a way to do that without serviceworkers. I mean a way that doesn't involve the end user reading a paragraph of instructions, based on their "OS".

Anyhow, sorry, I just can't tell what it does from the confines of that demo and a cellphone browser...

No I think you need service workers for notifications. You could do journalling but it's emits a file when saving by default. Index dB works so maybe that's a possability

Without looking into the source – GoldenLayout, right? :)

You can totally load a JS file from the same directory, I do it all the time.

I recall you can't use web workers, but just loading a JS file with <script> tags is fine.

You can run non-module scripts, yes, though not modules.

Though it's easy enough to run a caddy local server. It was easier in the past, in earlier caddy versions one could just place the caddy binary in PATH and launch `caddy` from any directory to auto serve a local server, now it requires more arguments or a config file.

I think the following works in Firefox. WARNING: this is a security risk obviously.

about:config -> security.fileuri.strict_origin_policy -> false

source: https://stackoverflow.com/questions/58067499/runing-javascri...

That and, bring back the "new tab" custom URL, and, a way to securely host local servers without root but also without just praying that another app doesn't port-squat me

You can bind to port 0 and have the OS then pick an available port for you.

I don't understand the downvote.

OP said

> a way to securely host local servers without root but also without just praying that another app doesn't port-squat me

Binding to port 0 is a solution. I tested it and I always get a port not used by other programs.

I guess the main disadvantage is you can't reliably link to anything. Maybe not a problem if you only ever need one local server.

That's a good point. I assumed it being a single local server per app.

Maybe this is an opportunity. Is there already a “DNS for ports” whereby the hosts file is propagated with application process identifiers that are mapped to localhost:port in hosts file?

Careening back to inetd and /etc/services …

It's amazing to me all of the fancy new ways eventually evolve into the thing they were trying not to be in the first place. We see this time and time again. I've been around long enough to have seen it in several situations to the point that at the start of the trend someone looks like the old dog refusing to learn a new trick, then eventually people realize they could have saved a lot of time/effort/money by taking the old's advice and experience.

I have said it before and I am unsure if I stole it: you can recreate nearly any "service" the web/internet has to offer today with only the RFCs prior to April, 1995, with the caveat that I'm technically fine with HTTP; I haven't given it much thought.

I think it was LogStash or Summit Patchy Project, that let you use IRC as a sync for redirecting logs or making a copy. So I made a PCI compliant logging service, immutable ircd (ro fs) that logged to itself via eggdrop locally. All little cattle VMs would have thier logs sourced and synced via logstash to an IRC channel for the vertical the VM "belonged to". All the irc stuff was on an append-only mount on the ircd server, so if audit just snapshot that mount and hand it over.

NOC was in the channels. I think some teams set up dashboard widgets that triggered on irc events.

All that was a POC done completely to prove that it could be done using only stuff from pre-1996 RFCs. I'm sure the company I built it for went with some vendor product instead and I don't blame them, I wouldn't have maintained that - you ever set up ircd? The volume of traffic just for logs was already fun to deal with.

Pedants: I'm working from 15 year old memories and I changed a few details to protect the innocent. I can't remember the project name other than it was a play on "BI" for business intelligence.

In some ways it is an inversion of inetd. Instead of something that listens to a bunch of ports and launches a port corresponding process, the user has a service that will listen to a random port and they wish to address it in a human-readable kind of way.

As far as I know, the hosts file does not afford a port number so a solution would look similar to a proxy on a known port like 443 listening for a particular domain name that hosts routes to localhost and the proxy routes to the service on port whatever. Also need to set up local CA to sign a cert for each of the hostfile domain names. . .

0. https://www.baeldung.com/linux/mapping-hostnames-ports

Isn't this "service discovery", which, at least, apple had 23 years ago "bonjour"? I'm not claiming that stuff like bonjour (I'm referring to the apparently infringing "rendezvous") and upnp did what we're discussing; but you could hack em to do it.

I know I generally use fing in a pinch, or nmap, or ask the DHCP server for all the hostnamr<->ip mappings and then nmap -A - t5 (that's threat level five - the system I use)

Is this thing on

SRV records do this.

hosts file (the hosts NSS database) does not speak DNS.

however I guess this line of thought comes from that web developers want a number of *.dev.myproject.net domain names to use in URLs and handle by different web listener processes. why don't just run a nginx as reverse proxy for all of your *.dev.myproject.net domains? update your port number ↔ domain name in nginx config; reload is quite cheap.

Use https://github.com/daisylb/newtab or other extension to load a home page when you open a new tab.

Support for Unix sockets would be a gamechanger.

I use an extension for the former and the latter has never been a problem for me using ports > 8000.

+1 for having your own local 'tab home page'!

Localhost is an entire /8, so you have a few million possible addresses you can bind to if you want, all on whatever your preferred dev server port is.

If it's too big to include in a script tag, you don't need it. At least, that's my rule.

From a security perspective, that's a bad thing to do.

> "local first"

Listening on 127.0.0.1:80 is local first and not being routable is in fact local-only. Its common alias ‘localhost’ even has ‘local’ in the name.

That requires having an actual server though.

which is extremely easy to do. Most programming languages have a one-liner to do it.

The best solution would allow both. Nothing quite as portable as shoving a .html file on a usb stick.

But then I want my non-technical users to experience the same benefits. So I guess I’m building an app with a web server included.

I don't know why don't we have something like Java but for Javascript. Then we don't need Electron anymore.

Huh?

I'm mostly resorting to self-hosting tools on my tiny server these days, but I would love it if I could run local web apps on a synced folder (a la Dropbox), and access them on my computer and mobile phone alike. With the CORS bypasses, it would be so convenient to have your own personal kanban or finance apps running and synced across multiple platforms, and remove the barrier of entry for many.

Why not use data: or blob: URI's instead? That ought to allow you to load resources from the "same" file, obviating security concerns from loading external resources.

(Alternately you could bundle multiple files into a single ePub, though that requires a few adjustments compared to simple HTML. It's a widely supported format and allows for scripting.)

Because of various security issues, what you really want is something like this web standard going forward: https://developer.chrome.com/docs/web-platform/web-bundles

and combine that with the js file APIs for working with data files.

I think at one point Firefox used to let you open a directory and start a web server in said directory for this very reason.

It's a prominent checkbox in the Safari developer settings to enable this.

You can run a JS file from any directory.

Reply on news.ycombinator.com