Re: [whatwg/fetch] Should we block port 10080? (#1191) from Adam Rice on 2021-03-16 (public-webapps-github@w3.org from March 2021)

From: Adam Rice <notifications@github.com>
Date: Tue, 16 Mar 2021 08:47:17 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/1191/800378284@github.com>

Unfortunately, it looks like it is easy to get the client to send arbitrary plaintext with QUIC: https://groups.google.com/a/chromium.org/g/proto-quic/c/KVqeA9q0OAc/m/-NxF0hkqCAAJ

So we have to block port 10080 for UDP at least. I think the option of doing nothing is no longer on the table.

Currently in Chrome blocking a port for only QUIC is not something that's implemented, but I'm sure I could work it out if that's the way we decide to go.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1191#issuecomment-800378284

Received on Tuesday, 16 March 2021 15:47:30 UTC