Re: [w3ctag/design-reviews] Private Network Access (aka CORS-RFC1918) (#572)

> Making sure I understand your concern correctly:
> 
> 1. Certain devices will not be able to update and support CORS preflights, for example old printers
> 2. There should be a way for websites to request access to such devices that bypasses PNA restrictions

Well, not really bypass restrictions, as the goal would not to let them be available through http, but as an attached device.
 
> If I've understood correctly, then I can certainly see your point. I have two reservations, however:
> 
> 1. This mechanism would significantly reduce the incentive for devices to implement PNA proper. In other words, it seems advantageous for device maintainers (and disadvantageous for user security) to classify _all_ services as pseudo-devices.

I don't think so, as not all services can be seen as a pseudo device, router configuration is definitely not in that range. I think more about devices sitting on the local network where the function can be identified easily.

> 2. It begs the question: how do you identify a pseudo-device? IP address alone works to an extent, but is hardly fool-proof. mDNS names are not authenticated either, though one could argue that on the private network they should be relatively stable.

mDNS is probably the most reliable way to identify an ipp or roap device, for example, but it is just a possibility.
 
> > On the second point, I think there is a difference between the local network and the private networks you can reach, like corporate private networks. The pseudo-device use case makes sense only for local networks, not for corporate private networks, for example.
> 
> Oh, so you propose allowing the pseudo-device attachment only work within the currently subnet(s)?

Yes, on remote private network, you can imagine that gateways to implement PNA would be in place to access devices that can't be directly upgraded.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/572#issuecomment-930560648