I'll add that recently I wrote a javascript mechanism to demonstrate that although theoretically one can script a scanning attack to discover link-local addresses via URLs with link-local address literals, it's impracticably slow (as suggested in the draft's Security Considerations). Even so, I won't publish the script. (The technique would also be able to discover any kind of IP address; it's by no means limited to IPv6 link-local.) -- Reply to this email directly or view it on GitHub: https://github.com/w3ctag/design-reviews/issues/774#issuecomment-1244751454 You are receiving this because you are subscribed to this thread. Message ID: <w3ctag/design-reviews/issues/774/1244751454@github.com>
Received on Tuesday, 13 September 2022 00:44:21 UTC