socket security

[Steve Holden]

"Jon Ribbens" <jon+usenet at unequivocal.co.uk> wrote in message
news:slrnaave1r.13h.jon+usenet at snowy.squish.net...
> In article <40sr8.3765$rg3.345703 at news-binary.blueyonder.co.uk>,
>   Alastair Nicol wrote:
> > 1) Can only hosts which can see the interface your program is bound to
> > communicate with your program. In the "normal" case if you bind to
> > 127.0.0.1 for example ONLY your machine can see that interface. Other
> > machines cannot connect to it. Is this a safe / secure assumtion? (not
just
> > for localhost)
>
> No. Other machines on your local net can talk to your localhost by
> sending ethernet packets with your machine's MAC address and 127.0.0.1
> as the IP address.

Good point.

My understanding is that this "feature" depends on the particualr stack and
OS you are using, and is not guaranteed to work. It is, of course, a
perversion of the intended use of the loopback network, although one we do
well to remember.

regards
 Steve