34.1.0 release notes question on 'unencrypted websocket connections to localhost'

[andyprough]

From the release notes for Pale Moon 34.1.0:

Pale Moon, from this version forward, allows unencrypted websocket connections to localhost addresses even when the calling document was served encrypted.

Is this a good thing or a bad thing? It has the sound of something I wouldn't want - 'unencrypted ... connections ... localhost'

But I don't really know what it means or does, so asking for clarification.

[Gemmaugr]

Might it be related to this?

https://forum.palemoon.org/viewtopic.ph ... 63#p264258

Though I thought I remembered a thread about someone making their own site and having problems fetching local resources, but I can't find it now.

[Moonchild]

Is this a good thing or a bad thing? It has the sound of something I wouldn't want - 'unencrypted ... connections ... localhost'

Context matters. I'd say it's a good thing, or I would have resisted it
The issue was that loopback connections to localhost would be blocked if the page calling it would be loaded over https - basically our mixed content blocker applying what is good practice on the internet. However, for localhost, this doesn't matter as we're not dealing with foreign content. The same exception for this was made before already for http to localhost, and this extends that exception to mixed content blocking to the websocket protocol.
Allowing these connections allows the browser to interface from a webpage with e.g. specific hardware or APIs that listen on plaintext ports (since encryption on localhost is just adding unnecessary complexity)

[andyprough]

However, for localhost, this doesn't matter as we're not dealing with foreign content.

Ahhh, I see now - this is not about giving external connections unencrypted access to localhost, this is about literally doing something locally with the browser. Thanks for the explanation!

[Bilbo47]

Just to comment: when bad-ware operates on localhost for the purpose of avoiding protections in the browser, it's not the browser's fault/problem - because the machine/OS is already pwned regardless of whether the browser is running.