{"action":"opened","issue":{"url":"https://api.github.com/repos/qzind/tray/issues/338","repository_url":"https://api.github.com/repos/qzind/tray","labels_url":"https://api.github.com/repos/qzind/tray/issues/338/labels{/name}","comments_url":"https://api.github.com/repos/qzind/tray/issues/338/comments","events_url":"https://api.github.com/repos/qzind/tray/issues/338/events","html_url":"https://github.com/qzind/tray/issues/338","id":338576489,"node_id":"MDU6SXNzdWUzMzg1NzY0ODk=","number":338,"title":"LoopbackExemption decision for Microsoft Edge","user":{"login":"tresf","id":6345473,"node_id":"MDQ6VXNlcjYzNDU0NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6345473?v=4","gravatar_id":"","url":"https://api.github.com/users/tresf","html_url":"https://github.com/tresf","followers_url":"https://api.github.com/users/tresf/followers","following_url":"https://api.github.com/users/tresf/following{/other_user}","gists_url":"https://api.github.com/users/tresf/gists{/gist_id}","starred_url":"https://api.github.com/users/tresf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tresf/subscriptions","organizations_url":"https://api.github.com/users/tresf/orgs","repos_url":"https://api.github.com/users/tresf/repos","events_url":"https://api.github.com/users/tresf/events{/privacy}","received_events_url":"https://api.github.com/users/tresf/received_events","type":"User","site_admin":false},"labels":[{"id":327962862,"node_id":"MDU6TGFiZWwzMjc5NjI4NjI=","url":"https://api.github.com/repos/qzind/tray/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":{"login":"tresf","id":6345473,"node_id":"MDQ6VXNlcjYzNDU0NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6345473?v=4","gravatar_id":"","url":"https://api.github.com/users/tresf","html_url":"https://github.com/tresf","followers_url":"https://api.github.com/users/tresf/followers","following_url":"https://api.github.com/users/tresf/following{/other_user}","gists_url":"https://api.github.com/users/tresf/gists{/gist_id}","starred_url":"https://api.github.com/users/tresf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tresf/subscriptions","organizations_url":"https://api.github.com/users/tresf/orgs","repos_url":"https://api.github.com/users/tresf/repos","events_url":"https://api.github.com/users/tresf/events{/privacy}","received_events_url":"https://api.github.com/users/tresf/received_events","type":"User","site_admin":false},"assignees":[{"login":"tresf","id":6345473,"node_id":"MDQ6VXNlcjYzNDU0NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6345473?v=4","gravatar_id":"","url":"https://api.github.com/users/tresf","html_url":"https://github.com/tresf","followers_url":"https://api.github.com/users/tresf/followers","following_url":"https://api.github.com/users/tresf/following{/other_user}","gists_url":"https://api.github.com/users/tresf/gists{/gist_id}","starred_url":"https://api.github.com/users/tresf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tresf/subscriptions","organizations_url":"https://api.github.com/users/tresf/orgs","repos_url":"https://api.github.com/users/tresf/repos","events_url":"https://api.github.com/users/tresf/events{/privacy}","received_events_url":"https://api.github.com/users/tresf/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-07-05T13:32:11Z","updated_at":"2018-07-05T13:32:11Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"@slprogrp I hope you don't mind, I've moved your question to our active bug tracker from it's original home at https://github.com/qzind/qz-print/issues/165#issuecomment-402619997.\r\n\r\n> @tresf , Isn't it a security issue to make Edge exempt from this? By running the command:\r\nCheckNetIsolation.exe LoopbackExempt -a -n=\"Microsoft.MicrosoftEdge_8wekyb3d8bbwe\"\r\n\r\nYes.\r\n\r\n> You are saying, not only your application, but any local application can send network traffic to Edge?\r\n\r\nNo, the other way around.  This tells Edge it can send HTTP and WebSocket requests back to `localhost`.\r\n\r\n> I can understand if you had a way to whitelist just your application, but you are essentially turning this security check off for MS Edge meaning all local applications can now send network traffic to it.\r\n\r\nAs explained above, this is the other way around.  I'm not aware of a way to send localhost requests back to edge or even what that would imply.\r\n\r\n> And if you roll it out in the installer of your product, the user will not even know they have lost this security feature...\r\n\r\nCorrect.  It's an interoperability flag because Microsoft puts sandbox restrictions on all WPF (Windows Presentation Foundation) application.  This makes sense for titles like `Angry Chicken`, but not so much for Edge as it cripples it and prevents it from behaving like these browsers... \r\n\r\n| | Chrome | Opera | Safari | Firefox | IE11 | Edge |\r\n|-|----------|--------|--------|------|---------|------|\r\n| Can talk to `localhost` | ✅ | ✅ | ✅ | ✅ | ⚠️* | ⚠️** |\r\n*Except on domain, requires `locahost.qz.io`\r\n**Loopbacks forbidden in WPF without `CheckNetIsolation` command, except on domain, requires `locahost.qz.io`\r\n\r\n> How can you justify this?\r\n\r\nI hope the above helps explain how we've justified this.  Websites can prevent non-origin communication using a special page header, which will prevent communication outside of the originating domain.  I'm not sure how widely adopted this is though.  Here's more information on it: https://gist.github.com/subudeepak/9897212#websockets---help-me-from-this-nightmare-please\r\n\r\nQuick installation and interoperability are paramount when delivery software to the masses and we believe the above is justification.  We believe whitelisting Edge loopbacks actually enables Edge to be used by the masses and puts all browsers on a level playing field and improves its adoption by embracing it as a supported browser."}}
{"actor":{"display_login":"tresf"}}