Remix.run Logo
mjmas 21 hours ago

Why not have your program just listen on port 80 on an address under 127.0.0.0/8?

You will need to run

  sysctl net.ipv4.ip_unprivileged_port_start=80
before you start, but after that you have 2 ** 24 addresses to choose from. And the browser will be happy to treat it as a secure page as well as do proper cookie isolation.
neilalexander 11 hours ago | parent | next [-]

The CAP_NET_BIND_SERVICE capability on Linux is far less of a blunt instrument that applies to a single process rather than system-wide.

c-hendricks 19 hours ago | parent | prev [-]

Is that the only thing governing unprivileged ports, or do programs also implement their own rules?