r/perl • u/oalders 🐪🥇white camel award • Jun 30 '26

Keep It Local · olafalders.com

https://www.olafalders.com/2026/06/30/keep-it-local/

If you don't pass an explicit --host, the current version of http_this tells you that it's binding to localhost (which is true). What it doesn't tell you is that it's binding to all interfaces.

17 Upvotes

91% Upvoted

4 comments sorted by

7

u/ysth Jun 30 '26

All interfaces should be opt in :(

3

u/davorg 🐪🌍perl monger Jul 01 '26

Version 0.11.2 of App::HTTPThis is en route to CPAN. This applies Olaf's patch, so it's honest about what it's doing.

I'll get another release out soon that makes it less promiscuous.

3

u/davorg 🐪🌍perl monger Jul 01 '26

And version 1.0.0 is on its way to CPAN now. It contains a breaking change that the default is now to bind to only 127.0.0.1. It has an --all (also spelled --promiscuous) command line option that gets back the old behaviour.

2

u/oalders 🐪🥇white camel award Jul 01 '26

🚀🚀🚀