2026-07-16 03:29 UTC
Figma runs a local server with a valid *signed* SSL certificate for https://figmadaemon.com:44960 (resolves to 127.0.0.1) ?!
https://gist.github.com/Willamin/dedc1de2d1d5d4e8db4e49b25007a34c
I thought this was not allowed?
(https://groups.google.com/g/mozilla.dev.security.policy/c/eV89JXcsBC0/m/wsj5zpbbAQAJ?pli=1)
What certificate authority allowed this?!
> Comodo
Ah
Replies (2)
-
@AlesandroOrtiz@infosec.exchange 2026-07-16 04:16
@zhuowei@notnow.dev Figma still does this? Gist is from 2020.
-
@Aissen@social.treehouse.systems 2026-07-16 05:32
@zhuowei@notnow.dev is this still working in browsers? Many ISP's DNS block RFC1918 address resolution. Firefox blocks them when using DoH by default. I wonder how that applies to local (127.*) addresses.