Cisco subdomain private key found in embedded executable
The domain in question (drmlocal.cisco.com) resolves to 127.0.0.1. This is a handy and above all cross-platform&#x2F;cross browser way for a website to talk to a locally installed application (that&#x27;s running a web server, bound to the loopback interface) by using CORS and&#x2F;or jsonp.<p>If the site that wants to make use of this is using SSL, then the locally running web browser also needs to be using SSL and it needs to have a publicly trusted cert.<p>The other alternative (installing a local CA) seems to be worse.<p>An option would be for the locally installed app to ask a server for a cert to use while it&#x27;s running, but that means that the app needs to phone home which it otherwise would not have to.<p>So I guess we&#x27;re back to proprietary browser extensions if this technique is frowned upon.