This seems like a textbook case of Hanlon&#x27;s Razor (<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Hanlon&#x27;s_razor" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Hanlon&#x27;s_razor</a>, &quot;Never attribute to malice that which is adequately explained by stupidity&quot;).  They wanted some way for their website to interact with the user&#x27;s local installation of their software, and somehow arrived at the idea of running a web server on localhost and accessing it from their website, without thinking through the security implications at all.  Even their responses in this bug show that they <i>still</i> don&#x27;t really understand the implications.<p>Less broken software tends to solve this same problem using a browser extension with a whitelisted domain for access, but that has the disadvantage of requiring a browser extension for each browser, and doesn&#x27;t fully protect against hostile networks.  Including the &quot;<a href="https:&#x2F;&#x2F;&quot;" rel="nofollow">https:&#x2F;&#x2F;&quot;</a> in the whitelist would provide somewhat more security, especially with HSTS, a pinned certificate, and a carefully-audited single-purpose domain.<p>But an even better design would eliminate the entire concept of connecting back from the vendor website to the client software.  Sometimes the right answer to &quot;how do I&quot; is &quot;don&#x27;t&quot;.