RFC-124: Evolving the Marketplace Trust Program

[BenRomberg]

@PhilipGrove

All outbound (egress) domains must be explicitly listed to prevent unrestricted network access.

Note: subdomain wildcards (.domain.com) are acceptable, while full wildcard () entries are not.

This can easily be circumvented, as we can just list a specific remote (*.codefortynine.com in our case) and proxy any requests we need to any other domains through our own servers. Not sure how much security is gained here.