I have a problem with the phrase "obviously sloppy work on the part of the developers." How exactly does one avoid loopback in an application like this?
Your second point is spot on though I think, one would need to own the machine already before being able to sniff loopback.
Your second point is spot on though I think, one would need to own the machine already before being able to sniff loopback.