1. A system comprising: a networked device, residing in a private network of Internet, and configured to: announce a networked service to a discovery service, and enable performing the discovery service for the private network; a client device residing in a same private network of the Internet as the networked device, the client device being configured to execute a sandboxed program in a security sandbox and to automatically instantiate a connection between the sandboxed program and at least one of the networked device and the networked service; and a Network Address Translator (NAT) straddling both the same private network and a public network of the Internet, wherein, as part of the automatic instantiation of the connection between the sandboxed program and the at least one of the networked device and the networked service, the NAT is configured to translate a private address of an announce message related to the announcement of the networked service to a public address thereof including a public Internet Protocol (IP) address, the sandboxed program is configured to address a discovery message to the discovery service from a private address thereof, the NAT is configured to translate the private address of the sandboxed program to a public address thereof including a public IP address when the discovery message transits the NAT, the discovery service is configured to perform a lookup based on the public IP address of the sandboxed program to determine at least one device having a same public IP address to determine that the sandboxed program and the at least one of the networked device and the networked service reside in the same private network, and in accordance with the determination that the sandboxed program and the at least one of the networked device and the networked service reside in the same private network, the discovery service is configured to respond with service information for the at least one of the networked device and the networked service.