Binding to 0.0.0.0 exposes your server to everyone.  That seems like the
wrong thing to do for a development tool.  It should be secure by default
which means limiting it to only the local machine.  People who are running
in an environment where they need to bind to a public interface will still
be able to do that but they'll know they're explicitly taking this action
and can decide whether that's safe or not.


On Thu, Dec 12, 2013 at 11:02 AM, Erik Rose <notifications@github.com>wrote:

> In bin/dxr-serve.py:
>
> > @@ -11,18 +11,31 @@
> >
> >
> >  def main():
> > -    parser = OptionParser(usage='usage: %prog [options] build-folder')
> > +    parser = OptionParser(usage='usage: %prog [options] build-folder',
> > +                          add_help_option=False)
> > +    parser.add_option('--help', action='help')
> > +    parser.add_option('-h', '--host', dest='host',
> > +                      type='string',
> > +                      default='localhost',
>
> Why not bind to all interfaces by default, saving confusion for new users
> and maintaining previous behavior?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mozilla/dxr/pull/207/files#r8303814>
> .
>