Add notice on server boot if binding to 0.0.0.0

[lukewendling]

My colleagues and I spend a lot of our dev time in coffee shops and on public wi-fi. Lightly call attention to a fairly obvious security hole per http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/

[rafaelfranca]

I'm not sure if someone will read this notice.

[steveklabnik]

I would prefer to actually change it to 127.0.0.1 over printing this kind of warning.

[rafaelfranca]

👍

But since this change the development workflow to something more difficult I like to hear @dhh and @jeremy before making any decision.

[steveklabnik]

Absolutely, and @NZKoz would be good as well.

[pixeltrix]

👍 to changing the default to 127.0.0.1

[ccallebs]

👍 as well.

[NZKoz]

In terms of a message, I agree with @rafaelfranca, no one will see that.

Security wise I can understand the desire for the defaults, but if you're spending time in coffee shops and don't have your firewall enabled you have much bigger problems.

binding to 127.0.0.1 would make some workflows more annoying, though on the whole it would be easy enough to work around. You'd probably want to bind to ::1 for ipv6 nerds too, not sure if that will cause errors.

[egilburg]

Most people who start a basic single instance mongrel, especially for the first time, will see the message, in my opinion. More advanced configurations such as running in the background may hide the message, but it's the basic users who would benefit most from the warning.

If you do switch to binding by default, there has to be a switch like --no-binding (or should it be --global-binding or --bind-all?) to turn if off for those who for whatever reason need the current behaviour. And a startup message should then explain it, probably.

[dhh]

I remember we tried this once many years ago and it was annoying for some reason. I don't remember what the problem was though.

I think a notice is a good place to start. It's highly visible when you start the webrick server as you will see the output straight in that terminal.

[rafaelfranca]

Fine. Lets start with the notice.