Listen only localhost by default

[KOLANICH]

By default tensorbord listens all interfaces, which may be a security issue. IMHO by default it should listen only on localhost, and if one uses it on a server, he usually configures the stuff, so it is not an issue for him.

[nfelt]

Thanks for the feedback, and yes, our current thinking is that we'll cut over to listening on localhost only by default for our 2.0 release, though there are a few details to work out around making sure it's easy for users who want the current behavior to still get it. Stay tuned.

[nfelt]

Update: as mentioned, we plan on changing the default to localhost for our 2.0 release, since this is the more conservative and safe behavior.

Users who specifically want to expose TensorBoard (e.g. in a lab context to let other users access the instance) can either pass --host=<interface> explicitly to bind to the desired interface, or configure some type of proxied access (for example, ssh port forwarding like ssh -L 6006:localhost:6006 <my-tensorboard-server>).

Strictly speaking the default behavior is actually to attempt to bind to :: and enable IPv6-mapped IPv4 for the socket, so that the same socket can serve both IPv4 and IPv6 traffic, which useful in cases where a hostname for the server (including sometimes localhost itself) has both IPv4 and IPv6 addresses associated with it, since this prevents spurious connection-denied errors from having chosen the wrong protocol. See #1449 for the details.

Since the existing behavior can't be achieved by specifying either 0.0.0.0 or :: explicitly, I propose that we accept an additional special host value, --host=*, which behave as though :: was passed but attempt to make the socket dual-bind to IPv4 as well.

This change should mostly resolve the following issues:

• Tensorboard could not bind to unsupported address family :: #1713 (bug still exists, but won't be triggered except on passing --host=*, and can be resolved by passing --host=0.0.0.0 instead)
• Tensorboard 0.0.0.0:6006 cannot work On Win7 but localhost:6006 works #89 (localhost will work)
• PR Confirm that the connection to tensorboard works or change to localhost #2371 (with defaulting to localhost, a potentially-not-reachable domain name will only be emitted when explicitly passing --host={0.0.0.0,::,*} and can be resolved by passing a domain name for an interface known to be valid; this PR could still be useful but the incidence of the issue should be much lower)
• Needing to click through the mac OS network security popup

[wchargin]

Fixed by #2589, which will be in TensorBoard 2.0.0.

[KOLANICH]

Thanks.