Initial serving hostname too restrictive

FamousArchives / generator-famous

for those who hate doing things once

123 stars 26 forks source link

Initial serving hostname too restrictive #23

Closed Offirmo closed 10 years ago

Offirmo commented 10 years ago

I develop on a headless VM.

On running my first famo.us project (from this yo famous), I wasn't able to open the page with a browser.

Of course, a quick look into the serving hostname confirmed that the app could only be served on localhost. Which I couldn't since I use a headless VM. I quickly fixed that.

The question is : why being so restrictive by default ? This annoy 1st time users.

MylesBorins commented 10 years ago

@Offirmo the thought process here was that some users may not realize they are leaving ports open to external machines when running grunt serve. There is the option to set the hostname using --hostname=0.0.0.0

My assumption is that first time users who know what they are doing will have a slight inconvenience either setting a flag or modifying the defaults, as opposed to having individuals unknowingly serve stuff publicly.

Do you think that this is a poor choice?

Offirmo commented 10 years ago

@TheAlphaNerd I humbly would say yes, cf. the last newsletter "Famo.us is for EVERYONE (kids, etc.)". I agree with the security argument but when executing the "install" tutorial for the 1st time - like I did - I think it SHOULD work. And we should be able to send a quick link to coworkers on our machine. Running a web app on a machine is obviously a conscious opening of a network port.

I thought of some options :

dropping the restriction completely
being open and friendly in NODE_ENV=DEVELOPMENT and more restrictive in production mode
having a security README to be followed when ready for production.

This may not be an important issue. We can also wait to see if many users have the same problem.

Thanks for all the work.

MylesBorins commented 10 years ago

@Offirmo I am going to close this issue for now. I think the restrictive security settings make sense imho. I will suggest an update to the installation instructions, although if you check the generated readme it has all the necessary documentation to get stuff working.

If more people file a similar issue I will definitely consider changing my position

Offirmo commented 10 years ago

@TheAlphaNerd fine with me !