[emrun] Don't listen to 0.0.0.0 by default (#22077)

[kolAflash]

A developer might start emrun without thinking about the --hostname setting. So he might expose sensible data on the webserver to the LAN or to the Internet. It might even happen, that a vulnerable Emsdk version becomes publicly reachable.

Instead use localhost (127.0.0.1) by default, which is usually sufficient for development.

[kolAflash]

bug #22077

[sbc100]

I normally do all my work over ssh and then point my browser at the IP of the my server.. so I guess I will always be adding --hostname 0.0.0.0. I wonder if there is some way we can make it even more obvious to folks how to opt into this if they (like me) need to.

[juj]

so I guess I will always be adding --hostname 0.0.0.0.

Hmm hmm.. yeah, I can see that this can be tedious.

Although emrun already has the default that it attempts to launch a browser, so you've been passing the --no_browser flag as well I presume?

I find it tedious to need to write that --no_browser flag all the time, so I ended up creating a serve.bat in my own local user bin/ folder, which runs emrun --no_browser --port %*, which I then run with serve 8000 to launch a web page. Maybe something like that might make sense?

If we defaulted to 0.0.0.0 and while doing so, print a warning that this will be accessible to all users, and then ask developers to opt to --hostname=127.0.0.1, then they would find it tedious.

[kolAflash]

If you have any ideas for fixing the failed tests or making the discussed suggestions, feel free to amend a patch.

[sbc100]

so I guess I will always be adding --hostname 0.0.0.0.

Hmm hmm.. yeah, I can see that this can be tedious.

Although emrun already has the default that it attempts to launch a browser, so you've been passing the --no_browser flag as well I presume?

I find it tedious to need to write that --no_browser flag all the time, so I ended up creating a serve.bat in my own local user bin/ folder, which runs emrun --no_browser --port %*, which I then run with serve 8000 to launch a web page. Maybe something like that might make sense?

If we defaulted to 0.0.0.0 and while doing so, print a warning that this will be accessible to all users, and then ask developers to opt to --hostname=127.0.0.1, then they would find it tedious.

Yes, I run with --no-browser already. Its easy enough for me to add --hostname=0.0.0.0.