{"action":"created","issue":{"url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/55","repository_url":"https://api.github.com/repos/feross/webtorrent-hybrid","labels_url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/55/labels{/name}","comments_url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/55/comments","events_url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/55/events","html_url":"https://github.com/feross/webtorrent-hybrid/issues/55","id":190471028,"number":55,"title":"Xvfb should not listen to outside connections","user":{"login":"dcposch","id":169280,"avatar_url":"https://avatars.githubusercontent.com/u/169280?v=3","gravatar_id":"","url":"https://api.github.com/users/dcposch","html_url":"https://github.com/dcposch","followers_url":"https://api.github.com/users/dcposch/followers","following_url":"https://api.github.com/users/dcposch/following{/other_user}","gists_url":"https://api.github.com/users/dcposch/gists{/gist_id}","starred_url":"https://api.github.com/users/dcposch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcposch/subscriptions","organizations_url":"https://api.github.com/users/dcposch/orgs","repos_url":"https://api.github.com/users/dcposch/repos","events_url":"https://api.github.com/users/dcposch/events{/privacy}","received_events_url":"https://api.github.com/users/dcposch/received_events","type":"User","site_admin":false},"labels":[{"id":207183113,"url":"https://api.github.com/repos/feross/webtorrent-hybrid/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-11-19T02:35:57Z","updated_at":"2016-11-24T03:20:59Z","closed_at":null,"body":"Currently when you run `webtorrent-hybrid`, it uses a headless X server to run Electron. It looks like that server, `Xvfb`, accepts connections from anywhere!\r\n\r\n```\r\n$ sudo netstat -tnlp\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name\r\ntcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      5052/nginx      \r\ntcp        0      0 127.0.0.1:28017         0.0.0.0:*               LISTEN      2962/mongod     \r\ntcp        0      0 0.0.0.0:6104            0.0.0.0:*               LISTEN      6987/Xvfb       \r\ntcp        0      0 0.0.0.0:6105            0.0.0.0:*               LISTEN      7187/Xvfb       \r\ntcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      3183/sendmail: MTA:\r\ntcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5052/nginx      \r\ntcp        0      0 0.0.0.0:222             0.0.0.0:*               LISTEN      27757/sshd      \r\ntcp        0      0 127.0.0.1:27017         0.0.0.0:*               LISTEN      2962/mongod     \r\ntcp        0      0 127.0.0.1:587           0.0.0.0:*               LISTEN      3183/sendmail: MTA:\r\ntcp6       0      0 :::46479                :::*                    LISTEN      7178/WebTorrent \r\ntcp6       0      0 :::6104                 :::*                    LISTEN      6987/Xvfb       \r\ntcp6       0      0 :::6105                 :::*                    LISTEN      7187/Xvfb       \r\ntcp6       0      0 :::222                  :::*                    LISTEN      27757/sshd      \r\ntcp6       0      0 :::8000                 :::*                    LISTEN      6978/WebTorrent \r\ntcp6       0      0 :::44359                :::*                    LISTEN      7178/WebTorrent \r\ntcp6       0      0 :::37357                :::*                    LISTEN      6978/WebTorrent \r\n```\r\n\r\n...it should probably bind localhost instead of 0.0.0.0\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/comments/262681589","html_url":"https://github.com/feross/webtorrent-hybrid/issues/55#issuecomment-262681589","issue_url":"https://api.github.com/repos/feross/webtorrent-hybrid/issues/55","id":262681589,"user":{"login":"mappum","id":398285,"avatar_url":"https://avatars.githubusercontent.com/u/398285?v=3","gravatar_id":"","url":"https://api.github.com/users/mappum","html_url":"https://github.com/mappum","followers_url":"https://api.github.com/users/mappum/followers","following_url":"https://api.github.com/users/mappum/following{/other_user}","gists_url":"https://api.github.com/users/mappum/gists{/gist_id}","starred_url":"https://api.github.com/users/mappum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mappum/subscriptions","organizations_url":"https://api.github.com/users/mappum/orgs","repos_url":"https://api.github.com/users/mappum/repos","events_url":"https://api.github.com/users/mappum/events{/privacy}","received_events_url":"https://api.github.com/users/mappum/received_events","type":"User","site_admin":false},"created_at":"2016-11-24T03:20:59Z","updated_at":"2016-11-24T03:20:59Z","body":"Thanks to @paulkernfeld for creating a fork of the `node-headless` package which accepts CLI args to pass to Xvfb. That made this change super simple 👍 "}}
{"actor":{"display_login":"mappum"}}