Security: Default startup should only listen on localhost, and should not run as root about zoonavigator HOT 1 OPEN

Sorry for the late reply. I appreciate your concern.

Regarding the listening address/interfaces, this tool is primarily tailored for cloud deployment where listening on loopback is mostly useless. The default choice of listening on all interfaces benefits users who want to quickly try it out without having to fiddle with configuration, however simple it may be. Afterwards if they decide to deploy it in production it's expected to configure it as required. Sorry if that's not what you expected though, but this is unlikely to change.

To the second point. Obviously I agree that running something as root when it's not needed is just wrong. This Snap is set up with strict confinement mode, which denies all system access except whats explicitly requested via interfaces (which in this case, is just network access), so I assume its not as bad as it looks? That said, I will look into it and try to change it to run under an unprivileged user.

Thank you.

from zoonavigator.