You assume a machine with a single all powerful user. These days computers don't really work this way, for our own good. A huge amount of effort is put into kee

You assume a machine with a single all powerful user. These days computers don't really work this way, for our own good. A huge amount of effort is put into keeping programs as isolated as possible (unix permissions, chroots, cgroups...). Most systemd units include isolation features enabled by default. Having an API that can reconfigure syncing being available without authentication for anything running on the machine feels backwards to me. More so for a project that focuses on security. If anyone from the project reads this, may I recommend either encouraging users to set a password or mentioning the implications on the page about Security Principles[0]? [0] https://docs.syncthing.net/users/security.html https://docs.syncthing.net/users/security.html