When it comes to databases, either 1) listening on localhost by default or 2) requiring a non-obvious password would seem to strike a decent balance between sec

When it comes to databases, either 1) listening on localhost by default or 2) requiring a non-obvious password would seem to strike a decent balance between security and usability. But MongoDB is web scale! Nobody is going to run it on localhost only! So the default (until 2.6) was to listen on all interfaces by default. AFAIK Elasticsearch still listens on all interfaces by default. Does this choice make life any easier for the developer who is just beginning to learn how to use it? I dunno, most of my development work takes place on localhost. I probably won't even notice if a newly installed database only listens on localhost.