A better default may be making ports for the 127.0.0.1/8 address space completely unprivileged (excluding 127.0.0.1). Using alternative localhost addresses is v

A better default may be making ports for the 127.0.0.1/8 address space completely unprivileged (excluding 127.0.0.1). Using alternative localhost addresses is very useful for development. It's more convenient than using random ports since /etc/hosts can be used to give each address a fake domain name and this way HTTPS certificates work fine and page redirects don't break your manually entered port number. I'm not sure if it's possible to make the unprivileged ports configurable per listening address; I just think not all listening addresses have identical security concerns. That said it's simple to add the "cap_net_bind_service+eip" capability to any program in question; on NixOS it's just the "security.wrappers" module option.