When started with no extra arguments other than required -i INTERFACE,
it default to listening on 0.0.0.0 and [::] port 667.

I do not think that is very secure, especially as [::] could easily be
publicly accessible, as does 0.0.0.0 from untrusted networks, and even
without exploits darkstat could easily disclose a lot of information
including personal and private data.

It is too easy to misuse or misconfigure.

With -b option it is not quite possible to bind back to both ipv4 and
ipv6 either.

/etc/darkstat/init.cfg  does show example of binding to 127.0.0.1, but
it is commented out. Plus there is no way to listen on both 127.0.0.1
and ::1 afaik.

So not only this config should be improved, but also command should
improve to only listen on localhost (127.0.0.1 and ::1) by default (with
no -b option).

Also confusingly, init.cfg suggests it is listening on port 666, but in
fact it is 667 by default.

Control: severity -1 wishlist
Control: tags -1 + wontfix
The standard security model considers your local network 0/:: to be safe,
the point of a fire-wall is to prevent access to your host
by hosts you don't like.
I don't really buy "personal and private data" either.
Doesn't appear to be true:
-b 127.0.0.1 -b ::1?
Fixed in git.

Control: severity -1 wishlist
Control: tags -1 + wontfix
The standard security model considers your local network 0/:: to be safe,
the point of a fire-wall is to prevent access to your host
by hosts you don't like.
I don't really buy "personal and private data" either.
Doesn't appear to be true:
-b 127.0.0.1 -b ::1?
Fixed in git.