Updated RPC Setup XMLRPC (markdown)

RPC-Setup-XMLRPC.md

@@ -16,7 +16,7 @@ You can:
 * ✔️ This is considered **more secure** as local unix domain sockets can be assigned unix file read/write modes that can control which users on the system can & cannot access the API.
 
 ❌ Configure rtorrent to expose this socket on some address + port, eg `localhost:5000`/`127.0.0.1:5000` 
-   * ⚠️ You *must never* publish this on any address besides `localhost` (`127.0.0.1`)
+   * :bangbang: **Never** bind the SCGI port to anything *but* 127.0.0.1. Anyone who can send rtorrent xmlrpc commands does have the ability to execute code with the privileges of the user running rtorrent.
    * ⚠️ Even if you do bind this to localhost, publishing directly to a port is still **less secure** than publishing to a unix domain socket & proxying that
      * Directly publishing to localhost is less secure because *any user* on the localhost can access `localhost:5000` and use the API, thereby getting access to everything that the user that runs `rtorrent` has access to.
    * ❌ In addition, you will most likely need to configure a reverse proxy to help publish your endpoint, so the convenience is not great.
@@ -42,6 +42,11 @@ What you need:
   * recent versions of nginx have this built in.
 * http://xmlrpc-c.sourceforge.net/ 1.00 or later, 1.07 or later for 64bit integer support.
 
+You will be:
+
+* Publishing the `xmlrpc` endpoint to a socker on the local filesytem, & setting user permissions on this socket to to restrict unauthorized user accounts on your computer from accessing it.
+* Proxying this socket to a network address + port, **with some kind of authentication set up on your reverse proxy**
+
 ### rtorrent configuration (rtorrent.rc)
 
 ```ini
@@ -130,7 +135,6 @@ encoding.add = UTF-8
 
 The web server will now route xmlrpc requests to rtorrent, which is listening only on connections from the local machine or on the local socket file. Also make sure the /RPC2 location is properly protected, (as in, has *at least* basic auth enabled, and is secured by SSL) and ~also name it differently to evade attackers probing for vulnerabilities~ (security through obscurity is not security, though this may reduce frequency of attempted exploits) 
 
-:bangbang: **Never** bind the SCGI port to anything *but* 127.0.0.1. Anyone who can send rtorrent xmlrpc commands does have the ability to execute code with the privileges of the user running rtorrent. If you want to be more secure on principle, use UNIX domain sockets instead of TCP ports (see below).
 
 You may also use `network.scgi.open_local = /foo/bar` to create a local domain socket, which supports file permissions. Set the rw permissions of the directory the socket will reside in to only allow the necessary processes. This is the recommended way of using XMLRPC with rtorrent, though not all http servers support local domain sockets for scgi.