I just discovered winstone recently and am quite impressed with its size, speed and ease of setup. It is really an amazing piece of software. One thing that I think would improve it would be a way to force the control port to listen only on a particular interface. This would allow winstone to serve up public pages on an untrusted interface while leaving the control port open and available on a trusted interface. I dropped a patch on sourceforge which should add this feature. If you think it is a decent idea I would love to see it go into the next release and if there is anything I can do to help let me know.