Can I use 127.0.0.1 for localhost in the Listen directive?
"127.0.0.1" is the IP for "localhost", and that's what you want.
There's no reason not to use the Listen directive and the firewall, is there?
You can do what you want. Use "Listen", use firewall or both. (shutdown XAMPP should be the safest
- Are FTP, MySQL and HTTP the only services to secure or are there others?
That are the only services provided by XAMPP. Maybe your Mac OS X have more.
(You are directly connected to the internet with a modem? Because with a NAT-Router there is need for "Listen" or firewall at all.)