diff --git a/CHANGES b/CHANGES
index 353e025..6d4cd21 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+1.3.6 2013-07-04
+- Check config and show some warning messages
+
 1.3.5 2013-06-29
 - Make local.js and server.js runnable
 
diff --git a/README.md b/README.md
index 9881906..1f77134 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 shadowsocks-nodejs
 ===========
 
-Current version: 1.3.5
+Current version: 1.3.6
 [![Build Status](https://travis-ci.org/clowwindy/shadowsocks-nodejs.png)](https://travis-ci.org/clowwindy/shadowsocks-nodejs)
 
 shadowsocks-nodejs is a lightweight tunnel proxy which can help you get through
diff --git a/lib/shadowsocks/local.js b/lib/shadowsocks/local.js
index 4f920ff..7f42f03 100644
--- a/lib/shadowsocks/local.js
+++ b/lib/shadowsocks/local.js
@@ -314,6 +314,7 @@
     if (config.verbose) {
       utils.config(utils.DEBUG);
     }
+    utils.checkConfig(config);
     SERVER = config.server;
     REMOTE_PORT = config.server_port;
     PORT = config.local_port;
diff --git a/lib/shadowsocks/server.js b/lib/shadowsocks/server.js
index 8125cad..7eaa06f 100644
--- a/lib/shadowsocks/server.js
+++ b/lib/shadowsocks/server.js
@@ -63,6 +63,7 @@
     if (config.verbose) {
       utils.config(utils.DEBUG);
     }
+    utils.checkConfig(config);
     timeout = Math.floor(config.timeout * 1000) || 600000;
     portPassword = config.port_password;
     port = config.server_port;
diff --git a/lib/shadowsocks/utils.js b/lib/shadowsocks/utils.js
index f31ef8e..6a0c5ba 100644
--- a/lib/shadowsocks/utils.js
+++ b/lib/shadowsocks/utils.js
@@ -33,7 +33,18 @@
     return result;
   };
 
-  exports.version = "shadowsocks-nodejs v1.3.5";
+  exports.checkConfig = function(config) {
+    var _ref;
+    if ((_ref = config.server) === '127.0.0.1' || _ref === 'localhost') {
+      exports.warn("Server is set to " + config.server + ", maybe it's not correct");
+      exports.warn("Notice server will listen at " + config.server + ":" + config.server_port);
+    }
+    if ((config.method || '').toLowerCase() === 'rc4') {
+      return exports.warn('RC4 is not safe; please use a safer cipher, like AES-256-CFB');
+    }
+  };
+
+  exports.version = "shadowsocks-nodejs v1.3.6";
 
   exports.EVERYTHING = 0;
 
diff --git a/package.json b/package.json
index 1268ac8..3abf932 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
     "description": "a tunnel proxy that help you get through firewalls",
     "keywords": ["shadowsocks", "proxy", "socks5"],
     "author": "clowwindy",
-    "version": "1.3.5",
+    "version": "1.3.6",
     "licenses": [{
         "type": "MIT",
         "url": "https://raw.github.com/clowwindy/shadowsocks-nodejs/master/LICENSE"
diff --git a/src/local.coffee b/src/local.coffee
index a9d8bf8..e100df6 100644
--- a/src/local.coffee
+++ b/src/local.coffee
@@ -265,6 +265,9 @@ exports.main = ->
     config[k] = v
   if config.verbose
     utils.config(utils.DEBUG)
+
+  utils.checkConfig config
+  
   SERVER = config.server
   REMOTE_PORT = config.server_port
   PORT = config.local_port
diff --git a/src/server.coffee b/src/server.coffee
index 413ee45..094b40a 100644
--- a/src/server.coffee
+++ b/src/server.coffee
@@ -64,6 +64,8 @@ exports.main = ->
     config[k] = v
   if config.verbose
     utils.config(utils.DEBUG)
+    
+  utils.checkConfig config
 
   timeout = Math.floor(config.timeout * 1000) or 600000
   portPassword = config.port_password
diff --git a/src/utils.coffee b/src/utils.coffee
index 86b2c61..8b570b0 100644
--- a/src/utils.coffee
+++ b/src/utils.coffee
@@ -24,7 +24,14 @@ exports.parseArgs = ->
       result['verbose'] = true
   result
 
-exports.version = "shadowsocks-nodejs v1.3.5"
+exports.checkConfig = (config) ->
+  if config.server in ['127.0.0.1', 'localhost']
+    exports.warn "Server is set to #{config.server}, maybe it's not correct"
+    exports.warn "Notice server will listen at #{config.server}:#{config.server_port}"
+  if (config.method or '').toLowerCase() == 'rc4'
+    exports.warn 'RC4 is not safe; please use a safer cipher, like AES-256-CFB'
+
+exports.version = "shadowsocks-nodejs v1.3.6"
 
 exports.EVERYTHING = 0
 exports.DEBUG = 1