diff --git a/checkin_notes b/checkin_notes
index 0e53e06d8f..07fd70e5c7 100755
--- a/checkin_notes
+++ b/checkin_notes
@@ -4495,3 +4495,12 @@ David  5 May 2006
 
     html/user/
         get_project_config.php
+
+David  5 May 2006
+    - GUI RPC sockets need to be close-on-exec
+        (otherwise applications inherit them)
+    - compile fix: change longs to ints
+
+    client/
+        gui_rpc_server.C
+        net_xfer_curl.h
diff --git a/client/gui_rpc_server.C b/client/gui_rpc_server.C
index 03d9ebdb07..b0ce93b7fd 100644
--- a/client/gui_rpc_server.C
+++ b/client/gui_rpc_server.C
@@ -38,6 +38,7 @@
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <arpa/inet.h>
+#include <fcntl.h>
 #endif
 
 #include "util.h"
@@ -154,12 +155,12 @@ int GUI_RPC_CONN_SET::init() {
     get_allowed_hosts();
     get_password();
 
-    lsock = socket(AF_INET, SOCK_STREAM, 0);
-    if (lsock < 0) {
+    retval = boinc_socket(lsock);
+    if (retval) {
         msg_printf(NULL, MSG_ERROR,
             "GUI RPC failed to create socket: %d", lsock
         );
-        return ERR_SOCKET;
+        return retval;
     }
 
     memset(&addr, 0, sizeof(addr));
@@ -284,6 +285,12 @@ void GUI_RPC_CONN_SET::got_select(FDSET_GROUP& fg) {
             return;
         }
 
+        // apps shouldn't inherit the socket!
+        //
+#ifndef _WIN32
+        fcntl(sock, F_SETFD, FD_CLOEXEC);
+#endif
+
         int peer_ip = (int) ntohl(addr.sin_addr.s_addr);
 
         // check list of allowed remote hosts
diff --git a/client/net_xfer_curl.h b/client/net_xfer_curl.h
index 748295c14b..453e5d98b8 100644
--- a/client/net_xfer_curl.h
+++ b/client/net_xfer_curl.h
@@ -92,8 +92,8 @@ public:
     bool io_ready;
         // Signals higher layers that they can read or write socket now
         // (used if !do_file_io)
-    long error;
-	long response;
+    int error;
+	int response;
     double start_time;
     double xfer_speed;
     double bytes_xferred;   // bytes transferred in this session