Re: mod_perl waters too deep
[email protected] (Randal L. Schwartz)
| Newsgroups | gmane.comp.apache.mod-perl |
|---|---|
| Message-ID | <[email protected]> |
>>>>> "Tosh" == Tosh Cooey <[email protected]> writes: Tosh> I want to setup an application for multiple clients, each of whom have their Tosh> own users. Tosh> http://www.site.com/clientA/application.pl Tosh> http://www.site.com/clientB/application.pl Tosh> http://www.site.com/clientX/application.pl Just an aside, but (a) can your clients load their own code onto the server without you intervening, and if so (b) do all of your clients *absolutely* trust each other? I'm saying this because I'm not sure if you realize that the trust domain for mod_perl is the entire server. If I can upload code to the same server you're using, I can mess up your day, pretty bad, because the Perl interpreters are necessarily shared. For example, I can patch the loaded CGI.pm so that if it sees your code and a secret extra parameter, it automatically gives me complete access to your data. This is why there are no "shared hosting" plans for mod_perl that don't require running completely separate clusters of apache servers. There's nothing like "su-exec" for mod_perl - it's not even possible. -- Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095 <[email protected]> <URL:http://www.stonehenge.com/merlyn/> Smalltalk/Perl/Unix consulting, Technical writing, Comedy, etc. etc. See http://methodsandmessages.vox.com/ for Smalltalk and Seaside discussion