[Fwd: Re: Writing my own FastCGI Server]

Jason P Sage wrote:

CGI's on a mainframe? Why not!?! Hmmm. A mainframe as a web server can't be
bad.

Only if you have money for that ! Have you thought about how much CPU
you need to offer a good perfomance ? Have you thought about security
issues ? Well, in our case, having a good perfomance on the mainframe
is very , very expensive. Also, mainframe doesnt like TCP/IP very much.
For instance : if you run a PortScan over it, you may put it on its
knees. So we must insulate it.

Another point : students are very, very curious and creative. They'd
love to know where grades are stored ! We prefer to keep them far, far
away from the grades database.

Anyway, I would not do it but, if you want, go ahead !

-----Original Message-----
From: fastcgi-developers-bounces+jasonpsage=jegas.com-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org
[ mailto:fastcgi-developers-bounces+jasonpsage=jegas.com-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org ]
On Behalf Of Jose Adriano Baltieri
Sent: Monday, July 17, 2006 10:57 AM
To: fastcgi-developers-xGejAJT2w6yOE5Ap4OspEtHuzzzSOjJt@public.gmane.org
Subject: Re: [FASTCGI] Writing my own FastCGI Server

Jeffrey H. Coffield wrote:

From your message, it sounds like you have the skills to do this. RFC
2616 will tell you what a web server
needs to do. I wrote my own web server because of security reasons.
Apache has too many features to keep
up with. All I needed was static pages and FastCGI. No PHP, Perl, Asp,
xyx, blah, blah, blah...

Yes, I'd like to write my own http server, of course. But I think that
is too much responsibility. I'm also thinking seriously about
Lighthttpd. It has native fastcgi support .

If I had to write my own httpserver, I'd use XB2NET which is a product
that already has a httpd class. I'd simply inherit from it.
But I'd have to purchase this product whereas using FastCGI I could go
around and get free stuff.

My main recommendation is to be extremely careful on how url's are
translated into file names. This is probably
the most important pieces of a web server. A mistake or unintended
"feature" here can leave your system wide
open to attacks.

In my case I could say I only accept 1 URL : the one to my dynamic
content page.

You could look at moving the web server to your Unisys if it supports
TCP/IP but it is not considered good
security practice to have an Internet web server running on the same
system as your databases. Usually the
web servers are in some sort of DMZ.

Not at all. Unisys mainframe OS does have a http server called Atlas.
But who would run a http server on a mainframe ? Have you though about
CGIs on a mainframe ?

Way, way too expensive !

My final recommendation is to look at moving off of Windows to some
operating system that scales better
and is inherently more secure.

Yes, this would be nice but, I'd have to rewrite it all, from bottom up.

Anyway, thanks 4 your support !

Jeff Coffield

--
Obrigado,
------------------------------------------------------------------------------
Jose Adriano Baltieri - Analista de Sistemas
DTI - CENTRO - UNIMEP - Universidade Metodista de Piracicaba
PIRACICABA - SP - Brasil - Fone : (19) 3124-1858
------------------------------------------------------------------------------

--
Obrigado,
------------------------------------------------------------------------------
Jose Adriano Baltieri - Analista de Sistemas
DTI - CENTRO - UNIMEP - Universidade Metodista de Piracicaba
PIRACICABA - SP - Brasil - Fone : (19) 3124-1858
------------------------------------------------------------------------------

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/