Re: apache manual language

On Tue, 2002-09-17 at 08:19, Rui Miguel Silva Seabra wrote:
> On Tue, 2002-09-17 at 16:09, Gordon Messmer wrote:
> > On Tue, 2002-09-17 at 05:32, Rui Miguel Silva Seabra wrote:
> > > Disabling FollowSymLinks is a performance improvement, not hit.
> > No it isn't.  When you configure the server to not follow symlinks, it
> > has to stat() all of the directories in the path to the file to make
> 
> I consider better security an improvement on performance, since overall
> uptime counts for performance too.

No one's arguing that.  However, symlink attacks are only possible by
users of the system.  I think it's acceptable to trust users with logins
by default, especially when not doing so would be detrimental to the
performance of the system.  System admins who do not trust their users
are free to turn off symlink following selectively.

Turning off symlinks by default would also break a number of third party
packages, which would not be desirable.

> > sure that none of them are symlinks.  This takes more time per page than
> > when the server is allowed to follow symlinks, and such checks are
> > unnecessary.
> 
> However, in the stated case, it is NEVER a performance hit, or do you
> run web servers with the default configuration?

What stated case?  Requiring that the server not follow symlinks is
always a performance hit.  The server will always have to stat all of
the members of every URL's path to determine that they are not symlinks,
in addition to all other overhead.