Re: apache manual language

On Tue, 2002-09-17 at 19:05, Gordon Messmer wrote:
> No one's arguing that.  However, symlink attacks are only possible by
> users of the system.

Yes, like the apache user.

> Turning off symlinks by default would also break a number of third party
> packages, which would not be desirable.

That's bad, but it probably means those packages should be fixed.

> > However, in the stated case, it is NEVER a performance hit, or do you
> > run web servers with the default configuration?
> What stated case?

Default configurations.

> Requiring that the server not follow symlinks is
> always a performance hit.  The server will always have to stat all of
> the members of every URL's path to determine that they are not symlinks,
> in addition to all other overhead.

If you have to fight for every hit of performance, then yes it is a non
neglectible performance hit, in which case other risks are probably not
so important.

Most of the time, though, it is neglectible anyway.

In fact, it is more than perfectly neglectible in default
configurations, where the risk of accidents is a bigger performance hit.

Rui

-- 
+ No matter how much you do, you never do enough -- unknown
+ Whatever you do will be insignificant,
| but it is very important that you do it -- Gandhi
+ So let's do it...?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQA9h3Tho+C50no0+t4RAh1WAJ4x/C3zjrOXw8MlcH7lOViSNG/wSACfUsbm
iUhHMn2kBV14qGUpzQ8eX6U=
=nBIC
-----END PGP SIGNATURE-----