Re: apache manual language

On Tue, 2002-09-17 at 11:30, Rui Miguel Silva Seabra wrote:
> On Tue, 2002-09-17 at 19:05, Gordon Messmer wrote:
> > No one's arguing that.  However, symlink attacks are only possible by
> > users of the system.
> 
> Yes, like the apache user.

That's ridiculous.  I'm talking about local users.  If a remote attacker
can convince apache to create a symlink, he can probably get it to serve
up a file outside the html root, too.  If you think that symlinks
present a real threat in the default configuration, on a system where
the users are trusted, then prove it.  Provide a danger scenario. 
Otherwise you're bickering.  Quit it.

> > > However, in the stated case, it is NEVER a performance hit, or do you
> > > run web servers with the default configuration?
> > What stated case?
> 
> Default configurations.

OK, compared to the default configuration, disallowing symlinks is a
performance hit.  Now, regardless of how you or I feel about the default
configuration, you continue to argue that it is not a performance hit,
and you're wrong.  If you think otherwise, prove it.  Tell us how it's
not a performance hit to stat() all of the items in the path to search
for symlinks.  (And bear in mind that I'm not arguing that the
performance hit is good reason for leaving this out of the default
configuration; I think there are other good reasons for leaving it out)