Re: secure web

Your question is much "romantic"and difficult to reply. You asked about Apa=
che or Nginx. The first, Apache, is super known (and cracked) and to fire p=
hp originally pass by a=C2=A0 phpmod (more safe) or by fastcgi. Nginx itsel=
f is built on a subsystem made of variables (easy to clear or change on the=
 fly) and to fire php it passes by fastcgi. If you need php-fpm you neeed f=
astcgi. And with fastcgi, being multihop/multitear/multilayer/whatever web =
solution you change or clear a fastcgi variable and your http exchange is g=
one.
Beyond these webservers httpd is=C2=A0 maybe more secure in OpenBSD, when y=
ou are there, but a little limited in syntax and modernity (maybe miss the =
nginx variables ;) not really in portability..

Then they reply you of a php maybe not so secure. Maybe meaning that a scri=
pting language is not so as cool as hamblee. But without class libraries is=
 probably more sexy and less prone to 3rd party hacking. (did you heard any=
 hacked voice system written in .net by the way?). Anyway, remaining on you=
r security php plan.. it also depends on how much you are involved php=C2=
=A0 in: db drivers, 3rd party components and external libraries. Here I'm e=
nough serious ad less joke prone, be minimalist cause it pays off.

I wonder than if at this point you think to be safe in C# or Java, but it n=
eeds an other thread..

Hope this helps.

From: Romain FABBRI <[email protected]>
To: Gustavo Rios <[email protected]>; OpenBSD-Misc <[email protected]>
Date: Jul 28, 2026 17:42:10
Subject: Re: secure web

> Hi,
>=20
> =C2=A0
>=20
> FPM is about PHP do you need PHP=C2=A0?
>=20
> PHP is built =C2=AB=C2=A0with=C2=A0=C2=BB FPM on openbsd (so the php pack=
age is in fact php-fpm)
>=20
> =C2=A0
>=20
> If you need maximum security and less features have a look at httpd in ba=
se it might be enough depending of your needs
>=20
> =C2=A0
>=20
> And if you need maximum security PHP might not be the best option unless =
it=E2=80=99s needed
>=20
> What do you really want to do=C2=A0?
>=20
> =C2=A0
>=20
> Regards,
>=20
> =C2=A0
>=20
> Romain
>=20
> =C2=A0
>=20
> *De=C2=A0:* [email protected] <[email protected]> *De la part d=
e* Gustavo Rios
> *Envoy=C3=A9=C2=A0:* mardi 28 juillet 2026 03:10
> *=C3=80=C2=A0:* OpenBSD-Misc <[email protected]>
> *Objet=C2=A0:* secure web
>=20
> =C2=A0
>=20
> Hi folks.
>=20
> =C2=A0
>=20
> I am in need to setup=C2=A0a web server (apache/nginx) in order to get ma=
ximum of security. I wonder how *-fpm could be used to supply such demand.
>=20
> =C2=A0
>=20
> thanks a lot for your time and cooperation.
>=20
> =C2=A0
>=20
> Gustavo.
>=20