On Thu, May 8, 2014 at 4:37 PM, Andrea Faulds <[email protected]> wrote:
>
> On 8 May 2014, at 15:29, Ferenc Kovacs <[email protected]> wrote:
>
>
> I think this actually shows how little understanding there is in the market
> in terms of how easy migrating to FastCGI is.
>
>
> setting up fastcgi is a bit more complicated for the less tech savy people.
> it adds another step of indirection, stuff like using mod_fcgid or
> mod_fastcgi, using unix sockets or tcp, setting up the correct timeout
> settings through the pipe, max request length, etc.
>
>
> It’s also easier for new users to configure it wrong. A lot of servers
> have been misconfigured with FastCGI and have PATH_INFO-related exploits.
> You can’t make the same mistake with mod_php.
> --
> Andrea Faulds
> http://ajf.me/
>
>
>
>
>
apache+mod_php also had it's fair bit of insecure default configurations
until distros figured out how to properly set it up:
http://ilia.ws/archives/226-Beware-of-the-default-Apache-2-config-for-PHP.html
--
Ferenc Kovács
@Tyr43l - http://tyrael.hu