From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chad N. Tindel <chad@tindel.net>
Cc: pgsql-docs@postgresql.org
Subject: Re: Mysql -> Postgresql pitfalls
Date: Sun, 03 Aug 2003 13:03:44 -0400
Message-ID: <28368.1059930224@sss.pgh.pa.us> (raw)
In-Reply-To: <20030802170410.GA12300@calma.pair.com>
References: <20030801163555.GA32496@calma.pair.com>
<Pine.LNX.4.33.0308011426280.30340-100000@css120.ihs.com>
<20030801205110.GA63709@calma.pair.com>
<18494.1059792541@sss.pgh.pa.us>
<20030802170410.GA12300@calma.pair.com>
"Chad N. Tindel" <chad@tindel.net> writes:
>> If someone roots your box, it's not our fault. Simple as that.
> I didn't say "require them to run as a non-root user". I said "Give them
> the choice to decide what is correct for their environment". In the case
> of apache, there are many internal webservers that are not exposed to the
> threat of the public internet; for such servers, it may be appropriate to run
> apache as root because it simplifies the administration and automation of
> tasks. But to do so, one has to know how to re-compile apache, which will
> exclude a lot of your basic garden variety administrators. Its very
> un-friendly programming.
If they don't know how to recompile apache, what are the odds that they
are truly competent to decide that they can safely run it as root?
Semi-competent people administering servers are the Achilles heel of the
internet already. We are doing them a favor, not creating a problem,
by preventing them from adopting insecure practices.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: tgl@sss.pgh.pa.us, chad@tindel.net
Subject: Re: Mysql -> Postgresql pitfalls
In-Reply-To: <28368.1059930224@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox