21–30 of 115 posts
On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
Anybody still using Apache?
Anybody still using Apache?
https://news.netcraft.com/archives/category/web-server-surve...
Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
That's an interesting point. I would love to see someone testing this assumption.
Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
We like exposing our private B2B web services in such a way that an attacker would be led to think the web server is totally fucked up or otherwise mis-configured if they don't understand the proprietary protocol. It's not that they could never understand it, but it would take a significant, targeted effort to even begin attacking our system in a direct fashion. Even if they figure out the obfuscation, they are still going to have to fight through a moat of PBKDF2 & hardware tokens.
To me, obfuscation is all about minimizing the impact of automated, mass, 0-day assaults. Some person will always be able to walk back something another person built. You can mitigate legions of scripts by cleverly dropping TCP connections when a resource isn't requested in just the right way.
Another fun option is to build a honey pot around your web service which has the ability to ferret naughty TCP pipes off to the hacker matrix where you then simulate all manner of PII-rich data sources for them to worry about (instead of your actual business).
Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
https://www.mail-archive.com/fedora-list@redhat.com/msg06924...
>On Jul 16, 2008, Les Mikesell wrote:
>> Alexandre Oliva wrote:
>> Apache wasn't the original name.
>It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten years after GNU started.
Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
Earlier quoted context omitted.
What's wrong with Apache? (honest question)
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…