Don't Leave Coredumps on Web Servers

Unless you use xdebug.max_nesting_level

By phrasing it as applicable to "web servers" in general, this article entails an implicit assumption that all HTTP servers "expose secret information" in core dumps. This is not the case. There still exist WWW sites where the HTTP server's code is entirely open, the content being published is entirely open, and no password or other user credentials mechanism is used by the HTTP server.

Not all WWW sites in the world are complex constructions of server-side scripting languages, plug-ins, cookies, user account authentication, and "business logic". Some serve up static content with code that has been around for decades and in the public domain for at least one decade. A core dump does not expose secret information on such sites, because there is no secret information to expose.

It's just untidy. (-:

Of course, it is a lot harder to cause these HTTP servers to dump core in the first place. The article's note about PHP being a source of core dumps again has the implicit assumption that PHP is involved in all WWW servers in the first place. It is not. Moreover, good practice for at least one such of these HTTP servers is to run them under the aegis of an unprivileged and dedicated to the purpose user account that has no owner nor write access to any filesystem object anywhere under its changed root. Thus they cannot create a core dump file irrespective of core dump size resource limits.