Essential Apache for Web Professionals actually went pretty fast. I had written another Apache book the year before, so I had a good idea of what topics needed to be covered and all the details were still fresh in my mind.

In general, though, I would say that writing a technical book is similar to writing twenty or thirty term papers in a row. It can be done, but it's not really anyone's idea of a good time.

What advice do you have for people that are considering exchanging IIS for Apache?

I'm quite confident that that is a sound business decision. At the risk of arousing all the Microsoft partisans out there, I'll reiterate the party line: Apache is faster, more reliable, more secure, and free.

In your opinion, what security measures should Apache administrators deploy?


Running on Apache (as opposed to IIS) is a good first step :^). In all seriousness, it's not possible to put together a security policy that is exactly right for every environment. The below is a short list of things that are always a good idea:

• a. Don't run as root
• b. Create directories for any CGI content and allow CGI to be run ONLY from those locations.
• c. Disable telnet and ftp services on your machine and replace with ssh/scp.
• d. Disallow the use of .htaccess files by using the "AllowOverride None" directive.
• e. Make sure someone in your organization is responsible for keeping an eye on security advisories, and upgrading as necessary.

What version of Apache do you prefer, 1.3.x or 2.0.x?

As a programmer, I prefer 2.0. As the name implies, Apache 1.x was in fact fairly patchy. I think 2.0 is an elegant consolidation of the core features, and very well thought-out with regards to future requirements--for instance, they've put some real effort into wireless support. I'm also excited about the multithreading refinements, and what that means for the Apache vs. IIS duel.

However, in my day-to-day life I'm still using 1.3. I wouldn't call it a preference, but my business relies on a number of modules that are only available for 1.3.

What are your future plans? Any exciting new projects?

As it happens, yes. I'm just wrapping up a year-long development effort this week. Myself and a few partners have created a GUI interface to Unix that can be run on the wireless handheld devices. The idea is to give all the pager slaves out there a way to fix Unix problems without staying chained to a terminal.