- a. Don't run as root
- b. Create directories for any CGI content and allow CGI to be run ONLY from those locations.
- c. Disable telnet and ftp services on your machine and replace with ssh/scp.
- d. Disallow the use of .htaccess files by using the "AllowOverride None" directive.
- e. Make sure someone in your organization is responsible for keeping an eye on security advisories, and upgrading as necessary.
As a programmer, I prefer 2.0. As the name implies, Apache 1.x was in fact fairly patchy. I think 2.0 is an elegant consolidation of the core features, and very well thought-out with regards to future requirements--for instance, they've put some real effort into wireless support. I'm also excited about the multithreading refinements, and what that means for the Apache vs. IIS duel.
However, in my day-to-day life I'm still using 1.3. I wouldn't call it a preference, but my business relies on a number of modules that are only available for 1.3.
What are your future plans? Any exciting new projects?
As it happens, yes. I'm just wrapping up a year-long development effort this week. Myself and a few partners have created a GUI interface to Unix that can be run on the wireless handheld devices. The idea is to give all the pager slaves out there a way to fix Unix problems without staying chained to a terminal.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.