You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Marc Slemko <ma...@znep.com> on 1997/07/01 22:24:51 UTC
mirrors and SSIs
The current setup assumes that mirrors have SSIs enabled. Some don't.
How do we resolve that?
Re: mirrors and SSIs
Posted by Brian Behlendorf <br...@organic.com>.
At 02:57 PM 7/1/97 -0700, you wrote:
>No this is the wrong answer. I, for example, refuse to run CGIs or SSIs
>that I download automatically from taz... and I trust Brian. Requiring
>mirrors to run SSI or CGI means that a compromise of taz can be a
>compromise of every single mirror site.
How can IncludesNoExec be a concern?
Brian
--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
"Why not?" - TL brian@organic.com - hyperreal.org - apache.org
Re: mirrors and SSIs
Posted by Marc Slemko <ma...@worldgate.com>.
I'm fine with that decision, but I don't think it is in
how-to-mirror.html. It should be added, and a note should be sent to the
mirrors list if that is what we want to do...
On Tue, 1 Jul 1997, Alexei Kosut wrote:
> On Tue, 1 Jul 1997, Marc Slemko wrote:
>
> > The current setup assumes that mirrors have SSIs enabled. Some don't.
> > How do we resolve that?
>
> If they don't have SSI enabled, they're not mirrors, and IMHO we should
> remove them from the HTTP mirror list.
>
> -- Alexei Kosut <ak...@organic.com>
>
Re: mirrors and SSIs
Posted by Dean Gaudet <dg...@arctic.org>.
No this is the wrong answer. I, for example, refuse to run CGIs or SSIs
that I download automatically from taz... and I trust Brian. Requiring
mirrors to run SSI or CGI means that a compromise of taz can be a
compromise of every single mirror site.
Alexei you wrote a perl script that we use to get rid of the SSI for
distribution, it should also be running on the live site.
Dean
On Tue, 1 Jul 1997, Alexei Kosut wrote:
> On Tue, 1 Jul 1997, Marc Slemko wrote:
>
> > The current setup assumes that mirrors have SSIs enabled. Some don't.
> > How do we resolve that?
>
> If they don't have SSI enabled, they're not mirrors, and IMHO we should
> remove them from the HTTP mirror list.
>
> -- Alexei Kosut <ak...@organic.com>
>
>
Re: mirrors and SSIs
Posted by Alexei Kosut <ak...@organic.com>.
On Tue, 1 Jul 1997, Marc Slemko wrote:
> The current setup assumes that mirrors have SSIs enabled. Some don't.
> How do we resolve that?
If they don't have SSI enabled, they're not mirrors, and IMHO we should
remove them from the HTTP mirror list.
-- Alexei Kosut <ak...@organic.com>