Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: <48D04431.7060007@jaqui-greenlees.net>
Date: Tue, 16 Sep 2008 16:41:37 -0700
From: "J. Greenlees" <lists@jaqui-greenlees.net>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.8.1.16) Gecko/20080715 SeaMonkey/1.1.11
MIME-Version: 1.0
To: users@httpd.apache.org
References: <FEECLNJFCJEDIILHOMNOKEJAHDAD.hugh@forsoft.com>
 <182715EE-1D49-459A-9498-F6ECCCE6284F@webthing.com>
In-Reply-To: <182715EE-1D49-459A-9498-F6ECCCE6284F@webthing.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [users@httpd] Directory hiding

Nick Kew wrote:
>
> On 16 Sep 2008, at 06:57, Hugh E Cruickshank wrote:
>
>> That may be the case but their recommendation is still: Issue a "404 -
>> Not Found" response status code for a forbidden resource, or remove it
>> completely.
>
> Either they're wrong or you're misreading.
>
> But I can see what's happening.  It's "chinese whispers", starting from
> the CIS benchmark.  Most likely someone along the way (IBM's tech
> writer's boss or somesuch) insisted that a meaningful explanation
> would be too difficult for their lusers, and either didn't understand or
> didn't care that it's misleading.
>
> Security by Cookery.  BTDT.  I can feel a blog entry coming on.
>
~chuckle~


Technically, cooking is following a detailed set of instructions, one 
set for each item being cooked, so it's not quite as bad as it sounds.

I don't disagree with the conclusion in this particular case, hiding 
filesystem structure in the documentroot is not an improvement in security.
I'm always concerned with security issues, but it's in the app code and 
data verification that I see as being where to focus my attention. At 
least until such time as updated underlying technologies are implimented 
to address the security issues.

Since the internet was built at a time and in an environment where 
security wasn't a concern at all, the core technologies need to be 
rebuilt with security as a priority. That would probably impact the HTTP 
Server and many other projects, requiring a lot of work to have them 
function with the new system(s) properly.


Jaqui


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org