From: Phillip Gawlowski <cmdjackryan@...>
Date: 2011-10-25T04:59:41+09:00
Subject: Re: security thesis advice

On Mon, Oct 24, 2011 at 11:08 AM, Michal Suchanek <hramrach@centrum.cz> wrote:
>
> It relies on security built into PHP (disabling certain features) to
> isolate these sites from each other. They live in one filesystem on
> one server but supposedly cannot access any data of each other, there
> is CPU and real time limit on execution of every page to prevent DoS,
> etc. Technically each site is associated with an UID - think of a web
> site stored in your home directory on a shared server.
>
> I don't know of any Ruby enabled web server that can run multiple
> sites like that.

Actually, this relies on *Apache's* features: Apache spawns off a PHP
thread for each site with mod_php (it's more complicated than that,
but that's essentially it, IIRC).

I'm pretty sure mod_passenger does that, too, for Sinatara, Rails,
and, I think, Rack middleware.

And, well, if you have to *disable* features to make something secure,
it really isn't designed with security in mind. ;)

-- 
Phillip Gawlowski

gplus.to/phgaw | twitter.com/phgaw

A method of solution is perfect if we can forsee from the start,
and even prove, that following that method we shall attain our aim.
              -- Leibniz