Security and freedom

I could wax on about how if you give up freedom for security you deserve neither, but this isn't a political point I'm trying to make. Instead it turns out that if you want security on the Internet, you have to give up some freedoms. Case in point was that this site was lost to the world because of a security decision coupled with a freedom decision.

PHP (which runs this site) has a mode called 'Safe Mode', wherein it will try and restrict the ability of itself to run amok and cause you grief. We had reason to switch this on globally for all of our sites (previously we had assumed that all our sites were well behaved, and I'm sure you all know the aphorism of the meaning of 'assume'). Seemed like a good idea until it became clear that we also made some management decisions about file ownerships to make it easier for multiple people to manage the sites. Well, Safe Mode has this thing about including unsafe content, like class libraries, and config files, at least that is what the effect was. What it was really doing wasn't all that bad, in fact it was quite good, it was blocking the loading of files that it didn't own. Which had we set this up as a single user system and not had a bunch of sites that we all hack on from time to time might have made sense. So now we have restricted our ability to share the workload in order to restrict the ability of unvetted code from doing damage.

Hopefully this will mean that our various sites won't be causing us any management grief. If you do notice some oddities, like pages that loaded before not loading, let us know so we can sort it out.

No feedback yet


Form is loading...