678 reputation
718
bio website bitdepth.thomasrutter.com
location Australia
age 33
visits member for 4 years, 11 months
seen Apr 10 at 2:11

Web application developer by day who has also dabbled in audio, video and image tools.


May
11
comment when should I use “apache:apache” or “nobody:nobody” on my web server files?
Reason for having Apache run as a user other than "nobody" is that if someone compromises Apache (through a bad PHP script, for instance) they are stuck in a user account that's only used for Apache and nothing else. Other services use the "nobody" account.
May
10
awarded  Citizen Patrol
May
10
comment Best Linux flavor for web application development (LAMP)
I'm a Debian person myself, but I would also include Ubuntu LTS in that list of stable distros. Each release has security support for at least 5 years.
May
10
comment Best Linux flavor for web application development (LAMP)
I've read that Ubuntu and Debian installations far outnumber other distros on virtual private servers at linode.com and slicehost, for example. Not that CentOS isn't popular elsewhere...
May
10
awarded  Editor
May
10
revised Security issues of running PHP scripts as the owner of the PHP file with suexec
added 2 characters in body
May
10
answered Solution for when your website's emails goes into yahoo or gmail spam folder
May
10
comment Choosing a Wiki for an academic institute
I work at a university that uses Confluence...
May
10
asked Security issues of running PHP scripts as the owner of the PHP file with suexec
May
10
accepted Should DKIM signing happen in the application or the MTA?
May
6
comment Can Spammers get your email address if it's set as postmaster, webmaster, etc?
No. Mail servers don't give out where an email is forwarded to.
May
6
comment What is the best Linux backup method for a home server?
I've had experience with this, and found that consumer NAS devices tend to have such low CPU power that SSH (encryption overhead) and rsync (hashing overhead) are prohibitively slow - 1 to 2 MB per second transfer, plus just reading files is slow even when nothing has changed. Unencrypted FTP was fine. This probably doesn't apply to newer Intel x86 based devices - mine was Marvell Orion based.
May
6
comment Should DKIM signing happen in the application or the MTA?
@Chris S, each application/client could use a different key. DKIM allows for different keys per hostname and even within one hostname. I would have thought that from a security perspective, each client having their own key would be much better than to sign all clients' mail with the one private key. Not saying leaving it to the clients is better, just should be better from a security perspective, and of course security is usually at odds with convenience.
May
6
comment Should DKIM signing happen in the application or the MTA?
Thanks for your answer. A would-be phisher wouldn't necessarily need to fully own your server at root level to send out mail in your name - it would be enough just for one of your users/clients to have poor password hygiene allowing someone into their limited user account. However I see your point that it's still my problem if that happens. Just not sure how to mitigate it.
May
4
awarded  Student
May
4
asked Should DKIM signing happen in the application or the MTA?
May
2
awarded  Commentator
May
2
comment DKIM sign outgoing mail from any domain (with Postfix and Ubuntu)
Thanks for putting this up here, it's helping others (like me) out :)
May
2
answered How to fix mail server SSL?
Apr
29
answered Is it bad to have the reverse DNS for two IPs point to the same domain name?