JONTILLMAN.COM | part of the problem since 1976

Why, oh why would a web host be stupid enough to install hundreds of directories for hundreds of customers with permissions 777 and then run apache as ‘nobody‘?

Why would they also run PHP with ‘register_globals=true’ and without open_basedir?

Why would they not use chroot jails for Apache?

Why would they not provide CGIWrap or suEXEC?

…no posts in days, I know. I am too busy cleaning up after an easily prevented script-kiddie attack. Stupid, stupid host. Tons of scripts running on their virtual host boxes, most with some sort of file upload capability, and they run Apache as nobody! Nicely done, asshats. One user or one script gets compromised and suddenly every folder on the entire server that is perm’d 777 starts serving up WMF exploits to every website visitor.