Is your security analysis assuming that the attacker is running under a different uid than the web server? Well, that's just what my example question above sai

Is your security analysis assuming that the attacker is running under a different uid than the web server? Well, that's just what my example question above said. Why on earth would you do that? To avoid them reading the memory? It's pretty common for shared hosting to have each user running on their own local port and a reverse proxy listening on 80, just so that each user gets the benefit of the basic UNIX security model (we assume trust in the admin, of course). I guess I don't understand the whole password in a file thing, either. If those have proper permissions then the only person who have to trust other than yourself is root. Seems better than nothing to me.