4 ms·
Good article. Be wary of the well documented zero-day exploits if you're using php. This is one of my other favorite articles: http://docs.ngx.cc/en/latest/top
by TallboyOne 13y ago
Good article. Be wary of the well documented zero-day exploits if you're using php.
This is one of my other favorite articles: http://docs.ngx.cc/en/latest/topics/tutorials/config_pitfalls.html http://docs.ngx.cc/en/latest/topics/tutorials/config_pitfall...
Some good introductory stuff here as well: http://pineapple.io/resources/tagged/nginx http://pineapple.io/resources/tagged/nginx
- Nate75Sanders 13y agowary
- TallboyOne 13y agoYikes, I'm supposed to be the grammar and spelling nazi :P
- mikegioia 13y agoThat first article was awesome. I found 2 things in my configs that were security holes :/
- emillon 13y agoHow can a zero-day be well documented? By definition it's not yet public.
- meritt 13y agoIt sounds scarier than saying: "If you use PHP, remember to set the following in your .ini" cgi.fix_pathinfo = 0
- jonknee 13y agoSo not zero day and not an exploit. A terrible idea for a feature though, PHP seems to be rich with those.
- meritt 13y agoNot really a terrible idea at all. They are simply conforming to the CGI specification. In realizing the potential security issues associated with doing so, they offer a way to disable that behavior.