4 ms·

> I've never heard of this happening in any Linux distribution. Can you be more specific? It was a couple of years ago. I know somewhere I have notes on it, bu

> I've never heard of this happening in any Linux distribution. Can you be more specific? It was a couple of years ago. I know somewhere I have notes on it, but I can't find them just this minute. I remember that it had something to do with one of the components in my apache-mpm-worker--php5--libapache2-mod-fcgid--apache2-suexec-custom--libapache-mod-security stack. It was something like, mpm-worker no longer supported libapache2-mod-fcgid or some such thing. At the time, I was really good about doing regular server updates, so when it happened, I spent some time researching it but eventually found the package had been removed during the update and was no longer supported, with no workaround aside from finding a new way to build an apache server. Either it got fixed or I'm running a slightly different stack now than I was at the time. Sorry I can't be more helpful. > This is because of a shortcut that somebody took... > You might want to look into "DevOps"... That somebody was me, and I'm aware of devops. Pretty big fan of it actually. Unfortunately, I'm just a small MSP, the owner and the senior tech and the sole software developer and the sysadmin, and I don't charge enough. The servers exist as an add-on service for my clients, especially ones that have special needs that other hosting companies can't easily meet. They work, the stacks I built a few years ago are robust and efficient (one of my customers was featured on a popular national radio show with a reputation for killing websites, but their site stayed up and responsive the whole time). Reproducible deployments, centralized management, further improvements to automated security, etc. are all on my to-do list -- along with like a couple dozen other things. I was supposed to rebuild all of the servers during last December, typically a slow period, but instead it was unseasonably, hair-on-fire, brain-meltingly busy, and it still hasn't let up.

rlpb 12y ago
> It was something like, mpm-worker no longer supported libapache2-mod-fcgid or some such thing. No stable release distribution ever does this within a release, unless there is a security issue that cannot be fixed any other way. In this case would you prefer to have remained vulnerable? Of course, mistakes can happen, but they would be fixed in a further regression update, or you could have even looked at fixing the bug yourself. Based on the package names you're likely talking about Debian or Ubuntu. In both cases, you could have just downgraded the packages for a quick (albeit temporary) end to your emergency.

rlpb 12y ago

> It was something like, mpm-worker no longer supported libapache2-mod-fcgid or some such thing. No stable release distribution ever does this within a release, unless there is a security issue that cannot be fixed any other way. In this case would you prefer to have remained vulnerable? Of course, mistakes can happen, but they would be fixed in a further regression update, or you could have even looked at fixing the bug yourself. Based on the package names you're likely talking about Debian or Ubuntu. In both cases, you could have just downgraded the packages for a quick (albeit temporary) end to your emergency.