Re: Apache ap_getpass vulnerability

[Carson Gaspar <carson () taltos org>]

--On Saturday, November 04, 2000 6:36 PM +0200 Peter Pentchev
<roam () ORBITEL BG> wrote:

> You mean you're writing an Apache module that reads user input at
> the time the server is starting?..  Does this mean that the server
> startup itself becomes interactive?  This pretty much rules out
> unattended Apache startup - you need to start the server manually
> each time it dies; also, it cannot be put in the system's startup
> scripts.  IMHO, this is not such a good idea :(

Having your private key stored un-encrypted on disk is also a really bad
idea. You have to decide how you're going to trade-off operational
complexity vs. security.

--
Carson Gaspar -- carson () taltos org
Queen Trapped in a Butch Body