Timeline for Does disabling .htaccess improve security?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 8, 2013 at 3:54 | answer | added | wireghoul | timeline score: 2 | |
| May 30, 2013 at 8:39 | answer | added | AbsoluteƵERØ | timeline score: 6 | |
| May 30, 2013 at 1:24 | answer | added | matthew | timeline score: 7 | |
| May 29, 2013 at 20:07 | history | tweeted | twitter.com/#!/StackSecurity/status/339835447868022784 | ||
| May 29, 2013 at 20:02 | comment | added | Xander | The primary reason I've seen for removing htaccess is not security related at all, but for performance. If they haven't explicitly said they're removing it for security reasons, they may be removing it to keep you from shooting yourself in the foot perf-wise with thousands of complex rules. | |
| May 29, 2013 at 19:54 | answer | added | gowenfawr | timeline score: 1 | |
| May 29, 2013 at 19:18 | comment | added | Lucas Kauffman | From my experience, bulletproof is an overcommercialized solution which does not offer a lot of added security. They advertise that they protect against CSRF (I actually mailed them to ask this) while in fact they aren't. If I can make a suggestion have a look at Wordfence instead of BPS. At least they can offer a lot more than writing regexes for htaccess. | |
| May 29, 2013 at 18:56 | comment | added | Adi |
Honestly, I think this is just some paranoia bullsh*t. If an attacker is able to infiltrate your security measures and gain access to your server, then modify your .htaccess then you have bigger problems. Same goes if your security depends on certain user-level Apache configurations so bad that you cannot trust your users with local .htaccess files, then you're a crappy sysadmin.
|
|
| May 29, 2013 at 18:52 | history | asked | That Brazilian Guy | CC BY-SA 3.0 |