Hacker News new | ask | show | jobs
by tlackemann 1639 days ago
Just because you read it in an old book doesn't mean people practice it. Any real world experience outside a Fortune 500 will inform you that.
2 comments

It takes real effort to run most of the LAMP stack as root. If you don't understand Unix permissions it's not easy. Apache, mysql, (and therefore php) all run by default as a low-privileged user. I have plenty of real world experience and haven't seen apache or mysql run as root outside of embedded devices, and even that was maybe a handful of times.
Another way to say it is that if a book says to not do something, it must be because there are people out there doing the opposite...
But the book isn't saying "You should try to make sure your web server runs as nobody". It's saying "when you're deploying your CGI programs, take into account the fact that the web server you're deploying to likely runs as nobody".