Re: [GENERAL] cgi with postgres

On 2000-01-14, Alfred Perlstein mentioned:

> > issue: how to secure cgi's that access postgres
> >
> > problem: passwords for postgres database are stored
> >       in plain text in scripts. (lets assume, perl,
> >       not a compiled language)
> >
> > points:
> >     make cgi dir 711
> >     big deal, they can get the name of the file
> >     from the web, and copy it.
>
> how about sourcing a conf file that's in a 700 dir?

Security through obscurity is little security indeed.

--
Peter Eisentraut                  Sernanders väg 10:115
peter_e@gmx.net                   75262 Uppsala
http://yi.org/peter-e/            Sweden