> -----Original Message----- > From: Connie DeCinko [mailto:[EMAIL PROTECTED] > Sent: Saturday, April 23, 2005 2:12 PM > To: CF-Talk > Subject: RE: CrystalTech Users Beware > > No, even so, that is a major bug in ColdFusion and or sandboxing, or at > least a problem with the configuration. This means that someone could > maliciously decide to hijack my site just because they are on the same box > and guessed my application name. Security should be #1 at any hosting > price > level. Every site should be treated as if a virtual dedicated server.
Then every site should cost $80/month. People on shared hosts accept the (still relatively small) risk of "hijacking" in exchange for paying sometimes a tenth of a what a real dedicated space (whether virtual or not) would cost. It's a trade of you make, pure and simple - and it has nothing to do with CrystalTech or CF or Windows or whatever. The same problems occur when your sharing any resources, anyplace. Every site CAN'T be treated as a virtual dedicated server if you're sharing resources! It just can't be - the only way to treat every site as a virtual dedicated server is to make every site a virtual dedicated server! So, to do that, CrystalTech (or any host) would have to accept that a box capable of serving, say, 100 shared accounts could now only serve perhaps 10-15. The customer then needs to prepare for a cost hike to cover that. As far as it goes CrystalTech has (as far as I know) the absolute cheapest dedicated hosting plan I've seen: $80/month gets you an actual box, all your own. It's not a great box, but it'll do for well over 99% of the sites out there. Of course in that case you also have to provide your own ColdFusion license (or use BlueDragon). "Security" and "Cheap" just don't go together. That being said CrytalTech, HostMySite and many other CF host still provide good (but nowhere near perfect) security configurations on their shared servers. There are still hosts where all you have to do to download other people's files is to go up a directory in FTP and pick from the smorgasbord. Jim Davis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tracking and documenting hours spent on a project or with a client with Logware today. Try it for free with a 15 day trial account. http://www.houseoffusion.com/banners/view.cfm?bannerid=67 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:204124 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
