Quoting "Craig R. McClanahan" <[EMAIL PROTECTED]>:
> 
> Craig (who is amused by this, since Apache itself ships with CGI
> enabled)

True enough, but the very point of JSP/Servlets is to obviate the need for CGI. 
I can't imagine that ANYONE would want to run CGI from Tomcat unless they had 
some legacy CGI code, and even then they would probably run that on Apache.

Anyway, that's why I would be in favor of turning it off by default. It's true 
that it is almost a non-risk given it's design, but no sense in leaving it 
turned on by default. It's only purpose 99.9% of the time would be to sit there 
unused.

- Christopher

Reply via email to