On Tue, Sep 29, 2009 at 8:36 PM, André Cruz <teste@cabine.org> wrote:
On Tue, Sep 29, 2009 at 5:04 PM, Brian Rectanus <Brian.Rectanus@breach.com> wrote:
I've read several posts about how to compile mod_security with a static
build of apache but none of them worked, the latest was
http://thread.gmane.org/gmane.comp.apache.mod-security.user/1840/focus=1841

Could you give your reasoning for building it static?  I have never seen a need for it.  If there really is one, then maybe I can do something to aide in this?

From a security standpoint it makes sense to only include the code that you're going to need.
The glibc mantainer think  different about security & static linking
http://people.redhat.com/drepper/no_static_linking.html
FWIW i think the same

Regards
I know exactly which modules I need so I build my custom apache with only those modules and include them statically. The whole dynamic loading of modules is just another piece of code I can live without.

I'm sure you'll agree this makes sense. Also, I sleep a little better knowing that rogue modules cannot be loaded into the web server. :)

Best regards,
André Cruz



------------------------------------------------------------------------------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
http://p.sf.net/sfu/devconf
_______________________________________________
mod-security-users mailing list
mod-security-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html