Re: [mod-security-users] mod_security in .htaccess files opinions?

[Mark <ad...@as...>]

Ivan Ristic wrote:

> I am thinking about removing the ability of mod_security
> to have its configuration directives in .htaccess files. I
> am even considering doing that in the forthcoming 1.8.5
> release. I haven't made up my mind yet but I'd like to
> know what others think about it.

Ditch it. :) Seriously, it has no place in .htaccess (frankly, I am one of 
those people who does not like any sort of administrative override in 
..htaccess to begin with).

Know, at least, I will shed no tear over its upcoming loss.

> On the other hand, I would hate to break backward
> compatibility in a minor, bug-fixing release. So the
> other option is to have .htaccess configuration directives
> off by default in 1.9.x, and introduce a global directive
> to enable it explicitly.

As long as it can be disabled, it can stay, as far as I am concerned. But my 
underlying "approval" is, of course, based on the ability to disable it; 
that should tell you enough. :)

- Mark

        System Administrator Asarian-host.org

---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx