[Xitami] I wanna get this guy

[Michael]

Oops. Not sure I answered this.  It's been a busy week.

On 9 Aug 2001, at 19:37, Ted Heske wrote:

> Michael,
> 
> Thanks very much for the reference to your SSI script.  I will try it.  I am
> a *complete* newbie so I'm sure it will take me a while to get it working.
> I wondered if you could clarify some of the tips you gave me earlier:
> 
> > Keep the root level clean without
> > links and change the directory names for areas you'd prefer to keep
> > more  private.
> 
> I'm not sure what you mean by "keep the root level clean without links."
> Also, how do I keep areas more private by changing directory names?  Can't
> people just view the HTML source and get whatever directory info they want.
> Remember, I'm a bigtime newbie.  This is my first website and I know zip
> about security.  Thanks very much again, and by the way, keep an eye out for
> our new book, scheduled to come out next year.
> 
> Jill



Be sure to add me to your email list when your book comes out.

You shouldn't start out trying to get web site security by using methods 
like robots.txt, logins and passwords, scripting, filtering, etc.

Keeping the root level clean and without links simply means don't do what 
most people do which is link to everything in the web site.  Lurkers can find 
anything and search engines will rip your entire site in seconds and put it 
on public display.

Consider your root level the base of the tree.  Lurkers and others come in 
but that's all they see.  A dead end :::gasp:::

Now you can list subdirectories or branches with search engines.  The very 
most a lurker or search engine can get is that branch.  Everything else is 
invivisible unless they know it exists.  For instance, on the same domain, 
clients can get business stuff but only special people can see pictures of 
me and the family getting sunburned at Disneyworld this summer.

If a lurker finds their way into places you'd rather they didn't, all you need 
to do is change the directory name and *poof* it's invisible again and 
there's no need to redo all your links or redo logins and passwords.  You 
will have to contact those who you wish to see certain pages.  
Surprisingly, the list of people who are able to see me with Mickey Mouse 
is quite small. (Hi Mom!)

Xitami is a great web server for the home but people with one computer 
:::gasp again::: who share their most personal stuff on the same box as 
their web pages are nuts.  Xitami don't require much firepower so if you 
want lots of instant security, dedicate a cheap $200 computer for your web 
server.

Have fun!

Michael