On Sat, 18 Aug 2001, Christopher Cain wrote:

> Quoting "Craig R. McClanahan" <[EMAIL PROTECTED]>:
> > 
> > Craig (who is amused by this, since Apache itself ships with CGI
> > enabled)
> 
> True enough, but the very point of JSP/Servlets is to obviate the need for CGI. 
> I can't imagine that ANYONE would want to run CGI from Tomcat unless they had 
> some legacy CGI code, and even then they would probably run that on Apache.
> 
> Anyway, that's why I would be in favor of turning it off by default. It's true 
> that it is almost a non-risk given it's design, but no sense in leaving it 
> turned on by default. It's only purpose 99.9% of the time would be to sit there 
> unused.
> 

Don't get me wrong, I'm ok with turning it off by default ... but it also
needs someone to write a HOWTO document on how to turn it on and use it
(to avoid endless questions on TOMCAT-USER about "I thought you said
Tomcat 4 supported CGI" :-).

> - Christopher
> 

Craig


Reply via email to