Re: Apache Vulnerability in WebTen

> The advice you were given to turn off Squid in order to fix the problems
> that you were having is absolutely incorrect.  I apologize for the
> incorrect advice you were given.

Hm. It's been quite a while since I turned it off. I'm kinda leery of
turning it on because 1) it will cause that date problem (below) again, 2)I
don't remember what other problems it was having, and 3) I don't know what
all I'll have to re-configure to get the functionality I have now (like the
lasso_log_roller).

>> Looking through my old e-mails, I find that I finally decided to take
>> Tenon's advice and turn off the cache after reporting this problem (and
>> getting the same answer: turn off the cache):
>>> When my WT memory allocation exceeds ~100 MB (due to Squid), WT decides
>>> (both in Apache and FTP) that the modification date of every document should
>>> be something recent (probably the moment when they were added to the cache).
>>> The only way to fix it is to clear the cache AND reboot the server. This
>>> results in a couple minutes of down-time that is starting to get me in
>>> trouble with my company's management. It also means that when the dates show
>>> incorrectly, our copyright information is incorrect, which could get us
>>> into legal trouble.
> 
> Are you implying that the modification dates to files actually get changed
> when the WebTen application's memory usage exceeds 100MB?  I doubt that
> the memory usage would correlate to modification dates.  There may be
> another issue at work here.

With Squid on, after the WebTen memory allocation exceeds ~100MB, the
echo var="Last_Modified"
command on any file shows today's date (or a very recent date). Likewise, an
FTP directory listing shows the same recent date. Only emptying the cache
AND rebooting the server result in the dates reverting to their proper date
(as is shown in the OS 9 Finder).

> What is your Squid cache size set to?

In troubleshooting this, I tried setting it very high and very low, to no
apparent effect.
 
> I would like to look into this further and cross-reference it with our
> list of known issues.  We may have a solution for you that doesn't include
> degrading the performance of your server by turning off Squid.

Would love to hear it. I will be transitioning to OS X in the next few
months, however, so I'm not going to kill myself to get this to work, unless
there's an indication hackers are finding me.

>> WebTen has indeed worked better since turning off the cache. It also gives
>> me better control over the logging.
> 
> WebTen's speed is significantly slower when the cache is disabled.  I'm
> surprised that you find that it is running better.

That was indeed a major concern of mine. I tried and tried to get it to work
with the cache on, but was eventually talked into turning it off. I'll
forward you some of the e-mails relevant to the topic.