In the spirit of my Firefox extensions , and since Ijust went through this exercise today, here are the Firefox preferencescustomizations that I currently use. At least some of these are onlypresent in relatively bleeding edge Firefox builds, and you will needto use about:config to enable at least some of them.

(I have not put everything in here, just the stuff that I always forgetand that irritates me when it's missing.)

Once you have CGI programs running through your web server, you might rationally ask why allowing them to writeinto the web server's document area adds any extra danger: after all, ifa CGI program is compromised, the attacker gets to run all the code theywant anyways.

Well, in theory. The flaw in this theory is that there are differentkinds of vulnerabilities.

In practice it turns out that 'file dropper' vulnerabilities, wherea CGI program (especially PHP programs) can be tricked into writing

I have to admit that there actually is a reason to break the goodpractice for webserver file ownership :the 404 handler trick for lightweight caching of semi-dynamic websites.

The 404 handler trick comes from three observations:

• most dynamic websites are in practice not very dynamic; the actualpages served change rarely.
• Apache (and other web servers) are many times faster at servingstatic content than dynamic content.
• Apache (and etc) can let you take arbitrary actions on 'page missing'errors.