From: Martin Langhoff Date: Fri, 17 Apr 2009 18:48:13 GMT Subject: Re: git for local web development Message-ID: <46a038f90904171148xefb2085yc47e58c62cd3bbaf@mail.gmail.com> In-Reply-To: <20090417183046.GB30240@coredump.intra.peff.net> On Fri, Apr 17, 2009 at 8:30 PM, Jeff King wrote: > repo and working tree are not owned by "william"? As long as www-data, > presumably the webserver could still serve it. Also, as long as they are owned by www-data, the setup is more vulnerable to security problems. Files served by Apache (or any other webserver) should _not_ be owned by the same user that the webserver runs under. The www-data ownership is exclusively for files that you expect the webserver to be able to _modify_: files uploaded by users, session data files, sqlite databases and such. You don't really want your webserver changing executable files such as PHP. It is a valid thing to create a user to own those files, and in servers where a team was maintaining the code, we have often used 'www-code'. cheers, m -- martin.langhoff@gmail.com martin@laptop.org -- School Server Architect - ask interesting questions - don't get distracted with shiny stuff - working code first - http://wiki.laptop.org/go/User:Martinlanghoff