Hacker News Reader

How utterly stupid do you have to be to engineer software that requires you to have configuration files in a publicly accessible folder? Even most shared hosts now will have a public_html folder and the ability to put sensitive stuff not inside it.

Complete untrue. You can (and are advised to) move your wp-config.php above public_html. The reason its not done by default is because you just can't do this on many of the crappy hosting services, and it creates a barrier for entry for people making their first-ever site.

Except you can on 99% of crappy hosts. I remember even Tripod allowed you to put things outside of public_html.

But things inside public_html can't read files outside of it. I believe cPanel is configured this way be default.

    The best way to do configuration is to have it in
    environment variables

Isn't it the only sensible way, actually?

Django doesn't expose static files the same way, so you still get away with a secret.txt stored as a file.

Because your average graphics designer or blogger has no idea what Apache is, what public directories or file permissions are. They just want to run their own blog. That's why Wordpress (or PHP for that matter) is successful; it's easy to set up and get started.

In that case why not just host it at wordpress.com where it's managed by people who are (presumably) more experienced?

There could be many reasons, not the least of which is that the hosting provider would be providing the installation and updates for the user.

So, they are paying for it by people who are presumably more experienced.

Edit: Just to be clear, I'm not excusing any of the mistakes. Just pointing out how normal people could get screwed over, even if they are using a "professional service" and paying for it.

You are correct, you could do almost exactly the same thing in "the whole shitty PHP way of doing things" using FPM pools.

Excellent! Part of me wants to have a play and see how closely I can get a PHP/FPM/nginx to resemble my Python/uWSGI Emperor/nginx stack.

You can do stuff like include /srv/*/pool.ini, right?

Yes you can. Dotdeb's php-fpm.ini even includes this line by default:

    ; To configure the pools it is recommended to have one .conf file per
    ; pool in the following directory:
    include=/etc/php5/fpm/pool.d/*.conf

Then you could configure ENV inside FPM pool using the env directive:

    env[DB_HOST] = localhost
    env[DB_USER] = foobar
    env[DB_PASSWORD] = foobar

...and use something like this in e.g. Wordpress config:

    define('DB_NAME', getenv('DB_NAME'));
    define('DB_USER', getenv('DB_USER'));
    define('DB_PASSWORD', getenv('DB_PASSWORD'));

The biggest caveat is you MUST disable phpinfo()

    php_value[disable_functions] = phpinfo

Otherwise these ENV will shown up in any page that calls phpinfo();

That's pretty handy. Didn't think about the phpinfo thing, actually, though in all fairness if they managed to upload any PHP files you're rather screwed. I think the way to be secure would be to not actually serve PHP files in the document root and instead have nginx proxy / directly to the FPM pool, and just alias your static files over, much as one would with Django.

If you wanna see php done right, forget about all the crap you have seen and take a look at symfony.com. It has great docs, that focus on teaching web development (not just a framework) and all these sysadmin best practices like how to set the permissions, etc. Trust me, I have used every popular framework (including Rails and Django), and Symfony2 has nothing to envy.

uWSGI is capable of serving PHP, mind.