On Thu, 27 Aug 2026, at 05:09, Piotr Durlej wrote:
> currently the httpd(8) log files are world and daemon-readable and 
> probably they shouldn't.

What specific risk are you trying to mitigate here?

If it’s “there might be sensitive stuff in request URLs”, I suggest to you that you are focusing on the wrong problem here. Such things do not belong in URLs.

If it’s not that, perhaps you could explain your reasons?

John