From: jslee <openbsd.lists@internetemails.net>
Subject: Re: httpd(8) log files are world and daemon-readable
To: "Piotr Durlej" <pdurlej@inetbox.org>
Cc: tech@openbsd.org
Date: Thu, 27 Aug 2026 19:19:52 +1000

On Thu, 27 Aug 2026, at 05:09, Piotr Durlej wrote:
> currently the httpd(8) log files are world and daemon-readable and 
> probably they shouldn't.

What specific risk are you trying to mitigate here?

If it’s “there might be sensitive stuff in request URLs”, I suggest to you that you are focusing on the wrong problem here. Such things do not belong in URLs.

If it’s not that, perhaps you could explain your reasons?

John