[Zope3-dev] Re: [Zope-dev] Medusa 0.5.1 maint release, planned for inclusion in Zope?

[Shane Hathaway]

Seb wrote:
> Le Sat, Mar 30, 2002 at 10:50:23AM -0600, Stephan Richter a =E9crit :
>=20
>>>Does Zope 3 use Medusa at all?
>>>
>>No. Shane rewrote all of the HTTP Server and I am writing right now the=
 FTP=20
>>server (which copies some of the Medusa code, but much is cleaned). We=20
>>added interfaces and made it more component-based.
>>
>=20
> Is direct external HTTP support planned in Zope3  (like Apache or Caudi=
um) ?

I would say so.  There are a couple of reasons Zope 2's ZServer isn't=20
always recommended for high traffic, public sites:

- It's complicated code, so it's hard to tell what ZServer will do given=20
bad data.  It won't give an attacker access to the filesystem or root=20
privileges, but it might eat up RAM or stop the server.  Apache tends to=20
filter out most bad requests.

- It has no virtual hosting capabilities.

But now we have a better opportunity to handle bad requests and add=20
virtual hosting when it's needed.

Shane