8.1 User directories: pro and con

You've probably seen URLs that bring you to personal Web directories. The http://host.domain.tld/~username/ syntax brings you to Web space in a nonprivileged user's personal account. User Web directories are often called userdirs.

Is this a good idea? It depends. In an educational or hobbyist environment, it's likely to be a very good idea. Users can develop their own Web content, take responsibility for it, organize their directories to suit themselves, update whenever they feel like it, and never have to hassle the system manager. Instructors can put assignments or syllabi on their personal Web sites, researchers display digital offprints of papers, and so on. The system manager can plausibly claim that he or she never checks anybody's content, and avoid uncomfortable issues of censorship, quality standards, browser compatibility, and so on. If your institution is teaching a class in Web development, this approach can solve a lot of problems.

In a commercial environment, it's probably a bad idea. If the Web site is your company's Internet storefront, it looks unprofessional to have people putting up digitized pictures from their wedding and your company probably has a written acceptable-use policy that you'll be responsible for enforcing, or at least required not to subvert. The userdir approach may be useful for providing test Web sites for your authorized Web developers, but you're mostly better off avoiding it.

There are a few additional security risks in user Web directories. (If you've decided to conceal the operating system and...