calum / calum.github.io Goto Github PK

This is a misleading statement:

1. Handling encryption at the app leve does not exclude a tcp proxy like Nginx itself: https://www.nginx.com/resources/admin-guide/tcp-load-balancing/ thus not requiring the application handling SSL to be on a privileged port or exposed to non-localhost at all.
2. Binding to port 80 or 443 requires an application to start with elevated privileges but nothing prevents the application from dropping them as soon as the port is bound thus not operating as root. As well as nice tools that help you to never need root privileges in the 1st place.