Sure, you could set it up in the <Directory> section, if you felt like it. It would improve performance, but you might not notice it unless your webserver came under heavy load.
Of course, Serendipity doesn't usually have access to the main server configuration file, and therefore it's written to modify the .htaccess when mod_rewrite is enabled. To get the performance increase, you'd have to disable (I believe) AllowOptions, then duplicate all the Serendipity .htaccess functionality in your main server config file.
As the sysop of a server where multiple users all want to write their own redirection rules and options, that could get pretty tedious. So most providers allow the users to acess the .htaccess.
This *is* a security risk, as mentioned in the document you referenced. Stupid users might forget to forbid outside access to their .htaccess, allowing a hacker to completely hijack their site simply by uploading a new .htaccess. Even if the hacker can only read the file, he gets valuable information that could help him plan a second attack.
WordPress does require .htaccess files, just like Serendipity. You could do the configuration in the main server config, but an Apache forum might be more helpful than the Serendipity-specific info you'd get here.
You also don't need an .htaccess in every directory. There should be one .htaccess in the Serendipity directory, which Serendipity will maintain on its own. Then you only need additional .htaccess files in the subdirectories of the Serendipity directory that you wish to be directly accessible to the outside world. For instance, if your website file system looks like this:
Code: Select all
/
/business
/gallery
/serendipity
/serendipity/custom_static
/the_old_site
In this case, Serendipity will only create an .htaccess in the /serendipity directory, and it will not affect access to the /business, /gallery, or /the_old_site directories. If you want someone to be able to reach a URL like
http://serendipity/custom_static/index.html, you will need to add an .htacess to it. But you won't have to add .htaccess file to the other directories.
Finally, the performance hit isn't great enough to prevent major providers from using .htacess files, so unless you're planning on getting hit like Google, you probably don't need to worry about it. (Of course, this is advice from a Serendipity tech; you might want to verify on an Apache forum.)
