I noticed that when installing cgiemail it is set as owned by root, same as other scripts simultaneously installed in /usr/lib/cgi-bin I figure this is right, I would be surprised if i were the first finding a bug, but I don't see why it makes it safer than installing it as owned by www-data:www-data. Can anyone answer this? Are all the scripts here supposed to belong to root?