Anybody still using Apache?
What's wrong with Apache? (honest question)
Developers fix multitude of vulnerabilities in Apache HTTP Server
11–20 of 115 posts
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#12Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
> In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are hacked type of situations.
Not sure about that... You might commit some of the same mistakes that they did
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#13Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
That's an interesting point. I would love to see someone testing this assumption.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#14Anybody still using Apache?
Lots of companies that have been around a while and haven't replaced legacy applications still run those behind the web server they were designed to run behind. Moving to another server seems simple until you actually try to do that with a handful of 15-year-old sites with proxy rules, rewrites, custom headers, and such in one server's central config file and a bunch of per-directory access files. Technical debt is a real thing.
Shared hosting is still huge for small sites, and the major control panels for that (cPanel, Plesk, DirectAdmin, vDeck) still support Apache as the primary web server.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#15On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
Debian back-ports patches. I guess they'll need some time although they are usually informed in advance
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#16Full vulnerability list: https://httpd.apache.org/security/vulnerabilities_24.html
[deleted]
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#17Anybody still using Apache?
What's wrong with Apache? (honest question)
Nothing really. Historically Apache HTTPD was slower than the newer web servers like NGinx when Apache HTTPD 2.2 was the mainline version. This is no longer the case with Apache 2.4 using the latest APR libraries. 2.4 has been out for a very long time, but some Linux distros were slow to uptake it.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#18Anybody still using Apache?
What's wrong with Apache? (honest question)
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share.
A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine for most applications.
There are other reasons to use nginx, and there are other reasons to use Apache. Both are fine, and I hear https://caddyserver.com/ is coming in hot!
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#19Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
> In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are hacked type of situations. Not sure about that... You might commit some of the same mistakes that they did
Exactly what I was thinking. You’re more likely just to have a wide open and highly/easily penetrable/vulnerable server up for grabs at that point.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#20Sometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
Security through obscurity is great for preventing low-effort attacks at low-scale, yes.
The market for security skills tends to be more interested in protecting targets that can draw high-effort attacks, or low-effort attacks at scale, so there's good reason for the "security through obscurity = bad" meme. You won't get in trouble by incorrectly assuming "security through obscurity = bad," but you can definitely get in trouble by incorrectly generalizing "security through obscurity = good enough." It makes sense to err in the direction of least damage.