31–40 of 115 posts
On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
>All five flaws are resolved with HTTP Server 2.4.49. The WSL version of Ubuntu is reporting 2.4.41 for me still. I don't know about the real version.
Anybody still using Apache?
Unlike nginx or Caddy^H^H^H^H^H, the Apache design and community encouraged writing modules (roughly akin to "middleware" in the modern server-side web stack) that hooked directly into the web server, rather than just using it as a static host + L7 proxy.
Furthermore, these modules could themselves expose language-specific APIs; ergo `mod_perl` and its ilk, which provide a bunch of useful building blocks for a full-stack webapp but are entirely specific to Apache's module API (vs. something more standard like FCGI, WSGI, etc.)
I've worked at some shops with heavy investments in Apache-based application servers and the cost of moving away from HTTPD modules and towards a more standalone, Apache-free implementation was generally quite high. Usually you need some other forcing function (rewrite in a new language, microservice decomposition, etc.) to justify the investment.
Earlier quoted context omitted.
What's wrong with Apache? (honest question)
I was looking for a pre-hardened httpd just for serving static html files, is there one?
Edit: specific to your request, I would probably set up a container pointing to the latest apache build, and write a script to pull the latest image then roll over the container... Don't need to wait for your OS of choice to have the fixed versions... Your never more than a day behind
On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
https://security-tracker.debian.org/tracker/status/release/s... is one place to look through in the past I think there was a better link I used to use to find all vulnerable packages which were awaiting a fix - but I can’t seem to find it now.
Earlier quoted context omitted.
What's wrong with Apache? (honest question)
I was looking for a pre-hardened httpd just for serving static html files, is there one?
darkhttpd is an option
This was an interesting security patch that marked the first time in my memory that updating Apache led to an immediate regression. A few hours after taking this upgrade many systems experienced such strange timeout errors. Connections were low and couldn't pinpoint the misleading behavior that looked like a slowloris attack, with no connections. Half a day later with no resolution in research a new patch [1] was ava…
It's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten year…
It's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten year…
Every day someone is born who has never seen The Flintstones