Earlier quoted context omitted.
What's wrong with Apache? (honest question)
I was looking for a pre-hardened httpd just for serving static html files, is there one?
Maybe Gatling fits your needs
Developers fix multitude of vulnerabilities in Apache HTTP Server
41–50 of 115 posts
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#42On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
You can check the status of vulnerabilities like this with a quick Google of "Debian" plus the CVE. Example for this one is https://security-tracker.debian.org/tracker/CVE-2021-33193 . When a patch is released, the package may not say 2.4.49, but that page will have the exact version number with the fix.
This page confused me. It seems to have bugs for Android?
Example:
https://security-tracker.debian.org/tracker/CVE-2021-30521
"Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page."
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#43Earlier quoted context omitted.
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…
Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
At the expense of the memory footprint because developed with Go. Hi Caddy creator!
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#44Earlier quoted context omitted.
What's wrong with Apache? (honest question)
Nothing really. Historically Apache HTTPD was slower than the newer web servers like NGinx when Apache HTTPD 2.2 was the mainline version. This is no longer the case with Apache 2.4 using the latest APR libraries. 2.4 has been out for a very long time, but some Linux distros were slow to uptake it.
Just like some of them were slow to take on 2.2 over 2.0, and 2.0 over 1.2.
Web servers have historically been pretty conservative as far as software goes.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#45Earlier quoted context omitted.
What's wrong with Apache? (honest question)
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…
Caddy also does the whole Let’s Encrypt thing for you for SSL
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#46Earlier quoted context omitted.
You can check the status of vulnerabilities like this with a quick Google of "Debian" plus the CVE. Example for this one is https://security-tracker.debian.org/tracker/CVE-2021-33193 . When a patch is released, the package may not say 2.4.49, but that page will have the exact version number with the fix.
This page confused me. It seems to have bugs for Android ? Example: https://security-tracker.debian.org/tracker/CVE-2021-30521 "Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page."
While bugs like that aren't "confirmed" to affect desktop versions of software, the underlying bug is still in the Desktop codebase and needs to be treated as a security issue.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#47It turns out that "multitude", in this case, is 5. (Still glad they got patched, of course)
Multitude: a very great number
5 is a very good number but I don’t know if I’d go so far as to call it “great”.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#48Anybody still using Apache?
This reminds me of the classic "Anybody still using PHP" question.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#49Earlier quoted context omitted.
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…
Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
Might be nice to disclose your involvement when commenting on caddy-related threads.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#50Earlier quoted context omitted.
Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
Might be nice to disclose your involvement when commenting on caddy-related threads.
> I'm the author of the Caddy web server.