Anybody still using Apache?
>Anybody still using Apache?
A similar number of folks as are using nginx[0]
Developers fix multitude of vulnerabilities in Apache HTTP Server
61–70 of 115 posts
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#62Earlier quoted context omitted.
Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities. At the expense of the memory footprint because developed with Go. Hi Caddy creator!
> At the expense of the memory footprint because developed with Go. Hi Caddy creator!
Makes sense to me that something built in a language with more memory safety than C would use more memory, but is it really significant in practice? I use go every day and memory usage has not been a significant issue for many applications.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#63It turns out that "multitude", in this case, is 5. (Still glad they got patched, of course)
Hrair
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#64Earlier quoted context omitted.
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…
To be fair, the event worker in Apache and nginx are roughly the same age, 2004. Smaller web servers have been event based since they first showed up, it is the natural way to build them. There was no epoll() available, but a select() loop is pretty much the same thing. The super useful thttpd had been around a long time at that time. What caused people to start using non-forking web servers for regular public web ap…
Nginx configs do look more readable, but they have a lot of gotchas themselves. Quite surprising actually.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#65Anybody still using Apache?
Lots of companies that have been around a while and haven't replaced legacy applications still run those behind the web server they were designed to run behind. Moving to another server seems simple until you actually try to do that with a handful of 15-year-old sites with proxy rules, rewrites, custom headers, and such in one server's central config file and a bunch of per-directory access files. Technical debt is a…
That's not debt. Those are working configurations on a fully supported web server with active development. There is zero reason to change them.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#66Earlier quoted context omitted.
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…
Caddy also does the whole Let’s Encrypt thing for you for SSL
There's a plugin for nginx that works well:
$ apt-get install python3-certbot-nginx
$ sudo certbot --nginx -d example.com -d www.example.com
https://www.nginx.com/blog/using-free-ssltls-certificates-fr...
On the other hand, caddy seems to auto renew them as well - one less cron job:
> Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed.
https://caddyserver.com/docs/automatic-https
Neat, but still not sold.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#67Earlier quoted context omitted.
> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities. At the expense of the memory footprint because developed with Go. Hi Caddy creator!
> At the expense of the memory footprint because developed with Go. Hi Caddy creator! Makes sense to me that something built in a language with more memory safety than C would use more memory, but is it really significant in practice? I use go every day and memory usage has not been a significant issue for many applications.
[deleted]
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#68Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#69Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#70Earlier quoted context omitted.
Lots of companies that have been around a while and haven't replaced legacy applications still run those behind the web server they were designed to run behind. Moving to another server seems simple until you actually try to do that with a handful of 15-year-old sites with proxy rules, rewrites, custom headers, and such in one server's central config file and a bunch of per-directory access files. Technical debt is a…
That's not debt. Those are working configurations on a fully supported web server with active development. There is zero reason to change them.
This. There's nothing wrong with using mature technology that is still being developed. LAMP is still a perfectly fine choice if it's what you want to use.