Live data from Hacker News

Developers fix multitude of vulnerabilities in Apache HTTP Server

portswigger.net

91–100 of 115 posts

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#91
post #57

Earlier quoted context omitted.

About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine fo…

To be fair, the event worker in Apache and nginx are roughly the same age, 2004. Smaller web servers have been event based since they first showed up, it is the natural way to build them. There was no epoll() available, but a select() loop is pretty much the same thing. The super useful thttpd had been around a long time at that time. What caused people to start using non-forking web servers for regular public web ap…

I agree wholeheartedly that php-fpm rapidly speed up nginx adoption.

Before nginx, lighttpd was a thing. It also comes with `spawn-fcgi` to handle fastcgi, but it's a little complex to set up. Back then people were also using `spawn-fcgi` with nginx, too. I remembered reading some tutorial and decided that I will continue to use Apache with mod_php due to complexity. When php-fpm come, I immediately switched.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#92
post #47

It turns out that "multitude", in this case, is 5. (Still glad they got patched, of course)

Multitude: a very great number 5 is a very good number but I don’t know if I’d go so far as to call it “great”.

Not great, not terrible..

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#93

Earlier quoted context omitted.

Caddy also does the whole Let’s Encrypt thing for you for SSL

There's a plugin for nginx that works well: $ apt-get install python3-certbot-nginx $ sudo certbot --nginx -d example.com -d www.example.com https://www.nginx.com/blog/using-free-ssltls-certificates-fr... On the other hand, caddy seems to auto renew them as well - one less cron job: > Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed. https://caddyserver.com/docs/automatic-https Ne…

What are you not sold on?

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#94
post #30

Earlier quoted context omitted.

Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.

> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities. At the expense of the memory footprint because developed with Go. Hi Caddy creator!

We're talking about shaving megs here rofl

cmon now

terminal systems engineer brain is everywhere

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#95
post #50

Earlier quoted context omitted.

> I'm the author of the Caddy web server.

I'm guessing you mean the about section of your profile. I'm just saying that it's nice to make that more visible when you have that sort of involvement in the topic and it is not obvious.

Why? I prefer when people don't flash their badge at me to support their statements. Words should stand on their own without appeals to authority.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#97
post #3

On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?

The long(er) patch cycle is why I switched away from Debian. Decent privacy, questionable security vs stability if you're serious about it.

What did you switch to?

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#99
post #60
post #14

Earlier quoted context omitted.

Lots of companies that have been around a while and haven't replaced legacy applications still run those behind the web server they were designed to run behind. Moving to another server seems simple until you actually try to do that with a handful of 15-year-old sites with proxy rules, rewrites, custom headers, and such in one server's central config file and a bunch of per-directory access files. Technical debt is a…

And Apache supports .htaccess files which are great for hosting (nginx doesn't, afaik).

Not by default, but since nginx is pretty flexible you can implement support for it, and it seems like people have.

There are some downsides with .htaccess files though; since it can change you need to at least check if it was modified since the last request, and since it's recursive (i.e. /foo/.htaccess applies to /foo/bar/file.txt) you may need to check several locations. Basically, it's a lot of stat() calls for every request.

The upside is that it's convenient; i.e. "tar xf somephpapp.tar.gz" and it "just works" without mucking about with configuration to disallow certain files, but this convenience comes with a fairly hefty performance impact, and it's only certain types of PHP apps that really take advantage of this.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#100

Earlier quoted context omitted.

Caddy also does the whole Let’s Encrypt thing for you for SSL

There's a plugin for nginx that works well: $ apt-get install python3-certbot-nginx $ sudo certbot --nginx -d example.com -d www.example.com https://www.nginx.com/blog/using-free-ssltls-certificates-fr... On the other hand, caddy seems to auto renew them as well - one less cron job: > Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed. https://caddyserver.com/docs/automatic-https Ne…

I never cared much for certbot because "sudo certbot" and it works by rewriting config files. I don't really fancy running it as root (which can probably be avoided with some muckery, but still) or a program automatically rewriting my configs.

Overall, the entire thing seems very complex automagic black box last time I tried it (already years ago). Sometimes trying to make something easier can make it harder.

Post reply on HN