Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developers fix multitude of vulnerabilities in Apache HTTP Server

portswigger.net

Post reply on HN
Print view View original

101–110 of 115 posts

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#101

Post by arp242 »

eric_h wrote: post #62
throw_m239339 wrote: post #43

Earlier quoted context omitted.

> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities. At the expense of the memory footprint because developed with Go. Hi Caddy creator!

> At the expense of the memory footprint because developed with Go. Hi Caddy creator! Makes sense to me that something built in a language with more memory safety than C would use more memory, but is it really significant in practice? I use go every day and memory usage has not been a significant issue for many applications.

I don't use Caddy, but I've written plenty of Go apps (which usually implement their own HTTP server with net/http) with plenty of users, and memory usage has never been much of a concern.

There are other performance concerns of course, e.g. GC latencies, and at times the GC may bite you. See e.g. the "taming Go memory usage" story from a few days ago[1], but this usually isn't a huge concern for many use cases.

[1]: https://news.ycombinator.com/item?id=28608083

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#102

Post by hulitu »

lucb1e wrote: post #76
edoceo wrote: post #2

Full vulnerability list: https://httpd.apache.org/security/vulnerabilities_24.html

What I find interesting is that when browsing lists like these, more and more often I see names that are not from Europe or a rich English-speaking country. Nice to see previously-poorer countries getting online, the internet a bit more diverse, and the world a bit more connected. Though of course this is only empirical, perhaps it has always been this way and I just never noticed.

It has always been this way. It's just that in the latest years the internet became more localized due to everyone wanting to take control of it. It is just sad.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#103

Post by rfmoz »

0x000000001 wrote: post #7
kimi wrote: post #4

Anybody still using Apache?

Considering that it has a lot of features Nginx makes you pay for, yes

Stock Apache from distros compared with Nginx, is like MSWord vs Notepad.

An Apache compiled with the exact options that you'll need shines, like an Nginx well done.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#104

Post by SahAssar »

0des wrote: post #95
SahAssar wrote: post #58

Earlier quoted context omitted.

I'm guessing you mean the about section of your profile. I'm just saying that it's nice to make that more visible when you have that sort of involvement in the topic and it is not obvious.

Why? I prefer when people don't flash their badge at me to support their statements. Words should stand on their own without appeals to authority.

It's more the other way around, when saying things about your own product it's nice to disclose your involvement since that definitely colors your view. Especially in cases like this where it's hyping the product.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#105

Post by Thorrez »

FreezingKeeper wrote: post #39
DonHopkins wrote: post #28

It's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten year…

Every day someone is born who has never seen The Flintstones

Is this a reference to something I'm not understanding? I don't know how the Flintstones are related to Apache.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#106

Post by Symbiote »

kimi wrote: post #4

Anybody still using Apache?

I use it. We probably have 50+ websites hosted on Apache HTTPD.

It's very stable, supports that one special thing many sites need (special headers, stripping file extensions, caching etc) and has excellent documentation.

It's not fashionable, but it will still be unfashionable in another 10 years, and we won't have needed to update the configurations in that time.

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#108

Post by egberts1 »

atatatat wrote: post #87
TekMol wrote: post #3

On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?

The long(er) patch cycle is why I switched away from Debian. Decent privacy, questionable security vs stability if you're serious about it.

have you tried adding security.debian.com to your APT sources?

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#109

Post by [deleted] »

FreezingKeeper wrote: post #39
DonHopkins wrote: post #28

It's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten year…

Every day someone is born who has never seen The Flintstones

[deleted]

Re: Developers fix multitude of vulnerabilities in Apache HTTP Server

#110

Post by benreesman »

junon wrote: post #51
sam_lowry_ wrote: post #38

Earlier quoted context omitted.

Those who can't program, go to security research.

Do you know what security research entails?

I’m replying to you because the parent is flagged.

I’m not a security guy, but I am a serious generalist and I’ll try my hand at anything.

Except security.

As finely as I try to hone my craft, as much discipline as I bring to it, and as many great results as I’ve produced: computer security is a completely different ballgame.

The guys and gals who are as sophisticated, and diligent, and dedicated, and ultimately humble enough to be serious security pros are a breed apart, and my hat is off to them.

Post reply on HN