Live data from Hacker News

Apache HTTP Server 2.4.58 (CVE fixes)

downloads.apache.org

21–30 of 47 posts

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#21

Earlier quoted context omitted.

I'm surprised you're surprised. It's a good web server.

I'm surprised HN hasn't added a feature where if you start a comment with "I'm surprised" it asks you to tick a box to confirm that you're really sure you're contributing to the discussion.

I am strongly in favor of this. I would also like HN to implement a warning that your comment may be extremely uninteresting if it starts out with, "Unfortunately..." or, "Can we all just agree that..."

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#24

Is HTTP/2 just too complex for a mere mortal to implement?

No, but QUIC definitely falls in the overly complicated category, spanning multiple, large RFCs.

This attack is just about failing to enforce the negotiated parameters during the start phase of the connection.

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#25
post #21

Earlier quoted context omitted.

I'm surprised HN hasn't added a feature where if you start a comment with "I'm surprised" it asks you to tick a box to confirm that you're really sure you're contributing to the discussion.

I am strongly in favor of this. I would also like HN to implement a warning that your comment may be extremely uninteresting if it starts out with, "Unfortunately..." or, "Can we all just agree that..."

Also some of the snide comments beginning with “lol” and “I didn’t ask you”.

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#26
post #13

I'm surprised people still actively use it and it seems on par with nginx, at least according to https://www.netcraft.com/blog/january-2023-web-server-survey...

Why surprised? It's rock solid, stable, fast, and does pretty much everything you need, and nothing is hidden behind premium tiers, unlike nginx where they leave bugs and awful behaviour in the open source version that aren't in the premium ones (e.g. nginx used to only resolve hostname entries on start-up, https://forum.nginx.org/read.php?2,215830,215832#msg-215832 , so if you used a hostname in proxy_pass, and the…

I love apache as much as anyone, cut my teeth with it and still work with it plenty.

It doesn’t strike me as odd to question its fit for people who have more experience with containers. If there’s a reverse proxy in the front, one may just need business logic in the back.

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#27
post #13

Earlier quoted context omitted.

Why surprised? It's rock solid, stable, fast, and does pretty much everything you need, and nothing is hidden behind premium tiers, unlike nginx where they leave bugs and awful behaviour in the open source version that aren't in the premium ones (e.g. nginx used to only resolve hostname entries on start-up, https://forum.nginx.org/read.php?2,215830,215832#msg-215832 , so if you used a hostname in proxy_pass, and the…

I love apache as much as anyone, cut my teeth with it and still work with it plenty. It doesn’t strike me as odd to question its fit for people who have more experience with containers. If there’s a reverse proxy in the front, one may just need business logic in the back.

>If there’s a reverse proxy in the front, one may just need business logic in the back.

I'm trying to imagine what that haircut would look like

Re: Apache HTTP Server 2.4.58 (CVE fixes)

#30
post #13

Earlier quoted context omitted.

Why surprised? It's rock solid, stable, fast, and does pretty much everything you need, and nothing is hidden behind premium tiers, unlike nginx where they leave bugs and awful behaviour in the open source version that aren't in the premium ones (e.g. nginx used to only resolve hostname entries on start-up, https://forum.nginx.org/read.php?2,215830,215832#msg-215832 , so if you used a hostname in proxy_pass, and the…

I love apache as much as anyone, cut my teeth with it and still work with it plenty. It doesn’t strike me as odd to question its fit for people who have more experience with containers. If there’s a reverse proxy in the front, one may just need business logic in the back.

I am actively trying to remove apache from a large chunk of projects mainly because at this point it is being used as a poor reverse proxy and not a web server which is its core competency.
Post reply on HN