Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

81–90 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#81

Post by MZMegaZone »

nmjohn wrote: post #70
MZMegaZone wrote: post #65

Earlier quoted context omitted.

We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.

Why did he not want CVE's assigned?

I think you'd have to ask Maxim. My take is he felt experimental features should not get CVEs, which isn't how the program works. But that's just my take - I'm the primary representative for F5 to the CVE program and on the F5 SIRT, we handle our vuln disclosures.

Re: Freenginx: Core Nginx developer announces fork

#82

Post by Thaxll »

687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

For the vast majority of use cases nginx from 10 years ago would not make a difference. You actually see the nginx version on some html pages and very often it's old.

Re: Freenginx: Core Nginx developer announces fork

#83

Post by tky »

MZMegaZone wrote: post #65
arter4 wrote: post #43

I admit I haven't followed closely this issue, but what is he talking about? >In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.

We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.

This seems like a much larger story than the fork, given the install base of nginx.

For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?

Re: Freenginx: Core Nginx developer announces fork

#84

Post by dingnuts »

bklyn11201 wrote: post #40
reactordev wrote: post #25

Earlier quoted context omitted.

HAProxy is an enterprise load balancer that's available through Red Hat or other OSS Vendor. Nginx is just so easy to configure...

HAProxy is a wonderful load balancer that doesn't serve static files thus forcing many of us to learn Nginx to fill the static-file-serving scenarios. Caddy seems like a wonderful alternative that does load balancing and static file serving but has wild config file formats for people coming from Apache/Nginx-land.

I keep a Caddy server around and the config format is actually much, much nicer than nginx's in my experience. The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them.

This works for me because I already knew a fair bit about nginx configuration before picking up Caddy but it really kills me to see just how many projects don't even bother to explain the nginx config they provide.

An example of this is Mattermost, which requires WebSockets and a few other config tweaks when running behind a reverse proxy. How does Mattermost document this? With an example nginx config! Want to use a different reverse proxy? Well, I hope you know how to read nginx configuration because there's no English description of what the example configuration does.

Mastodon is another project that has committed this sin. I'm sure the list is never-ending.

Re: Freenginx: Core Nginx developer announces fork

#85

Post by Dylan16807 »

hadlock wrote: post #79
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

This is your semi-annual reminder to fork and archive offline copies of everything you use in your stack.

There's plenty of copies of the code. That doesn't help with the actual problems with the setup.

Re: Freenginx: Core Nginx developer announces fork

#88

Post by eddieroger »

JackSlateur wrote: post #39
karolist wrote: post #26

Earlier quoted context omitted.

The world has moved on in the sense that "good enough" and cloud eats into their balance sheets I'm sure, but there's loads and loads of banks and legacy enterprises that maintain their ivory tower data centers and there's nothing to replace these with AFAIK. Google has Maglev, AWS perhaps something similar, MS no idea, everyone else just buys F5 or doesn't need it.

Lots of people are using haproxy

My org moved off nginx for haproxy after we learned that (at the time, maybe it changed) reloading an nginx config, even if done gracefully through kernel signals, would drop existing connections, where haproxy could handle it gracefully. That was a fun week of diving in to some C code looking for why it was behaving that way.

Re: Freenginx: Core Nginx developer announces fork

#89

Post by MZMegaZone »

tptacek wrote: post #87
MZMegaZone wrote: post #66

Earlier quoted context omitted.

Yep. Maxim did not want CVEs assigned.

MegaZone as in Usenet MegaZone?

No, a MegaZone. Haven't you heard, we come in six packs now. ;-)

Yeah, very, very likely one and the same. Since 1989.

Post reply on HN