Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

111–120 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#111

Post by MZMegaZone »

tky wrote: post #83
MZMegaZone wrote: post #65

Earlier quoted context omitted.

We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.

This seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?

Yes, those are the two CVEs I was referring to. All I know is he objected to our decision to assign CVEs, was not happy that we did, and the timing does not appear coincidental.

Re: Freenginx: Core Nginx developer announces fork

#112

Post by the_duke »

ironmagma wrote: post #77
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

Nginx is still evolving a lot though.

Eg: http3 support was stabilized with 1.25.1 , which came out June 2023.

Re: Freenginx: Core Nginx developer announces fork

#113

Post by ironmagma »

szundi wrote: post #104
ironmagma wrote: post #77

Earlier quoted context omitted.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

Not the web though

Certainly the web can mostly coast indefinitely. There are webpages from decades ago that still function fine, even that use JavaScript. The web is an incredibly stable platform all things considered. In contrast, it's hard to get a program that links to a version of Zlib from 10 years ago running on a modern Linux box.

Re: Freenginx: Core Nginx developer announces fork

#114

Post by jackcviers3 »

687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

It's not that scary. If a project everyone depends on is broken and unmaintained, someone else will manufacture a replacement fairly quickly and people will vote with their feet.

NGINX is the de facto standard today, but I can remember running servers off apache when I began professionally programming. I remember writing basic cross-broweser spas with script.aculous, and prototypejs in 2005, before bundlers and react and node.

Everything gets gradually replaced, eventually.

Re: Freenginx: Core Nginx developer announces fork

#116

Post by colechristensen »

szundi wrote: post #104
ironmagma wrote: post #77

Earlier quoted context omitted.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

Not the web though

HTTP 1.1 isn’t really changing is it?

That and a small collection of other things are standards based and not going though changes.

Re: Freenginx: Core Nginx developer announces fork

#117

Post by salmo »

kevin_nisbet wrote: post #98
salmo wrote: post #69

Earlier quoted context omitted.

I dunno about rock solid. I’ve had plenty of issues forcing a failover/reboot, multiple complicated tickets open a year, etc. But we have a sh ton of them. To be fair, some are kernel bugs with connection table leaks, SNAT + UDP, etc. Buuuut, they have by far the best support. They’re as responsive as Cisco, but every product isn’t a completely different thing, team, etc. And they work really well in a big company us…

I'm very out of date so take my opinion with a grain of salt. The customer support I received from F5 when they acquired a telco product was about the worst support I've ever seen. Now this wasn't the general LB equipment that F5 has the reputation around, it's some specific equipment for LTE networks. We'd get completely bogus explanations for bugs, escalate up the chain to VPs and leadership because there was an ob…

I completely get this. I feel like every product I’ve had outside of a vendor’s wheelhouse has gone that way. We just use the BigIP gear from F5 and they’re better than the load balancers we used in the past. Thank god Cisco just abandoned that business.

I can’t imagine them supporting telco gear. The IPv6 thing has me LOLing because I just had a similar experience with a vendor where we don’t route IPv6 in that segment and even if we did, it shouldn’t break. Similarly, a vendor in a space they don’t belong that I imagine we bought because of a golf game.

A thing I dread is a product we’ve adopted being acquired… and worse, being acquired by someone extending their brand into a new area. It’s also why we often choose a big brand over a superior product. It’s not the issue of today, but when they get bought and by who. I hate that so much and not my decision, but it’s a reality.

It’s also a terrible sign if you’re dealing with a real bug and you’re stuck with a sales engineer and can’t get a product engineer directly involved.

I have a list of “thou shalt not” companies as well, and some may be similar where a few bad experiences ruined the brand for me. Some we’re still stuck with and I maaaay be looking for ways to kill that.

Re: Freenginx: Core Nginx developer announces fork

#118

Post by EasyMark »

687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

I don't worry when it's open source, as if it's that valuable someone will pick it up, or corps would be forced to. I do wish those 1 or 2 devs got more support monetarily from the huge corps benefitting.

Re: Freenginx: Core Nginx developer announces fork

#119

Post by quickthrower2 »

ironmagma wrote: post #113
szundi wrote: post #104

Earlier quoted context omitted.

Not the web though

Certainly the web can mostly coast indefinitely. There are webpages from decades ago that still function fine, even that use JavaScript. The web is an incredibly stable platform all things considered. In contrast, it's hard to get a program that links to a version of Zlib from 10 years ago running on a modern Linux box.

The web is the calm looking duck that is paddling frantically. You want to be using SSL from the 90s, or IE vs. Netscape as your choice etc. Nostalgia aside!

Re: Freenginx: Core Nginx developer announces fork

#120

Post by bklyn11201 »

pests wrote: post #101
bklyn11201 wrote: post #94

Earlier quoted context omitted.

I assume USA companies are by far the highest revenue source for Nginx Plus. Both of these forks seem to be based in Russia. How is a USA company supposed to pay either of these vendors for their consulting or Pro versions? How long until F5 submits requests for domain ownership of freenginx.org, and how quickly does Angie get takedown requests for their features that look remarkably similar to Nginx Plus features (e…

> features that look remarkably similar to Nginx Plus features (e.g., the console) Its illegal for products in the same space to have similar features?

Please compare the two and let us know if you think "similar" is the right word.
Post reply on HN