Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

121–130 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#121

Post by spydum »

xcrunner529 wrote: post #108
qwertox wrote: post #47

Time for me to slowly start looking for an alternative. There was a time when I wanted to move away from it and was eyeing HAProxy, but the lack of the ability to serve static files didn't convince me. Then there was Traefik, but I never looked too much into it, because Nginx is working just fine for me. My biggest hope was Cloudflare's Rust-based Pingora pre-announcement, which was then never published as Open Sourc…

I mean I’m not sure how it’s good to want to move to a dev who is against CVEs and disclosures…

I think people are seeing this as a very generic "big bad globocorp destroying OSS community", and not moving past the headlines. I'm with you, this seems like a foolish thing to decide to fork the project over. Probably there is other conflict brewing, and this was just a convenient opportunity.

Re: Freenginx: Core Nginx developer announces fork

#122

Post by mholt »

MZMegaZone wrote: post #106
tptacek wrote: post #92

Earlier quoted context omitted.

Wow, that's a throwback. I was an ISP person back in the Portmaster era. You're at F5 now, I guess! Can you say more about the CVE thing? That seems like the opposite of what Maxim Dounin was saying.

Yeah, I've been with F5 since 2010 - gotta love those old PortMasters though, Livingston was good times, until Lucent took over. I was there 95-98. I don't know what else there is to say really. The QUIC/HTTP/3 vuln was found in NGINX OSS, which is also the basis for the commercial NGINX+ product. We looked at the issue and decided that, by our disclosure policies, we needed to assign a CVE and make a disclosure. And…

> Honestly, anyone could have gone to a CNA and demanded a CVE and he would not have been able to stop it. That's how it works.

Even if third parties can file CVEs, do you think it hits different when the parent organization decides to do so against the developer's wishes? Why do he and F5 view the bugs differently? It sounds like the fork decision was motivated less by the actual CVEs and more about how the decision was negotiated (or not at all).

(PS. Thanks for participating in the discussion.)

Re: Freenginx: Core Nginx developer announces fork

#123

Post by EasyMark »

amne wrote: post #45
ComputerGuru wrote: post #35

This isn’t just “a core nginx dev” — this is Maxim Dounin! He is nginx. I would consider putting his name in the title. (And if I were F5, I’d have given him anything he asked for to not leave, including concessions on product vision.) That said, I’m not sure how much leg he has to stand on for using the word nginx itself in the new product’s name and domain…

He *is* nginx ? https://freenginx.org/hg/nginx I don't see it. Sure, he contributes. But in the last 3-4 years he definitely does not look like he is nginx based on that log. Or am I looking in the wrong place?

you should have googled his name, and you would have known within seconds. I mean it's everywhere nginx is mentioned (or dev of it)

Re: Freenginx: Core Nginx developer announces fork

#124

Post by bkallus »

downrightmike wrote: post #32
SteveNuts wrote: post #5

Earlier quoted context omitted.

The last two companies I've worked for have paid for Nginx+ since software LB is all we really need. Handling a few thousand RPS is nothing to nginx, and doesn't require fancy hardware. That said, it replaced Kemp load balancers, which it seems is the next biggest competitor in the hardware load balancer appliance space.

AVI if you're using VMware already

I'm pretty sure that AVI just wraps Nginx, even though they claim otherwise.

I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.

Re: Freenginx: Core Nginx developer announces fork

#125

Post by quickthrower2 »

jackcviers3 wrote: post #114
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

It's not that scary. If a project everyone depends on is broken and unmaintained, someone else will manufacture a replacement fairly quickly and people will vote with their feet. NGINX is the de facto standard today, but I can remember running servers off apache when I began professionally programming. I remember writing basic cross-broweser spas with script.aculous, and prototypejs in 2005, before bundlers and react…

You can also probably host without a reverse proxy. Also there are alternatives like Caddy. IIS!! And I imaging the big cloud would swoop in and help since their expensive CDNs and gateways will rely on it, or maybe Kubernetes maintainers, since most likely they use it.

Re: Freenginx: Core Nginx developer announces fork

#126

Post by reactordev »

mholt wrote: post #96
dingnuts wrote: post #84

Earlier quoted context omitted.

I keep a Caddy server around and the config format is actually much, much nicer than nginx's in my experience. The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This works for me because I already knew a fair bit about nginx configuration before picking up Caddy but it really kills me to see just how many…

> The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This is so real. I call it "doc-lock" or documentation lock-in. I don't really know a good scalable way to solve this faster than the natural passage of time and growth of the Caddy project.

LLMs baby! Input nginx config, output caddy config. Input nginx docs, output caddy docs. Someone get on this and go to YC.

Re: Freenginx: Core Nginx developer announces fork

#127

Post by Twirrim »

MZMegaZone wrote: post #81
nmjohn wrote: post #70

Earlier quoted context omitted.

Why did he not want CVE's assigned?

I think you'd have to ask Maxim. My take is he felt experimental features should not get CVEs, which isn't how the program works. But that's just my take - I'm the primary representative for F5 to the CVE program and on the F5 SIRT, we handle our vuln disclosures.

I'm inclined to agree with your decision to create and publish CVEs for these, honestly. You were shipping code with a now-known vulnerability in it, even if it wasn't compiled in by default.

Re: Freenginx: Core Nginx developer announces fork

#128

Post by mynameisvlad »

colechristensen wrote: post #116
szundi wrote: post #104

Earlier quoted context omitted.

Not the web though

HTTP 1.1 isn’t really changing is it? That and a small collection of other things are standards based and not going though changes.

Sure, but HTTP3 was proposed in 2022.

Re: Freenginx: Core Nginx developer announces fork

#129

Post by Gormo »

ironmagma wrote: post #77
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

> Also this is kind of why everything is ever so slightly broken, IMHO.

OTOH, things that update too often seem to be more than slightly broken on an ongoing basis, due to ill-advised design changes, new bugs and regressions, etc.

Re: Freenginx: Core Nginx developer announces fork

#130

Post by mholt »

bklyn11201 wrote: post #109
mholt wrote: post #93

Earlier quoted context omitted.

That's the best part -- you can choose your config format when using Caddy! https://caddyserver.com/docs/config-adapters

True and I've made use of the Nginx adapter, but the resulting series of error messages and JSON was too scary to dive in further. The workflow that would make the most sense to me (to exit Nginx-world) would be loading my complex Nginx configs (100+ files) with the adapter, summarizing what could not be interpreted, and then writing the entirety to Caddyfile-format for me to modify further. I understand that JSON to…

Thanks for the feedback, that's good to know.
Post reply on HN