131–140 of 501 posts
Earlier quoted context omitted.
Yep. Maxim did not want CVEs assigned.
Why wouldn't he want CVEs assigned?
>And, while the particular action isn't exactly very bad, the approach in general is quite problematic.
Earlier quoted context omitted.
> The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This is so real. I call it "doc-lock" or documentation lock-in. I don't really know a good scalable way to solve this faster than the natural passage of time and growth of the Caddy project.
LLMs baby! Input nginx config, output caddy config. Input nginx docs, output caddy docs. Someone get on this and go to YC.
Earlier quoted context omitted.
> features that look remarkably similar to Nginx Plus features (e.g., the console) Its illegal for products in the same space to have similar features?
Please compare the two and let us know if you think "similar" is the right word.
Earlier quoted context omitted.
> The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This is so real. I call it "doc-lock" or documentation lock-in. I don't really know a good scalable way to solve this faster than the natural passage of time and growth of the Caddy project.
LLMs baby! Input nginx config, output caddy config. Input nginx docs, output caddy docs. Someone get on this and go to YC.
It's clear from this thread that a) Nginx open source will not proceed at its previous pace, b) the forks are for Russia and not for western companies, and c) Caddy seems like absolutely the most sane and responsive place to move.
Earlier quoted context omitted.
Yep. Maxim did not want CVEs assigned.
Why wouldn't he want CVEs assigned?
- CVEs are gold to researchers and organizations like citations are to academics. In this case, the CVEs were filed based on "policy" but it's unclear if they are just adding noise to the DB.
- The severity of the bug is not as severe as greater powers-that-be would like to think (again, they see it as doing due diligence; developers who know the ins and outs might see it as an overreaction).
- Bug is in an experimental feature.
I'm not saying one way is right or not in this case, just pointing out my experience has generally been that CVEs are kind of broken in general...
It is scary to think about how much of web relies on projects maintained by 1 or 2 people.
It's not that scary. If a project everyone depends on is broken and unmaintained, someone else will manufacture a replacement fairly quickly and people will vote with their feet. NGINX is the de facto standard today, but I can remember running servers off apache when I began professionally programming. I remember writing basic cross-broweser spas with script.aculous, and prototypejs in 2005, before bundlers and react…
Earlier quoted context omitted.
Yep. Maxim did not want CVEs assigned.
[flagged]
Yes, very suspicious that he didn't want to issue CVEs for
checks notes
Two DOS attacks that only apply to users that explicitly enabled experimental QUIC support (by default it's disabled)
Earlier quoted context omitted.
Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.
> Also this is kind of why everything is ever so slightly broken, IMHO. OTOH, things that update too often seem to be more than slightly broken on an ongoing basis, due to ill-advised design changes, new bugs and regressions, etc.