I don't understand why some people use a Russian software! Especially in this age.
Because they aren't short sighted like some others?
Freenginx: Core Nginx developer announces fork
181–190 of 501 posts
Re: Freenginx: Core Nginx developer announces fork
#182>freenginx.org
IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.
Re: Freenginx: Core Nginx developer announces fork
#183Per the discussion at https://news.ycombinator.com/item?id=39374312, this cryptic shade:
> Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.
Refers to F5's decision to publish two vulnerabilities as CVEs, when Maxim did not want them to be published.
Re: Freenginx: Core Nginx developer announces fork
#184Earlier quoted context omitted.
Why wouldn't he want CVEs assigned?
I haven't read the content of the patches to understand the impact of the bugs, but from my own experience [0] I can suggest a few reasons: - CVEs are gold to researchers and organizations like citations are to academics. In this case, the CVEs were filed based on "policy" but it's unclear if they are just adding noise to the DB. - The severity of the bug is not as severe as greater powers-that-be would like to think…
To summarize: the more CVEs a "security researcher" can say he created on his resume, the more impressive he thinks he looks. Therefore, the incentive to file CVEs for any stupid little problem is very high. This creates a lot of noise for developers who are forced to address sometimes nonsense that are filed as "high" or "critical".
Re: Freenginx: Core Nginx developer announces fork
#185Earlier quoted context omitted.
It's not that scary. If a project everyone depends on is broken and unmaintained, someone else will manufacture a replacement fairly quickly and people will vote with their feet. NGINX is the de facto standard today, but I can remember running servers off apache when I began professionally programming. I remember writing basic cross-broweser spas with script.aculous, and prototypejs in 2005, before bundlers and react…
I still deploy Apache httpd, because that’s what I know best, and it works.
[deleted]
Re: Freenginx: Core Nginx developer announces fork
#186>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.
They could take the Postgres naming approach.
Ingress was forked; the Post fork version of Ingress was called "Post"gres.
So maybe name this new project "PostX" (for Post + nginx).
Though that might sound too similar to posix.
Re: Freenginx: Core Nginx developer announces fork
#187Earlier quoted context omitted.
HAProxy is a wonderful load balancer that doesn't serve static files thus forcing many of us to learn Nginx to fill the static-file-serving scenarios. Caddy seems like a wonderful alternative that does load balancing and static file serving but has wild config file formats for people coming from Apache/Nginx-land.
Just for completeness sake and probably not useful to many people, HAProxy can serve a limited number of static files by abusing the back-end and error pages. I have done this for landing pages, directory/table of content pages. One just makes a properly configured HTTP page that has the desired HTTP headers embedded in it and then configure it as the error page for a new back-end and use ACL's to direct specific URL…
FYI: Serving static files is easier and more flexible in modern versions of HAProxy via the `http-request return` action [1]. No need to abuse error pages and no need to embed the header within the error file any longer :-) You even have some dynamic generation capabilities via the `lf-file` option, allowing you to embed e.g. the client IP address or request ID in responses.
[1] https://docs.haproxy.org/dev/configuration.html#4.4-return
Disclosure: I'm a community contributor to HAProxy.
Re: Freenginx: Core Nginx developer announces fork
#188Earlier quoted context omitted.
You and I have very different notions of "shipped". It's open source code, it's being made publicly available. That's shipped, as I see it.
This is an insane standard and attempting to adhere to it would mean that the CVE database, which is already mostly full of useless, irrelevant garbage, is now just the bug tracker for _every single open source project in the world_.
This. CVE has become garbage because "security researchers" are incentivized to file anything and everything so they can put it on their resume.
Re: Freenginx: Core Nginx developer announces fork
#189Earlier quoted context omitted.
if it's not compiled in by default, then you aren't shipping the code! Somebody is downloading it and compiling it themselves!
If the feature is in the code that's downloaded, regardless of whether or not the build process enables it by default, the code is definitely being shipped.
BRB, filing CVE's against literally any project with example code in their documentation...
Re: Freenginx: Core Nginx developer announces fork
#190>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.
They could take the Postgres naming approach. Ingress was forked; the Post fork version of Ingress was called "Post"gres. So maybe name this new project "PostX" (for Post + nginx). Though that might sound too similar to posix.
"Postginx" has a nice ring to it, could be an alcoholic beverage, a name of a generation, or even a web server.