Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

211–220 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#211

Post by Nijikokun »

tiffanyh wrote: post #186
nimbius wrote: post #182

>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.

They could take the Postgres naming approach. Ingress was forked; the Post fork version of Ingress was called "Post"gres. So maybe name this new project "PostX" (for Post + nginx). Though that might sound too similar to posix.

Postgres name is said to be a reference to ingres db, not a fork of ingres.

> The INGRES relational database management system (DBMS) was implemented during 1975-1977 at the Univerisity of California. Since 1978 various prototype extensions have been made to support distributed databases [STON83a], ordered relations [STON83b], abstract data types [STON83c], and QUEL as a data type [STON84a]. In addition, we proposed but never prototyped a new application program interface [STON84b]. The University of California version of INGRES has been ‘‘hacked up enough’’ to make the inclusion of substantial new function extremely difficult. Another problem with continuing to extend the existing system is that many of our proposed ideas would be difficult to integrate into that system because of earlier design decisions. Consequently, we are building a new database system, called POSTGRES (POSTinGRES).

[https://dsf.berkeley.edu/papers/ERL-M85-95.pdf]

Re: Freenginx: Core Nginx developer announces fork

#212

Post by doormatt »

martinohansen wrote: post #62
doormatt wrote: post #55

Earlier quoted context omitted.

Yup - there was a massive internal push to move off of SSL terminating LBs back in ~2018

How come?

Cost.

Now, SSL termination is done at the host level, using a distributed SSL termination proxy developed by S3 called "JBLRelay"

Re: Freenginx: Core Nginx developer announces fork

#213

Post by DarkmSparks »

Thaxll wrote: post #82
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

For the vast majority of use cases nginx from 10 years ago would not make a difference. You actually see the nginx version on some html pages and very often it's old.

nginx from 5 years ago has some pretty nasty actively exploited CVEs.

Re: Freenginx: Core Nginx developer announces fork

#214

Post by xcrunner529 »

qwertox wrote: post #164
xcrunner529 wrote: post #108

Earlier quoted context omitted.

I mean I’m not sure how it’s good to want to move to a dev who is against CVEs and disclosures…

Did I miss something regarding that Maxim didn't want CVEs and disclosures? I was not aware of this. And F5 are the ones wanting to add the CVEs (as happened in the announcement which was released an hour earlier)? I could have sworn that I've read about Nginx CVEs in the past.

Well it seems he didn’t think this particular thing should have one despite the criteria being clear.

Re: Freenginx: Core Nginx developer announces fork

#215

Post by KronisLV »

ironmagma wrote: post #113
szundi wrote: post #104

Earlier quoted context omitted.

Not the web though

Certainly the web can mostly coast indefinitely. There are webpages from decades ago that still function fine, even that use JavaScript. The web is an incredibly stable platform all things considered. In contrast, it's hard to get a program that links to a version of Zlib from 10 years ago running on a modern Linux box.

> Certainly the web can mostly coast indefinitely.

I'm not sure about that, for anything besides static resources, given the rate at which various vulnerabilities are found at and how large automated attacks can be, unless you want an up to date WAF in front of everything to be a pre-requisite.

Well, either that or using mTLS or other methods of only letting trusted parties access your resources (which I do for a lot of my homelab), but that's not the most scalable approach.

Back end code does tend to rot a lot, for example, like log4shell showed. Everything was okay one moment and then BOOM, RCEs all over the place the next. I'm all for proven solutions, but I can't exactly escape needing to do everything from OS updates, to language runtime and library updates.

Re: Freenginx: Core Nginx developer announces fork

#216

Post by stusmall »

ironmagma wrote: post #77
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

This isn't one though. I think the issue he is talking about is around the CVEs that came out with the HTTP3 implementation. This is an area of very active and complex development.

Re: Freenginx: Core Nginx developer announces fork

#218

Post by tingletech »

codetrotter wrote: post #172
ironmagma wrote: post #110

Earlier quoted context omitted.

Perhaps someone with more knowledge can chime in. But, my impression is that there are vulnerabilities with TTY, it's just that we stay educated on what those are. And we build systems around it (e.g. SSH) that are secure enough to mitigate the effects of those issues.

SSH was a replacement for Telnet. But any weaknesses at the TTY level is orthogonal to that, right? Unless you mean, having thin clients use SSH as opposed to directly running serial cables throughout a building to VT100 style hardware terminals, and therefore being vulnerable to eavesdropping and hijacking? But I think when we talk about TTY we mostly don’t refer to that kind of situation. If someone talks about TTY…

I miss rooms of green and amber screen terminals hooked up via serial cable. As an undergrad I remember figuring out how to escape from some menu to a TTY prompt that I could somehow telnet to anywhere from. Later, I would inherit a fleet of 200 of them spread across 12 branch libraries. I can't remember how it worked except that somehow all the terminals ran into two BSDi boxes in the core room of the central library, and it had been hardened so you could not break out of the menus and telnet to arbitrary places. Over a year I replaced them all with windows machines that ran version of netscape navigator as the shell with an interface that was built in signed javascript. It was the early days of the web, and we had to support over 300 plug ins for different subscriptions we had. The department that ran the campus network didn't want to let me on the network until I could prove to them everything was secure.

Re: Freenginx: Core Nginx developer announces fork

#219

Post by xcrunner529 »

aaronbwebber wrote: post #173
Twirrim wrote: post #158

Earlier quoted context omitted.

You and I have very different notions of "shipped". It's open source code, it's being made publicly available. That's shipped, as I see it.

This is an insane standard and attempting to adhere to it would mean that the CVE database, which is already mostly full of useless, irrelevant garbage, is now just the bug tracker for _every single open source project in the world_.

Why is it insane? The CVE goal was to track vulnerabilities that customers could be exposed to. It is used…in public, released versions. Why wouldn’t it be tracked?
Post reply on HN