Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

251–260 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#251

Post by hnfong »

ciceryadam wrote: post #227
codetrotter wrote: post #172

Earlier quoted context omitted.

SSH was a replacement for Telnet. But any weaknesses at the TTY level is orthogonal to that, right? Unless you mean, having thin clients use SSH as opposed to directly running serial cables throughout a building to VT100 style hardware terminals, and therefore being vulnerable to eavesdropping and hijacking? But I think when we talk about TTY we mostly don’t refer to that kind of situation. If someone talks about TTY…

SSH was a replacement for RSH, not telnet.

This was on HN two(?) days ago: https://news.ycombinator.com/item?id=39313170

> I wrote the initial version of SSH (Secure Shell) in Spring 1995. It was a time when telnet and FTP were widely used.

> Anyway, I designed SSH to replace both telnet (port 23) and ftp (port 21). Port 22 was free. It was conveniently between the ports for telnet and ftp. I figured having that port number might be one of those small things that would give some aura of credibility. But how could I get that port number? I had never allocated one, but I knew somebody who had allocated a port.

Emphasis mine.

Cheers.

Re: Freenginx: Core Nginx developer announces fork

#252

Post by lolinder »

MZMegaZone wrote: post #66
sschueller wrote: post #34

Is this what the security disagreements is about https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6M... ?

Yep. Maxim did not want CVEs assigned.

It would be worth flagging in this comment that you represent F5. I didn't realize that until I found your other comment below.

Re: Freenginx: Core Nginx developer announces fork

#253

Post by akira2501 »

687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

HTTP/1, HTTP/2 and HTTP/3 are huge standards that were developed, considered and separately implemented by hundreds of people. It's built in C which has an even more massive body of support through the standard, the compilers, the standard libraries, and the standard protocols it's all implemented on.

1 or 2 people maintain one particular software implementation of some of these standards.

It's interesting to think of what a large and massive community cheap and reliable computation and networking has created.

Re: Freenginx: Core Nginx developer announces fork

#254

Post by jupp0r »

ndriscoll wrote: post #229
mynameisvlad wrote: post #128

Earlier quoted context omitted.

Sure, but HTTP3 was proposed in 2022.

Yeah but you can just continue to use HTTP/1.1, which is simpler and works in more scenarios anyway (e.g. doesn't require TLS for browsers to accept it).

You could have stayed with HTTP/1.0 as well. Or Gopher.

Re: Freenginx: Core Nginx developer announces fork

#255

Post by hinkley »

jbverschoor wrote: post #67
amne wrote: post #45

Earlier quoted context omitted.

He *is* nginx ? https://freenginx.org/hg/nginx I don't see it. Sure, he contributes. But in the last 3-4 years he definitely does not look like he is nginx based on that log. Or am I looking in the wrong place?

And that's how 100x developers don't get the recognition they deserve.

Philosophically, if a lead developer is doing most of the commits on a project, then they are monopolizing both the code and the decision making process, which is a sure way to kill a project.

If the basketball or soccer team captain were also a ball hog, they'd have trouble keeping the bench full.

When you become lead, you have to let some of the code go, and the best way I know to do it is to only put your fingers into the things that require your contextual knowledge not to fuck up. If you own more than 10% of the code at this point, you need to start gift-wrapping parts of the code to give away to other people. If you own more than 20%, then you're the one fucking up.

Obviously this breaks down on a team size of 2, but then so do concerns about group and team dynamics.

Re: Freenginx: Core Nginx developer announces fork

#256

Post by ryukoposting »

tky wrote: post #83
MZMegaZone wrote: post #65

Earlier quoted context omitted.

We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.

This seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?

This is confusing. The CVE doesn't describe the attack vector with any meaningful degree of clarity, except to emphasize how you'd have to have a known unstable and non-default component enabled. As far as CVEs go, it definitely lacks substance, but it's not some catastrophic violation of best practices. It hardly reflects poorly on Maxim or anything he's done for Nginx. This seems like an extreme move, and it makes me wonder if there's something we're missing.

Re: Freenginx: Core Nginx developer announces fork

#257

Post by 22c »

patrickmay wrote: post #193
nimbius wrote: post #182

>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.

nginy?

There was also a time where ng postfix was used to denote "next generation", so they could go with nginxng :)

Re: Freenginx: Core Nginx developer announces fork

#258

Post by mike_d »

MZMegaZone wrote: post #111
tky wrote: post #83

Earlier quoted context omitted.

This seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?

Yes, those are the two CVEs I was referring to. All I know is he objected to our decision to assign CVEs, was not happy that we did, and the timing does not appear coincidental.

QUIC in Nginx is experimental and not enabled by default. I tend to agree with him here that a WIP codebase will have bugs that might have security implications, but they aren't CVE worthy.

Re: Freenginx: Core Nginx developer announces fork

#259

Post by mike_d »

Thoreandan wrote: post #54
bklyn11201 wrote: post #33

Earlier quoted context omitted.

Surely "Nginx" is trademarked, copyrighted, etc. A cool and collected fork would do some basic work to avoid trivial lawsuits, consider the other forks already in the space, and write up a bit on how this fork will be different from the others.

A quick glance at USPTO and https://www.f5.com/company/policies/trademarks confirms this.

Russia has laws on the books that allow them to exempt domestic operations from international IP enforcement and to nullify any damages if the entity has a connection to an "unfriendly state."

Re: Freenginx: Core Nginx developer announces fork

#260

Post by numbsafari »

spicykraken wrote: post #205
ramses0 wrote: post #189

Earlier quoted context omitted.

BRB, filing CVE's against literally any project with example code in their documentation...

I've actually seen CVEs like that before, I agree that's bonkers but I have seen it...

Given how frequently people copy and paste example code… why is that surprising? Folks need to be informed. CVEs are a channel for that.
Post reply on HN