Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Freenginx: Core Nginx developer announces fork

mailman.nginx.org

Post reply on HN
Print view View original

261–270 of 501 posts

Re: Freenginx: Core Nginx developer announces fork

#261

Post by reactordev »

karolist wrote: post #37
reactordev wrote: post #31

Earlier quoted context omitted.

There's a world of software out there that's not on github or using git. "I don't always git clone, but when I do, it's hg clone"

I have mixed feeling about github's dominance. They have created facebook for devs and uplifted collaboration of software to a high level, but I can't help but feel like I'm renting storage space in someone else's private shop when I use them. Yes you get engagement, yes you get one link to share your dev profile and timeline grid in CV, but it's a for profit business that is run by MS.

“but I can't help but feel like I'm renting storage space in someone else's private shop when I use them”

I’ve been looking for the words to put to that feeling myself but was unable to pinpoint it so well.

I loved GitHub at first. “Look at all the cool stuff I made” was kinda a way of showing my capabilities (and is still a great way today!) but somewhere along the way it became a platform for egos and star stroking and blind following into the nights. They improved their search but it could be so much better. Not everyone has a graphic designer on staff to make pretty README.md’s

Re: Freenginx: Core Nginx developer announces fork

#262

Post by Twirrim »

whoknowsidont wrote: post #249
xcrunner529 wrote: post #219

Earlier quoted context omitted.

Why is it insane? The CVE goal was to track vulnerabilities that customers could be exposed to. It is used…in public, released versions. Why wouldn’t it be tracked?

Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.

It's in the published source code, as a usable feature, just flagged as experimental and not compiled by default. It's not like this is some random development branch. It's there, to be used en route to being stable. People will have downloaded a release tagged version of the source code, compiled that feature in and used it.

By what definition is that not shipped?

> I am actually completely shocked this needs to be explained. Legitimate insanity.

Right back at you.

Re: Freenginx: Core Nginx developer announces fork

#263

Post by CogitoCogito »

nullify88 wrote: post #155
eddieroger wrote: post #88

Earlier quoted context omitted.

My org moved off nginx for haproxy after we learned that (at the time, maybe it changed) reloading an nginx config, even if done gracefully through kernel signals, would drop existing connections, where haproxy could handle it gracefully. That was a fun week of diving in to some C code looking for why it was behaving that way.

How did you come to that conclusion? I always believed a reload spawned new workers and let the old one drain off.

Yes I reload nginx all the time and it doesn’t drop connections. I just use the debian nginx package. Not sure what the gp is talking about.

Re: Freenginx: Core Nginx developer announces fork

#264

Post by xcrunner529 »

whoknowsidont wrote: post #249
xcrunner529 wrote: post #219

Earlier quoted context omitted.

Why is it insane? The CVE goal was to track vulnerabilities that customers could be exposed to. It is used…in public, released versions. Why wouldn’t it be tracked?

Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.

I guess a vulnerability doesn’t count unless it’s default lol. Just don’t make it default and you never have any responsibility nor does those who use it or use a vendor version that has added it in their product.

Re: Freenginx: Core Nginx developer announces fork

#265

Post by whoknowsidont »

Twirrim wrote: post #262
whoknowsidont wrote: post #249

Earlier quoted context omitted.

Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.

It's in the published source code, as a usable feature, just flagged as experimental and not compiled by default. It's not like this is some random development branch. It's there, to be used en route to being stable. People will have downloaded a release tagged version of the source code, compiled that feature in and used it. By what definition is that not shipped? > I am actually completely shocked this needs to be…

>just flagged as experimental and not compiled by default

Are UML diagrams considered in scope too?

Re: Freenginx: Core Nginx developer announces fork

#266

Post by whoknowsidont »

xcrunner529 wrote: post #264
whoknowsidont wrote: post #249

Earlier quoted context omitted.

Because it's not actually part of the distribution unless you compile it yourself. It is not released any sense of the word. It is not even a complete feature. I am actually completely shocked this needs to be explained. Legitimate insanity.

I guess a vulnerability doesn’t count unless it’s default lol. Just don’t make it default and you never have any responsibility nor does those who use it or use a vendor version that has added it in their product.

>I guess a vulnerability doesn’t count unless it’s default lol.

It's still being tested. It's not complete. It's not released. It's not in the distribution. The amount of people that have this feature in the binary AND enabled is less than the amount of people that agree that this should be a CVE.

CVE's are not for tracking bugs in unfinished features.

Re: Freenginx: Core Nginx developer announces fork

#267

Post by whatever1 »

ironmagma wrote: post #77
687m786m78 wrote: post #75

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.

Meanwhile my anaconda installation died after a casual apt-get update lol

I now believe that every piece of software should be shipped as a container to avoid any system library dependencies.

Re: Freenginx: Core Nginx developer announces fork

#268

Post by bhaney »

hinkley wrote: post #255
jbverschoor wrote: post #67

Earlier quoted context omitted.

And that's how 100x developers don't get the recognition they deserve.

Philosophically, if a lead developer is doing most of the commits on a project, then they are monopolizing both the code and the decision making process, which is a sure way to kill a project. If the basketball or soccer team captain were also a ball hog, they'd have trouble keeping the bench full. When you become lead, you have to let some of the code go, and the best way I know to do it is to only put your fingers…

> which is a sure way to kill a project

Nonsense

Re: Freenginx: Core Nginx developer announces fork

#269

Post by MZMegaZone »

tiffanyh wrote: post #192
sschueller wrote: post #34

Is this what the security disagreements is about https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6M... ?

I don't see anything more in that mail list thread beyond the post you linked too. Where was the disagreement hashed out, so I can read more?

Internally at F5 (where I work as a Principal Security Engineer in the F5 SIRT and was one of the people responsible for making the call on assigning the CVEs).
Post reply on HN