Note for some reason Maxim chose to link to http://freenginx.org , instead of https://freenginx.org
typo? it forwards to https anyway.
Pretty sure that's an extension on your part.
Neither chrome/firefox/cURL redirects that to https for me.
Freenginx: Core Nginx developer announces fork
371–380 of 501 posts
Re: Freenginx: Core Nginx developer announces fork
#372Earlier quoted context omitted.
SSH was a replacement for RSH, not telnet.
This was on HN two(?) days ago: https://news.ycombinator.com/item?id=39313170 > I wrote the initial version of SSH (Secure Shell) in Spring 1995. It was a time when telnet and FTP were widely used. > Anyway, I designed SSH to replace both telnet (port 23) and ftp (port 21). Port 22 was free. It was conveniently between the ports for telnet and ftp. I figured having that port number might be one of those small things…
https://docs.oracle.com/cd/E36784_01/html/E36870/ssh-1.html from man page:
It is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network.
Re: Freenginx: Core Nginx developer announces fork
#373It is scary to think about how much of web relies on projects maintained by 1 or 2 people.
Relevant Xkcd comic: https://xkcd.com/2347/
Re: Freenginx: Core Nginx developer announces fork
#374Earlier quoted context omitted.
Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.
That only helps if it stays static. For example, if the Linux TTY interface was unchanged for decades to such a degree that nobody worked on it, but then had a vulnerability, who would be able to fix it quickly?
They're open source.
Re: Freenginx: Core Nginx developer announces fork
#375Earlier quoted context omitted.
HAProxy is a wonderful load balancer that doesn't serve static files thus forcing many of us to learn Nginx to fill the static-file-serving scenarios. Caddy seems like a wonderful alternative that does load balancing and static file serving but has wild config file formats for people coming from Apache/Nginx-land.
A load balancer shouldn't serve static files. It shouldn't serve anything. It should... load balance. I can see why you'd want an all-in-one solution sometimes, but I also think a single-purpose service has strengths all its own.
For a lot of web apps, having an all-in-one solution makes sense.
nginx open source does all of these things and more wonderfully:
Reverse proxying web apps written in your language of choice
Load balancer
Rate limiting
TLS termination (serving SSL certificates)
Redirecting HTTP to HTTPS and other app-level redirects
Serving static files with cache headers
Managing a deny / allow list for IP addresses
Getting geolocation data[0], such as a visitor’s country code, and setting it in a header
Serving a maintenance page if my app back-end happens to be down on purpose
Handling gzip compression
Handling websocket connections
nginx can do all of this with a few dozen lines of config and it has an impeccable track record of being efficient and stable. You can also use something like OpenResty to have Lua script support so you can script custom solutions. If you didn't want to use nginx plus you can find semi-comparable open source Lua scripts and nginx modules for some individual plus features.
[0]: Technically this is an open source module to provide this feature.
Re: Freenginx: Core Nginx developer announces fork
#376I hope he implements the least connection load balancing option for free users.
Re: Freenginx: Core Nginx developer announces fork
#377Earlier quoted context omitted.
> Also this is kind of why everything is ever so slightly broken, IMHO. OTOH, things that update too often seem to be more than slightly broken on an ongoing basis, due to ill-advised design changes, new bugs and regressions, etc.
The problem with bug full updating software is usually that they don’t release changes fast enough, ironically. Apple routinely holds back changes for a .0 release for advertising reasons. This means that they routinely have big releases that break everything at once. Bugs could come from 4 or 5 different sets of changes. But if they spread out changes… bug sources would be way more easy to identify. And bug fix velo…
This means they should either push updates quickly on an ongoing basis, or not push them at all and provide service packs at regular intervals like Windows XP and 7 used to do.
Re: Freenginx: Core Nginx developer announces fork
#378Earlier quoted context omitted.
QUIC in Nginx is experimental and not enabled by default. I tend to agree with him here that a WIP codebase will have bugs that might have security implications, but they aren't CVE worthy.
We know a number of customers/users have the code in production, experimental or not. And that was part of decision process. The security advisories we published do state the feature is experimental. When in doubt, err on the side of doing the right thing for the users. I find that's the best approach. I don't consider CVE a bad thing - it shouldn't be treated like a scarlet letter to be avoided. It is a unique ident…
The question I ask is "Why not assign a CVE?"
Re: Freenginx: Core Nginx developer announces fork
#379Earlier quoted context omitted.
I'm very out of date so take my opinion with a grain of salt. The customer support I received from F5 when they acquired a telco product was about the worst support I've ever seen. Now this wasn't the general LB equipment that F5 has the reputation around, it's some specific equipment for LTE networks. We'd get completely bogus explanations for bugs, escalate up the chain to VPs and leadership because there was an ob…
I completely get this. I feel like every product I’ve had outside of a vendor’s wheelhouse has gone that way. We just use the BigIP gear from F5 and they’re better than the load balancers we used in the past. Thank god Cisco just abandoned that business. I can’t imagine them supporting telco gear. The IPv6 thing has me LOLing because I just had a similar experience with a vendor where we don’t route IPv6 in that segm…
> I have a list of “thou shalt not” companies
Can you share that list?
Re: Freenginx: Core Nginx developer announces fork
#380Earlier quoted context omitted.
I haven't read the content of the patches to understand the impact of the bugs, but from my own experience [0] I can suggest a few reasons: - CVEs are gold to researchers and organizations like citations are to academics. In this case, the CVEs were filed based on "policy" but it's unclear if they are just adding noise to the DB. - The severity of the bug is not as severe as greater powers-that-be would like to think…
"Denial of service" is never a security bug; it's a huge mistake people have started classifying these things as such to start with. Serious bug? Sure. Loss of security? Not really.
> "Denial of service" is never a security bug.
What about serving certificate revocation list, with another system relying on say one day old cache? (Sure, that's "fail open" - but still...).
Or proxying LDAP for sync to a central auth/authz system?
Ed: proxy giving access to logging system goes down - alert on failed logins silenced, disabling rate limits for brute force attacks?