Did we find out why the dev of freenginx did not want the nginx CVE that caused this fork? Some contex would be nice as it seems like a weird reason to fork.
Freenginx: Core Nginx developer announces fork
411–420 of 501 posts
Re: Freenginx: Core Nginx developer announces fork
#412It was already mentioned in the other thread, but it looks like F5 owns the trademark for the Nginx name. Maxim should consider rebranding the project to avoid any legal blowback.
Re: Freenginx: Core Nginx developer announces fork
#413Earlier quoted context omitted.
tangent but i havent seen that happen on any of my putty clients in years and i use it everyday, so i think that finally got fixed? or maybe was a side effect of something stupid
next question: why are people still using putty
There's some obscure settings that putty supports that other terminals do (did?) not. It's been a while so I don't remember all the details, but for example, some systems expected the DEL key and not Ctrl-C to interrupt. You can change the interrupt key with `stty` on other terminals, but it only allows setting the key to a single character, and DEL is typically an escape sequence.
Re: Freenginx: Core Nginx developer announces fork
#414Earlier quoted context omitted.
While I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrains, for example. But there is also core-js which is a little polyfill library being used by like way more than half of high profile websites. Also written by a Russian national. If you excise all contributions by Russian nationals to PostgreSQL or the Linux ker…
I think being open source is important here; I don't care if you're German or Russian or Finnish or Chinese or what your governments policies are, as long as we can inspect what's going on. "Trust but verify".
You can still sneak nefarious stuff if you have a lot of reputation score so that most people who actually put their eyeballs on the stuff tend to trust you blindly, especially if the development on the project is so active that you don't have the bandwidth to inspect all the changes.
There is also the mighty bystander effect at play: surely, someone else is going to look at it. Someone else will have time to test it. He's our hero, the Someone-Else-Man!
Mind you, it only takes to catch you once, and your mountain of reputation will poof out of existence in an eyeblink. This is the price.
Mind you, asking to downplay a vulnerability "because it's in an experimental module not built by default" would make me suspicious on the simple grounds that even if a module is experimental, you ship it alongside your stable code, and for sure someone builds it and is using it. Depending on who those users might be, there could be also parties interested in them not patching the vulnerability for as long as possible.
This sounds paranoid for sure, but your being paranoid doesn't mean there's nobody out to get you!
Re: Freenginx: Core Nginx developer announces fork
#415Bravo!
Re: Freenginx: Core Nginx developer announces fork
#416It was already mentioned in the other thread, but it looks like F5 owns the trademark for the Nginx name. Maxim should consider rebranding the project to avoid any legal blowback.
As I suggested elsewhere [0] if you bump each letter in nginx you get... ohjoy!
Re: Freenginx: Core Nginx developer announces fork
#417Earlier quoted context omitted.
I think being open source is important here; I don't care if you're German or Russian or Finnish or Chinese or what your governments policies are, as long as we can inspect what's going on. "Trust but verify".
You can still sneak nefarious stuff if you have a lot of reputation score so that most people who actually put their eyeballs on the stuff tend to trust you blindly, especially if the development on the project is so active that you don't have the bandwidth to inspect all the changes. There is also the mighty bystander effect at play: surely, someone else is going to look at it. Someone else will have time to test it…
I never said it's perfect, but at least I have an opportunity to inspect things.
Re: Freenginx: Core Nginx developer announces fork
#418Earlier quoted context omitted.
There's trust in the security sense, which yeah, you're stuck with the whole deal. But there's also trust in the rely on sense. Which at least I try to compartmentalize. I can trust Microsoft (or Google) to make an OS I can rely on to run other people's apps. If Microsoft or Google want to provide apps, they'll be evaluated as they are, not with a bias because the OS provider shipped them.
The client shipped with Windows is literally OpenSSH.
I don't have a problem using OpenSSH, really. But I'm not going to use a Microsoft terminal emulator, unless it has some advantage over the terminal emulator I've been using for decades, when the Microsoft product has no advantage other than Microsoft included it with the OS so I can save a 3.5 MB download. Same reason I don't use Internet Explorer / Edge / new Edge or Windows Media Player. On a level playing field, I would never use those products (well that's not true, IE 3 was ok when it came out, IE 4 and 6 were good when they were new, but I don't have a time machine), so why use them because the field is unlevel.
Re: Freenginx: Core Nginx developer announces fork
#419Earlier quoted context omitted.
You can still sneak nefarious stuff if you have a lot of reputation score so that most people who actually put their eyeballs on the stuff tend to trust you blindly, especially if the development on the project is so active that you don't have the bandwidth to inspect all the changes. There is also the mighty bystander effect at play: surely, someone else is going to look at it. Someone else will have time to test it…
I never said it's perfect, but at least I have an opportunity to inspect things.
Yes, this is exactly the counter-argument I always make whenever someone says "but there are never the eyeballs to inspect open source, see Heartbleed, so why bother, it's not better", blablabla.
But at least I have the option, dammit! Contrary to the proprietary software where your problem will be diligently filed into a ticket, given a number, and be left to rot.
Which doesn't change the fact that people are lazy and do turn the blind eye... :-( and sometimes the Someone-Else-Man won't come and save the day. But that's just life.
Re: Freenginx: Core Nginx developer announces fork
#420This fork should use the Apache Foundation for its hosting and things.
[deleted]