Earlier quoted context omitted.
Multitude: a very great number 5 is a very good number but I don’t know if I’d go so far as to call it “great”.
5 vulnerabilities at once is a lot.
You missed a very good dad joke.
Developers fix multitude of vulnerabilities in Apache HTTP Server
71–80 of 115 posts
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#72It turns out that "multitude", in this case, is 5. (Still glad they got patched, of course)
Multitude: a very great number 5 is a very good number but I don’t know if I’d go so far as to call it “great”.
A very good number, some people say great, I don't know, maybe even one of the very best! That's what people are saying.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#73On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
Could be the case. Could also be that the bugs were never in Debian if they were introduced recently as Debian stable is relatively conservative about package updates other than for security purposes.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#74It's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten year…
Every day someone is born who has never seen The Flintstones
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#75Earlier quoted context omitted.
Exactly what I was thinking. You’re more likely just to have a wide open and highly/easily penetrable/vulnerable server up for grabs at that point.
Presumably you'll have less features. I wrote a web server (in the 90s, so forgivable?), and I only implemented GET and query string for the API data, and nothing fancy, no cache headers, no redirects, no multipart, no gzip, no content-encoding negotiation, etc. Some of the APIs it hosted were ultimately hacked (thru encryption of the encrypted query string via plain DES, and the key was determined), but, so far as I…
Ah yes, that would make sense.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#76Full vulnerability list: https://httpd.apache.org/security/vulnerabilities_24.html
What I find interesting is that when browsing lists like these, more and more often I see names that are not from Europe or a rich English-speaking country. Nice to see previously-poorer countries getting online, the internet a bit more diverse, and the world a bit more connected. Though of course this is only empirical, perhaps it has always been this way and I just never noticed.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#77Earlier quoted context omitted.
Multitude: a very great number 5 is a very good number but I don’t know if I’d go so far as to call it “great”.
A very good number, some people say great, I don't know, maybe even one of the very best! That's what people are saying.
Donny, is that you?
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#78Anybody still using Apache?
You seem to not be a fan of it, do you have a feature-complete replacement?
For example, Nginx's standpoint on htaccess is basically "find yourself another web server" (https://www.nginx.com/resources/wiki/start/topics/examples/l...). I don't fancy giving users access to /etc/nginx and the power to reload the config just to add aliases on their own subdomains. Much better if they can add password protection to a directory by themselves. It also breaks that each site can live in its own project directory: without htaccess, if I copy over a project I would also have to modify my global nginx config to set per-directory (or at least per vhost) aliases, error pages, etc. Right now, I can say that deploying a project is "download the directory into the desired location and configure your database credentials and a pepper in the config.php". No global configuration changes are ever needed, the global config only does global stuff: tls ciphers, fallback error pages, compression, log files, and more such things.
And that's ignoring the fact that, even if there was some objectively better web server, I'd have the task of rewriting a decade of htaccess files into their fancy new format while Apache2 is still alive and properly supported.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#79Anybody still using Apache?
This reminds me of the classic "Anybody still using PHP" question.
raises remaining hand
Now if someone asks me if I also still use the same laptop as when Apache had >6 times the market share of Nginx (https://news.netcraft.com/archives/category/web-server-surve...), I will need to find more hands.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#80Anybody still using Apache?
I used to run apache for general purpose web service / perl CGI and Zeus to serve static images.
I thought I was so cool ...