3 ms·
> which you should for many reasons but chiefly performance and security. Why would you use nginx for security? I see over 100 CVEs for nginx. This isn't exac
by wyager 9y ago
> which you should for many reasons but chiefly performance and security.
Why would you use nginx for security? I see over 100 CVEs for nginx.
This isn't exactly unexpected. Nginx is an incredibly complicated piece of software written for performance in C. That's basically the trifecta of security badness.
If you want security, why not use a (possibly slower) simpler product written in a safer language?
- icebraining 9y agoAh, the old concept of binary security - either you want it or not. It doesn't work like that, security is one need to be balanced against others. Also, lots of CVEs indicate only one thing: that lots of people are checking it.
- ghettoimp 9y agoHrmn. Doesn't it also mean they're finding lots of problems with it?
- throwaway135634 9y agoKey word "finding". Most large software has plenty of bugs, CVE's just tell you how many they're aware of
- wyager 9y ago> Also, lots of CVEs indicate only one thing: that lots of people are checking it. Also that it has lots of vulnerabilities. Instead, you could use a product that's secure by design.
- rkeene2 9y agoIf you want no CVEs you could use my web server filed[0]. It's really fast. And written in C. ;-) Of course, it doesn't support HTTPS or HTTP/2, so... there's that. [0] http://filed.rkeene.org/ http://filed.rkeene.org/