3 ms·

I'm astonished how many shared hosting provider still using apache 2.4. Yes, there are a few things apache is remarkable about - the npm-itk engine could run a

by pmlnr 9y ago

I'm astonished how many shared hosting provider still using apache 2.4. Yes, there are a few things apache is remarkable about - the npm-itk engine could run as user processes, which was nice for shared hosting - but all the problems with it - slowloris, anyone? - simply outweights the benefits. Shared hosting should be containerised or vm-ised instead and run on nginx/lighttpd/cherookee/etc + php-fpm 7.0 which will save you a lot of headaches and CPU cycles. .htaccess can be just as much a benefit as a curse. (Note: WordPress is completely nginx + php-fpm friendly.)

toomuchtodo 9y ago
Lots of shared hosting uses tooling like cPanel shared hosting automation, which if I recall is still defaulting to Apache. Nginx is surely the first choice if you're rolling your own shared hosting infrastructure, but most legacy commercial shared hosting automation frameworks still use Apache and customers don't care what the underlying tech is serving their bits over HTTP.
jimjag 9y ago
"all the problems" are really old, old news, long ago addressed and resolved. In fact, such statements are more FUD than anything else. Certainly you MUST know that Apache httpd supports PHP-FPM, for example.
- user5994461 9y ago
  The old problems are not solved and not resolved at all. I am working on a critical apache setup at the moment and the software is rigged with weird corner cases and bugs. This shit doesn't happen with haproxy and nginx.
  - stephenr 9y ago
    You know you can use HAProxy with apache too right? I never understand these arguments that basically pit Apache2 on its own/with modules against a completely modular arrangement of tls/cache/web/app as different layers. If you use apache as the "web" in that setup, it needs relatively few modules loaded and when configured correctly can be blazing fast.
    - deleted 9y ago
      [deleted]
xorcist 9y ago
Still using? Apache 2.4 is the current version. Apache is far from perfect, but among its ilk it is probably the one of the more robust and well tested. It's not as if you don't have to care about connection hogging attacks such as slowloris with other http servers. The cycles saved on the nginx http parser, which is completely irrelevant to the performance of any real world web application, comes at the price of being hand optimized and opaque. You can't really argue for that type of performance engineering at the same time as you argue for solid security. The world generally needs more secure software, not more performant protocol parsers. Do also note that nginx had a very similar data leak bug not even two months ago in the range header.

by pmlnr 9y ago

toomuchtodo 9y ago

Lots of shared hosting uses tooling like cPanel shared hosting automation, which if I recall is still defaulting to Apache. Nginx is surely the first choice if you're rolling your own shared hosting infrastructure, but most legacy commercial shared hosting automation frameworks still use Apache and customers don't care what the underlying tech is serving their bits over HTTP.

jimjag 9y ago

"all the problems" are really old, old news, long ago addressed and resolved. In fact, such statements are more FUD than anything else. Certainly you MUST know that Apache httpd supports PHP-FPM, for example.

user5994461 9y ago
The old problems are not solved and not resolved at all. I am working on a critical apache setup at the moment and the software is rigged with weird corner cases and bugs. This shit doesn't happen with haproxy and nginx.
- stephenr 9y ago
  You know you can use HAProxy with apache too right? I never understand these arguments that basically pit Apache2 on its own/with modules against a completely modular arrangement of tls/cache/web/app as different layers. If you use apache as the "web" in that setup, it needs relatively few modules loaded and when configured correctly can be blazing fast.
  - deleted 9y ago
    [deleted]

xorcist 9y ago

Still using? Apache 2.4 is the current version. Apache is far from perfect, but among its ilk it is probably the one of the more robust and well tested. It's not as if you don't have to care about connection hogging attacks such as slowloris with other http servers. The cycles saved on the nginx http parser, which is completely irrelevant to the performance of any real world web application, comes at the price of being hand optimized and opaque. You can't really argue for that type of performance engineering at the same time as you argue for solid security. The world generally needs more secure software, not more performant protocol parsers. Do also note that nginx had a very similar data leak bug not even two months ago in the range header.