6 ms·

From a cursory glimpse, it seems Apple only pathes CVEs in OSS components when the OS itself gets an upgrade. The next time there is a problem in Apache, the c

by nikanj 9y ago

From a cursory glimpse, it seems Apple only pathes CVEs in OSS components when the OS itself gets an upgrade. The next time there is a problem in Apache, the chances seem pretty high it will remain unpatched on macOS for weeks, if not months.

Prontiol 9y ago
AFAIK macOS built in Apache is not started by default, so it is not a security risk anyway
- domenukk 9y ago
  That's a strange way to look at things. You could argue the computer doesn't come started by default so it's not a security risk... If there's an option to start it, it's a risk.
  - mariusmg 9y ago
    Yeah, they should sell those Macs without a start button. That should keep them secure :)
simlevesque 9y ago
Why does macOS ship with Apache ?
- rcarmo 9y ago
  It used to be the basis for personal web pages, and deployable to via iWeb, the “easy” web authoring tool that baked text into images... Also, the server variants ran most services (calendars, etc.) behind it. Edit: premature posting.
- tjohns 9y ago
  Before Mountain Lion, a personal web server was available under System Preferences > Sharing > Web Sharing. They removed the UI to enable it in Mountain Lion, but the functionality is still built in and can be enabled if you install Apple's MacOS Server app from the app store. Or you can just enable it from the command line.
  - amatecha 9y ago
    heh, remember when you could actually host your own website from your home connection on port 80? Dynamic DNS services, etc... ISPs put a quick end to that, though :(
    - rodgerd 9y ago
      I... still do? This is more about ISPs where you live than anything else. Most people don't want the hassle.
      - amatecha 9y ago
        Yeah, guess it varies, but a lot of ISPs block incoming port 80 connections. Common enough that noip.com has a "port redirection" feature, interestingly enough: http://www.noip.com/support/knowledgebase/my-isp-blocks-port-80-what-can-i-do/ http://www.noip.com/support/knowledgebase/my-isp-blocks-port...
    - __david__ 9y ago
      Not really. I still host a number of sites on my home linux box.
    - ungzd 9y ago
      Nowadays you need PAAS cloud hosting with Kubernetes on at least 3 servers, monitoring SAAS, log storage SAAS, CI for js transpilers, CDN for assets, Cloudflare, SSL certificate, checklist for PWA compliance, UX guidelines, AMP, OpenGraph metadata. Because best practices!
  - Waterluvian 9y ago
    It was a really nice idea. I wonder how often it got used. I think it was a conceptual relic of the [Jeff Goldblum era](https://www.youtube.com/watch?v=dQmK1CnwOUI https://www.youtube.com/watch?v=dQmK1CnwOUI) of iMacs with instant Internet and personal webpages.
    - tomc1985 9y ago
- thought_alarm 9y ago
  I assume it's so that I can run Bugzilla on my laptop.
- nvr219 9y ago
  Right, I feel like anyone who would need apache on MacOS would know how to install it...
btgeekboy 9y ago
Apple sometimes distributes separate security updates, depending on the severity of the issue.

by nikanj 9y ago

Prontiol 9y ago

AFAIK macOS built in Apache is not started by default, so it is not a security risk anyway

domenukk 9y ago
That's a strange way to look at things. You could argue the computer doesn't come started by default so it's not a security risk... If there's an option to start it, it's a risk.
- mariusmg 9y ago
  Yeah, they should sell those Macs without a start button. That should keep them secure :)

simlevesque 9y ago

Why does macOS ship with Apache ?

rcarmo 9y ago
It used to be the basis for personal web pages, and deployable to via iWeb, the “easy” web authoring tool that baked text into images... Also, the server variants ran most services (calendars, etc.) behind it. Edit: premature posting.
tjohns 9y ago
Before Mountain Lion, a personal web server was available under System Preferences > Sharing > Web Sharing. They removed the UI to enable it in Mountain Lion, but the functionality is still built in and can be enabled if you install Apple's MacOS Server app from the app store. Or you can just enable it from the command line.
- amatecha 9y ago
  heh, remember when you could actually host your own website from your home connection on port 80? Dynamic DNS services, etc... ISPs put a quick end to that, though :(
  - rodgerd 9y ago
    I... still do? This is more about ISPs where you live than anything else. Most people don't want the hassle.
    - amatecha 9y ago
      Yeah, guess it varies, but a lot of ISPs block incoming port 80 connections. Common enough that noip.com has a "port redirection" feature, interestingly enough: http://www.noip.com/support/knowledgebase/my-isp-blocks-port-80-what-can-i-do/ http://www.noip.com/support/knowledgebase/my-isp-blocks-port...
  - __david__ 9y ago
    Not really. I still host a number of sites on my home linux box.
  - ungzd 9y ago
    Nowadays you need PAAS cloud hosting with Kubernetes on at least 3 servers, monitoring SAAS, log storage SAAS, CI for js transpilers, CDN for assets, Cloudflare, SSL certificate, checklist for PWA compliance, UX guidelines, AMP, OpenGraph metadata. Because best practices!
- Waterluvian 9y ago
  It was a really nice idea. I wonder how often it got used. I think it was a conceptual relic of the [Jeff Goldblum era](https://www.youtube.com/watch?v=dQmK1CnwOUI https://www.youtube.com/watch?v=dQmK1CnwOUI) of iMacs with instant Internet and personal webpages.
  - tomc1985 9y ago
thought_alarm 9y ago
I assume it's so that I can run Bugzilla on my laptop.
nvr219 9y ago
Right, I feel like anyone who would need apache on MacOS would know how to install it...

btgeekboy 9y ago

Apple sometimes distributes separate security updates, depending on the severity of the issue.