10 ms·

Overview of new features in Apache HTTP Server 2.6

79 points by based2 5y ago

chrsig 5y ago
kind of weird to see this posted -- it's not a release announcement. Just some change notes from trunk (you can see on the page it's still versioned 2.5) It does look like they've added a few nice little features (i wonder if per listen options means we'd be able to listen on a unix socket?)
- duskwuff 5y ago
  > Just some change notes from trunk (you can see on the page it's still versioned 2.5) The Apache httpd project uses even/odd versioning, much like the Linux kernel. 2.5 is the development branch for 2.6.
- throw0101a 5y ago
  Further it's in the French ("fr") part of the tree so some of the links to go the translated page. Versus: * https://httpd.apache.org/docs/trunk/en/new_features_2_6.html https://httpd.apache.org/docs/trunk/en/new_features_2_6.html Or just: * https://httpd.apache.org/docs/trunk/new_features_2_6.html https://httpd.apache.org/docs/trunk/new_features_2_6.html
codewiz 5y ago
And where is HTTP/3?
- capableweb 5y ago
  The right question would be: "Does Apache support HTTP/3?" and the answer would be: "No".
  - codewiz 5y ago
    To be fair, neither does Nginx, at the moment. But they've been working on it for some time: https://www.nginx.com/blog/our-roadmap-quic-http-3-support-nginx/ https://www.nginx.com/blog/our-roadmap-quic-http-3-support-n...
  - kiwijamo 5y ago
    Another question would be "Should Apache support HTTP/3?". Personally I'm happy with the status quo and would need some convincing that it's worth turning on a new protocol.
davidgerard 5y ago
How is Apache as an SSL terminator on 2.6? 2.4 failed hard on me when I had a popular blog post, and I switched to nginx.
HNTA_1 5y ago
It's been an interesting ride the past few years as a software engineering manager: many junior engineers have never developed or deployed anything that requires Apache httpd. Some have never even heard of it, or seen it in the wild.
- orf 5y ago
  Is that unexpected?
  - rbanffy 5y ago
    Well… I was a bit surprised to find a Teams group about VMS application support in my company… perhaps I shouldn’t. After all, we also have a lot of IBM mainframes being used too and, most likely, other exotic stuff in areas I don’t even know about that exist way above my security clearance.
  - HNTA_1 5y ago
    Considering it still runs a large percentage of the WWW, I would say it is a bit unexpected.
- alexpotato 5y ago
  I've seen a similar effect with web design. EVERY page (or site) seems to need a full blown NodeJS server install and tons of React/Vue etc. Younger folks are blown away at how quickly I can develop a fully functional site with just Flask, good ole' HTML, basic CSS and VanillaJS using only a couple flat files as a backend database. I could make a similar argument about complex Python or Golang scripts that are basically the equivalent of multiple bash commands piped into a one liner.
  - dreyfan 5y ago
    The toolchains to build and deploy a completely static site today are about 10x more complex than a fully dynamic python/ruby/php site a decade or two ago. I genuinely don’t understand it.
rbanffy 5y ago
What are current use cases for Apache where it is a better choice than, say, Nginx?
- _-david-_ 5y ago
  As far as I know Nginx doesn't have the equivalent of an htaccess. This can be quite beneficial for shared hosting.
  - pstuart 5y ago
    https://www.nginx.com/resources/wiki/start/topics/examples/likeapache-htaccess/ https://www.nginx.com/resources/wiki/start/topics/examples/l...
    - RhodesianHunter 5y ago
      Surely that's not true and the maintainers of Apache understand caching?
      - duskwuff 5y ago
        It's true. If .htaccess is enabled (AllowOverride not set to None), Apache httpd will search for them and parse them on every request. For most use cases, this is honestly fine; it only becomes an issue for very high traffic sites.
        vlovich123 5y ago
        Huh. I’m surprised they don’t use fs events to watch for changes rather than doing fs I/O in the critical path.
        duskwuff 5y ago
        FS events are OS dependent, don't always work (e.g. on network volumes), and often have a limited number of "watches" available which could easily be exhausted by deep, complex directory structures.
josephcsible 5y ago
You linked to the French version of this page instead of the English version. Since this page itself isn't translated yet, you don't notice on it, but if you click any of the links on it, you'll end up on pages that actually are French.
egberts1 5y ago
Wut? Still no enhanced error code messages for improper use of `.htaccess` files? (sigh)
jagger27 5y ago
> The htpasswd utility can now generate SHA-256 or SHA-512 crypt() hashes where supported by the C library. Oh god, it didn’t have SHA-256 support before today? Was it using MD5 and SHA-1? I knew basic auth was weak but jeez.
- arpa 5y ago
  it had bcrypt.
  - jagger27 5y ago
    Oh good.
rangoon626 5y ago
Httpd is my favorite. So many features and flexibility make it highly satisfying.
szastamasta 5y ago
Looking at the release docs it’s a smallish release. But I’m very happy something is still going on there. HTTPD has been my go to web server for years and I had used it so many times in production as a proxy/gateway. Always reliable. I know that everyone uses nginx now and that in the end it has more scalable - event based architecture. But for my scale httpd was never a bottleneck. It’s just like an “old friend” you can always rely on.
- alserio 5y ago
  HTTPD has had mpm_worker and mpm_event since a long time
Tsiklon 5y ago
I’ve always had a soft spot for Apache httpd, Something about it’s configuration syntax i can grok a little easier than Nginx. I look forward to testing 2.6 out!

79 points by based2 5y ago

kind of weird to see this posted -- it's not a release announcement. Just some change notes from trunk (you can see on the page it's still versioned 2.5) It does look like they've added a few nice little features (i wonder if per listen options means we'd be able to listen on a unix socket?)

duskwuff 5y ago
> Just some change notes from trunk (you can see on the page it's still versioned 2.5) The Apache httpd project uses even/odd versioning, much like the Linux kernel. 2.5 is the development branch for 2.6.
throw0101a 5y ago
Further it's in the French ("fr") part of the tree so some of the links to go the translated page. Versus: * https://httpd.apache.org/docs/trunk/en/new_features_2_6.html https://httpd.apache.org/docs/trunk/en/new_features_2_6.html Or just: * https://httpd.apache.org/docs/trunk/new_features_2_6.html https://httpd.apache.org/docs/trunk/new_features_2_6.html

codewiz 5y ago

And where is HTTP/3?

capableweb 5y ago
The right question would be: "Does Apache support HTTP/3?" and the answer would be: "No".
- codewiz 5y ago
  To be fair, neither does Nginx, at the moment. But they've been working on it for some time: https://www.nginx.com/blog/our-roadmap-quic-http-3-support-nginx/ https://www.nginx.com/blog/our-roadmap-quic-http-3-support-n...
- kiwijamo 5y ago
  Another question would be "Should Apache support HTTP/3?". Personally I'm happy with the status quo and would need some convincing that it's worth turning on a new protocol.

davidgerard 5y ago

How is Apache as an SSL terminator on 2.6? 2.4 failed hard on me when I had a popular blog post, and I switched to nginx.

HNTA_1 5y ago

It's been an interesting ride the past few years as a software engineering manager: many junior engineers have never developed or deployed anything that requires Apache httpd. Some have never even heard of it, or seen it in the wild.

orf 5y ago
Is that unexpected?
- rbanffy 5y ago
  Well… I was a bit surprised to find a Teams group about VMS application support in my company… perhaps I shouldn’t. After all, we also have a lot of IBM mainframes being used too and, most likely, other exotic stuff in areas I don’t even know about that exist way above my security clearance.
- HNTA_1 5y ago
  Considering it still runs a large percentage of the WWW, I would say it is a bit unexpected.
alexpotato 5y ago
I've seen a similar effect with web design. EVERY page (or site) seems to need a full blown NodeJS server install and tons of React/Vue etc. Younger folks are blown away at how quickly I can develop a fully functional site with just Flask, good ole' HTML, basic CSS and VanillaJS using only a couple flat files as a backend database. I could make a similar argument about complex Python or Golang scripts that are basically the equivalent of multiple bash commands piped into a one liner.
- dreyfan 5y ago
  The toolchains to build and deploy a completely static site today are about 10x more complex than a fully dynamic python/ruby/php site a decade or two ago. I genuinely don’t understand it.

rbanffy 5y ago

What are current use cases for Apache where it is a better choice than, say, Nginx?

_-david-_ 5y ago
As far as I know Nginx doesn't have the equivalent of an htaccess. This can be quite beneficial for shared hosting.
- pstuart 5y ago
  https://www.nginx.com/resources/wiki/start/topics/examples/likeapache-htaccess/ https://www.nginx.com/resources/wiki/start/topics/examples/l...
  - RhodesianHunter 5y ago
    Surely that's not true and the maintainers of Apache understand caching?
    - duskwuff 5y ago
      It's true. If .htaccess is enabled (AllowOverride not set to None), Apache httpd will search for them and parse them on every request. For most use cases, this is honestly fine; it only becomes an issue for very high traffic sites.
      - vlovich123 5y ago
        Huh. I’m surprised they don’t use fs events to watch for changes rather than doing fs I/O in the critical path.
        duskwuff 5y ago
        FS events are OS dependent, don't always work (e.g. on network volumes), and often have a limited number of "watches" available which could easily be exhausted by deep, complex directory structures.

josephcsible 5y ago

You linked to the French version of this page instead of the English version. Since this page itself isn't translated yet, you don't notice on it, but if you click any of the links on it, you'll end up on pages that actually are French.

egberts1 5y ago

Wut? Still no enhanced error code messages for improper use of `.htaccess` files? (sigh)

jagger27 5y ago

> The htpasswd utility can now generate SHA-256 or SHA-512 crypt() hashes where supported by the C library. Oh god, it didn’t have SHA-256 support before today? Was it using MD5 and SHA-1? I knew basic auth was weak but jeez.

arpa 5y ago
it had bcrypt.
- jagger27 5y ago
  Oh good.

rangoon626 5y ago

Httpd is my favorite. So many features and flexibility make it highly satisfying.

szastamasta 5y ago

Looking at the release docs it’s a smallish release. But I’m very happy something is still going on there. HTTPD has been my go to web server for years and I had used it so many times in production as a proxy/gateway. Always reliable. I know that everyone uses nginx now and that in the end it has more scalable - event based architecture. But for my scale httpd was never a bottleneck. It’s just like an “old friend” you can always rely on.

alserio 5y ago
HTTPD has had mpm_worker and mpm_event since a long time

Tsiklon 5y ago

I’ve always had a soft spot for Apache httpd, Something about it’s configuration syntax i can grok a little easier than Nginx. I look forward to testing 2.6 out!