15 ms·
The long life of Apache httpd 2.4
- chungy 3y agoWith the continual feature additions in the 2.4.x series, I dare say the project fell into a versioning slump like Linux had in the 2.6.x series. Rather than being a fixed set, instead it was continually evolving, and Apache's "2.4" prefix on version numbers is effectively just as meaningless at this point. It could probably replicate Linux's solution to this and stop fixing "major" version numbers. Make the next release 3.0, then 3.1, and so forth. And every so often, bump that first part so it's not on "3." forever either.
- Ygg2 3y agoWhy though? If it's obeying semver ideally you want to be on 2.4 forever.
- chungy 3y agoThe feature additions already say it's not obeying semver. They could adopt it, but that'll mean the next release is 2.5, and if a feature is added, 2.6 after that.
- exmadscientist 3y agoInterestingly, Apache is roughly twice as old as SemVer (dating SemVer using the Wayback Machine looking at semver.org). I'd have guessed SemVer was younger than that, but time is weird. Incidentally, that means that Apache is not, in fact, using SemVer. They're using the old-school even-odd system.
- secondcoming 3y agoVersion numbers and how they’re used have been around long before someone decided to make a webpage about them and claim some sort of paradigm shift.
- hnlmorg 3y agoWhile that’s true, the GP is right that semantic versioning is a relatively recent term and a lot of older projects followed a principle of odd numbers being development versions with even numbers being stable releases (Apache 2.3 vs 2.4, PHP used to follow this, Linux kernel used to too, eg 2.4, 2.6). The x number (in x.y.z) was still used to denote a major upgrade but jumps between y were usually considered breaking changes too. It’s also worth noting that it used to be common to have 4 sets of numbers, x.y.z.n with n being automatic build numbers. Lastly, there’s still another common trend to have version numbers based on release date. Ubuntu do this, for example. I personally quite like this approach as it communicates a little more than just a release version. For internal projects I often go even further and recommend a git hash included as part of the release version. So yes, versioning schemes are older than the web. However agreed standards in how to use version numbers have always varied a significantly (and still do now). And the Apache httpd project does predate the rise in popularity of semantic versioning.
- ilyt 3y agoI'm not a fan of year numbers being the first number. Stick it at end with git hash IMO. I do like when first number change signals need to read the changelog (as in "backward-incompatible changes"). Semver or not.
- hnlmorg 3y agoIt depends on what piece of software your version numbering though. Semver is great for APIs but doesn’t have as compelling strengths for standalone applications, distributions of packages nor operating systems since what constitutes as a “breaking change” becomes harder to define. For something like Ubuntu, signalling the age of a release to end users is more valuable than following semver strictly (not to mention that the patch part of semver wouldn’t even apply). Whereas if your software is being consumed by other software, such as an API, then you need to communicate where interfaces might change in ways that are verifiable via other software interfaces. So it really depends on who is consuming your software interface. You might even want multiple different version schemes for different parts of your application. You’ll sometimes see applications have one versioning scheme for their end user facing interface while their developer APIs, which are still bundled as part of their application, might follow another. Going back to the original point about dates as version numbers, the biggest appeal for me is it takes human error out of the equation. I’ve lost track of the number of companies I have joined which were very good at supporting versioning but terrible at remembering to increment that version number. So having a system which can auto-increment version numbers takes one problem away from developers. And if you’re auto-incrementing private packages then the question becomes: “how strictly are you now following semver?” At which point you might as well have a timestamp and then have the bonus feature of communicating to your team when a specific build was committed. I don’t think there is a right or wrong way to do these things though. You just need to pick a standard, document it and be committed to following it.
- brianm 3y agoApache uses [APR Versioning](https://apr.apache.org/versioning.html https://apr.apache.org/versioning.html) which I think had a big influence on semver, fwiw
- yjftsjthsd-h 3y agoNo, if it was semver we'd be on 2.x forever - but apache does regularly get new features, so it'd probably be 2.35 or something by now.
- pmontra 3y agoThat would signal "we are alive." Does it have any other practical purpose? On the other side, who remembers the version of Chrome, Firefox, Thunderbird or even the Linux kernel since they started moving fast? They basically become versionless, we just upgrade to the latest one prompted to us by their autoupdates or by the OS.
- MeteorMarc 3y agoDid they deprecate and later remove any of the mod API features within the 2.4 branch as well?
- Energiesustaine 3y agoReally unfortunate. As far as benchmarks go, nginx is much faster using less memory. Apache2 could save energy on the scale it is still used. I stopped using it for 7 years now
- deleted 3y ago[deleted]
- idoubtit 3y agoWhat's missing from this history is the origins of Apache httpd 2.4: as I see it, circa 2009 Nginx started growing. Apache's market share was like fresh snow under foehn (from 75% at this time down to 20% today). Nginx was much more performant and its configuration was saner. Apache had to change or it would gradually disappear. Another note on this 10 years anniversary is that, though Apache 2.4 was released in 2012-01, it was a rushed release and some features were still lacking. In my opinion, the most important was that mod_proxy could not talk to unix sockets. It made Apache 2.4 hard to use in many cases. This feature only appeared with 2.4.7 in 2013-09. Nowadays I rarely see Apache installed on web servers that I work with. In one case, it was because the sysadmin was used to it (though 2.4 broke the compatibility with 2.2's config syntax), he didn't consider changing and even kept the awful Apache prefork engine. In other cases, it was because of some modules (e.g. shibboleth) that were packaged by the OS for Apache, but not for Nginx.
- tempestn 3y agoIs nginx still considerably more performant than Apache when both are configured well? (IE. Using mpm_event, not needlessly recycling processes, using mostly threads for concurrency, etc.?) I'm one of those who always just stuck with Apache because 1) I'm used to it, and 2) it's never been close to a bottleneck in our stack. Especially now that the vast majority of static content requests don't even hit the servers at all. Buy I am curious! I haven't looked at comparisons in years, but last I did, everyone liked to compare nginx to prefork Apache, which is pointless.
- water9 3y agoHAProxy is faster than both of them for load balancing. Apache is slightly faster for static content. Nginx has more responsiveness under high load than Apache for dynamic content (Hence Tomcat workers for example)
- tempestn 3y agoIs that true even if you configure Apache to use a static number of processes? IE set startservers equal to serverlimit and maxsparethreads equal to maxrequestworkers? IME that allows Apache to respond to load spikes more quickly. But is the issue with high load and dynamic content specifically related more to connecting to the process manager for the scripting language? (I take the same approach there, using a static pool of processes. Haven't had any issues, but have no way of knowing if nginx might be even faster!)
- macropin 3y agoThe only thing keeping Apache alive today is the need to support .htaccess files for PHP apps like WordPress and the like. For every other use case there are better alternatives.
- RedShift1 3y agoI still use Apache httpd, I see no reason to change. It's a solid workhorse, I know it's not trendy anymore but I have yet to find anyone who left a website because it was served by httpd...
- cies 3y agoAdmins leave Apache, usually because the config language is so arcane, sometimes because they are attracted by better performing solutions.
- Nux 3y agoI prefer the config syntax to nginx'. Probably because I'm so used to it.
- nurettin 3y agotrying to construct logical statements using [N,L] stuff is sometimes mind-bending and sometimes plain impossible.
- rascul 3y agoThe config language isn't so arcane, and Apache can perform on par with Nginx in a number of cases nowadays.
- jacooper 3y agoCaddyfiles ftw, best webserver config syntax ever
- cies 3y agoAgreed. Certainly up a big notch from Nginx.
- nologic01 3y agoWhile no longer dominant, httpd seems to have consolidated a stable and significant base [1]. [1] https://w3techs.com/technologies/history_overview/web_server/ms/y https://w3techs.com/technologies/history_overview/web_server...
- nailer 3y agoHa, I remember the days where Apache was one of the poster childs of open source along with Mozilla. Meanwhile nginx was the authors own homepage, complete with hammers and sickles, with a personal anecdote about how he read the c10k paper (describing how you should have 10,000 connections on a Pentium III ) and decided to use nonblocking io make a fast Web server. Nowadays nginx is the safe choice and Apache is seen as a little bit old hat.
- mnot 3y agoSafe choice - why? My experience is that it has lots of non-conformant, weird little behaviors.
- ilyt 3y agoYou could say same about both of them. Like how example in Apache ordering of vhosts doesn't matter, except for choosing the default vhosts
- rascul 3y agoThe order matters in Nginx also in certain cases.
- Kamq 3y ago> non-conformant Non-conformant to what? Is it following a spec somewhere?
- nailer 3y agoI mean, yes, there is an HTTP1, 1.1 and 2 spec, gzip spec, brotli spec, mime types, tls 1, 1.1, 1.2, and 1.3, quic spec, sni spec, but I did not bother replying as the grandparent comment hasn’t given any detail.
- Kamq 3y agoOh derp. Yeah I could see that being an issue. My brain's shot and I thought they were talking about some sort of server spec (not sure for what? conig? request handling?)
- awestroke 3y agoI've used nginx for a long time, but for the last few years I've been using Caddy for my projects. So easy to set up, easier configs and automatic tls certificates via letsencrypt
- 5e92cb50239222b 3y agoIt has also been the first to gain HTTP/3 support. nginx still has some beta-quality branches which must be compiled manually and will be shipped to mainline god knows when. (Yes, HTTP/3 is noticeably faster on crappy high-latency networks, some of us do need that.)
- djigrucst 3y agoarticle is nonsense. yeah, there was a huge push for a breaking change from 2.2 to 2.4, but it was very well thought out. proof is that we had 10 years of security and features and nobody even noticed while updating. that's actually great. and apache can keep with ngix without breaking a sweat if you know what you're doing. the fact ngix took over apache metrics overnight is because few people know what they are doing, and while keeping apache, put ngix in front back in the days. also nowadays every language packs their own server, which learn all the old lessons again, slowly...
- 2342342343636 3y agoIt would be a great application server, if only it supported non-blocking IO and the handling of multiple requests simultaneously with each worker thread. Instead the event MPM is basically the worker MPM (thread-per-connection) with dedicated epoll/kqueue-based listener threads in front, but otherwise synchronous.
- zzzeek 3y agoim sure nginx and whatever have way more elaborate performance features and integrations than apache, but i have never once used anything besides apache for production web serving. I've been using it for 25 years, I know everything I need to know about it, and for performance, since I'm not serving Google, there's never been any issue. I use the event mpm for static sites on Linode nanos (1 CPU / 1G virtual machine...tiny) and such a site has no problem with hacker news front page traffic.
- what-no-tests 3y ago20 years ago, Microsoft made a large donation to the Apache foundation. I declared that it would be the end of innovation in httpd. Microsoft, at the time, was making big moves in IIS in support of then-new ASP.NET web framework. Although there was so much that could have been done to improve the DX/UX of Apache httpd, it stopped moving ahead, and the OSS community fragmented into nginx, lighttpd and others - often losing velocity because of the need to not only achieve feature parity with what httpd offered already, but also the slew of CVEs security issues that cropped up again and again as the Internet grew exponentially during that period as more people went from dialup to broadband, then into mobile.
- 404mm 3y agoWhat are some web servers suitable for use in containers? I’ve been using httpd or nginx but the images tend to be a bit bloated because it usually comes built on top of a distro. Are there any leaner alternatives?
- jgalt212 3y agoAnother comment along these lines was [killed], but I'll attempt to take a more diplomatic approach. Nginx is a Russian (in its inception) product. The reason one should not be worried about this (as one is worried about Kaspersky products) is that Nginx is open source. Do I have this right?