40 ms·
Freenginx: Core Nginx developer announces fork
- nimbius 3y ago>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.
- tiffanyh 3y agoThey could take the Postgres naming approach. Ingress was forked; the Post fork version of Ingress was called "Post"gres. So maybe name this new project "PostX" (for Post + nginx). Though that might sound too similar to posix.
- virtualwhys 3y ago"Postginx" has a nice ring to it, could be an alcoholic beverage, a name of a generation, or even a web server.
- diego_sandoval 3y agogintonx
- agateau 3y agoSounds like an character from the Asterix comic book :)
- icybox 3y ago... and postfix
- anotherhue 3y agoGo roman? nginxii ?
- bandie91 3y agoare we at the twelfth fork? :)
- Nijikokun 3y agoPostgres name is said to be a reference to ingres db, not a fork of ingres. > The INGRES relational database management system (DBMS) was implemented during 1975-1977 at the Univerisity of California. Since 1978 various prototype extensions have been made to support distributed databases [STON83a], ordered relations [STON83b], abstract data types [STON83c], and QUEL as a data type [STON84a]. In addition, we proposed but never prototyped a new application program interface [STON84b]. The University of California version of INGRES has been ‘‘hacked up enough’’ to make the inclusion of substantial new function extremely difficult. Another problem with continuing to extend the existing system is that many of our proposed ideas would be difficult to integrate into that system because of earlier design decisions. Consequently, we are building a new database system, called POSTGRES (POSTinGRES). [https://dsf.berkeley.edu/papers/ERL-M85-95.pdf https://dsf.berkeley.edu/papers/ERL-M85-95.pdf]
- tiffanyh 3y agoIsn't this a bit pedantic. Fork vs "hacked up [Ingress] enough ... Consequently, building a new database system" named Postgres.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- patrickmay 3y agonginy?
- austinjp 3y agoBump each letter in nginx and we get.... ohjoy!
- Silasdev 3y agoInsane find. Brilliant!!
- endofreach 3y agoDude, please, just create a fork & explain the name. ohjoy sounds perfect and the meaning is brilliant. This must be it.
- dystroy 3y agoThis might even look like enough a reason to spend the rest of their life maintaining it.
- yakshaving_jgt 3y agoJesus Christ. That’s incredible.
- skykooler 3y agoWow, that's perfect!
- 22c 3y agoThere was also a time where ng postfix was used to denote "next generation", so they could go with nginxng :)
- CodeWriter23 3y agoNot necessary. It’s not like F5 is going to go to Russia and file suit against any of them.
- osigurdson 3y agoMaybe not today, but one day they might. Better to start with a workable long term name.
- deleted 3y ago[deleted]
- thinkyfish 3y agoHow about EngineF?
- illusive4080 3y agoAnyone have more info about the changes nginx made?
- karolist 3y ago> Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Ah, I completely forgot F5 was involved in this, probably most of everyone else and F5 gets no money from this. Shouldn't matter to them, do they even have competition in enterprise load balancer space? I spent 9 years of my career managing these devices, they're rock solid and I remember some anecdotes about MS buying them by the truckloads. They should be able to cover someone working on nginx, maybe advertise it more for some OSS goodwill.
- SteveNuts 3y agoThe last two companies I've worked for have paid for Nginx+ since software LB is all we really need. Handling a few thousand RPS is nothing to nginx, and doesn't require fancy hardware. That said, it replaced Kemp load balancers, which it seems is the next biggest competitor in the hardware load balancer appliance space.
- downrightmike 3y agoAVI if you're using VMware already
- bkallus 3y agoI'm pretty sure that AVI just wraps Nginx, even though they claim otherwise. I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.
- karolist 3y agoThe world has moved on in the sense that "good enough" and cloud eats into their balance sheets I'm sure, but there's loads and loads of banks and legacy enterprises that maintain their ivory tower data centers and there's nothing to replace these with AFAIK. Google has Maglev, AWS perhaps something similar, MS no idea, everyone else just buys F5 or doesn't need it.
- pornel 3y agoI'm hoping the fork will allow having code comments.
- larodi 3y agoIs called "rage-fork" perhaps this. So proposed title: nginx dev rage-forks over security disagreement with boss company But then perhaps he also has every right to do it, even though AFAIR the original author was somebody else.
- water-your-self 3y agoWhy does the identity of the original author matter here?
- allanrbo 3y agoIn my opinion the original author did a really good job, so I found it interesting to know where and whether he might continue his vision. Edit: I see now from the hg history that Igor hasn't been coding on Nginx for a decade actually.
- larodi 3y agoIndeed, the original work done by single dev (Igor) to get the nginx project running was very impressive timewise, and as a volume of code produced. I can't really recall why he left, but with other comments around the thread implies such forks have happened more than once. As a sidenote I believe the people who start projects that they themselves run in excellent manner, should be praised, supported, noted and there is nothing more for their identities to matter. It very much matters some particular person with weird nick burntsushi created this wonderful tool rg, and kept growing it for long time. Besides, I can bet for projects such as Cosmopolitan C, it absolutely matters that jart started/did it.
- allanrbo 3y agoIgor, the original author, left in 2022 according to wikipedia: https://en.wikipedia.org/wiki/Igor_Sysoev https://en.wikipedia.org/wiki/Igor_Sysoev
- Kluggy 3y agoRage-fork doesn’t show up anywhere in their announcement, nor does it read like they’re doing something specifically out of rage. Everyone has a right to forking the project. Only time will tell if they get critical mass of developers to keep it going.
- system2 3y agoThere is no news other than this individual post. I wish he could describe it more. It says it is free but where is the github page for it?
- reactordev 3y agoThere's a world of software out there that's not on github or using git. "I don't always git clone, but when I do, it's hg clone"
- karolist 3y agoI have mixed feeling about github's dominance. They have created facebook for devs and uplifted collaboration of software to a high level, but I can't help but feel like I'm renting storage space in someone else's private shop when I use them. Yes you get engagement, yes you get one link to share your dev profile and timeline grid in CV, but it's a for profit business that is run by MS.
- mech422 3y ago>>I have mixed feeling about github's dominance. Yep - I remember what happened with Source Forge/VA Linux. I actually paid for github when it first came out, just to fund it. Still makes me nervous tbh
- karolist 3y agoGood old times, freshmeat.net also ;)
- cellularmitosis 3y agoI'm much less concerned with this because github seems to have to lowest vendor lock-in of any platform. If you want to switch platforms, it should be as easy as changing your upstream and push. Switching from MySpace to Facebook never looked like that.
- 3y ago
- caycep 3y agowondering also whether Igor and Maxim are ok, what w/ the geopolitical situation there.
- schneems 3y agoCan it un-swap the behavior of SIGTERM and SIGKILL please?
- tyingq 3y agoSwap SIGTERM and SIGQUIT behavior? I don't think you can catch SIGKILL.
- stefanos82 3y agoI don't get it...does not he knows about angie [1]? It was created by NGINX core devs after F5 acquisition if I'm not mistaken and it's a drop-in replacement for NGINX. [1] https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie
- bemusedthrow75 3y agoThis surely is the question. Why not Angie?
- sodality2 3y agoCould be related to the fact that Angie offers 'pro' version: https://wbsrv.ru/angie-pro/docs/en/ https://wbsrv.ru/angie-pro/docs/en/ From statement: "Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities"
- bemusedthrow75 3y agoHm. I guess this consultancy-on-a-paid-version model doesn't bother me (and clearly didn't bother the developer of freenginx while they were paying him). But a double fork can't be good.
- bklyn11201 3y agoI assume USA companies are by far the highest revenue source for Nginx Plus. Both of these forks seem to be based in Russia. How is a USA company supposed to pay either of these vendors for their consulting or Pro versions? How long until F5 submits requests for domain ownership of freenginx.org, and how quickly does Angie get takedown requests for their features that look remarkably similar to Nginx Plus features (e.g., the console)?
- pests 3y ago> features that look remarkably similar to Nginx Plus features (e.g., the console) Its illegal for products in the same space to have similar features?
- deleted 3y ago[deleted]
- nginxforks2402 3y agoThere is another fork already from some "ex-devs from the original team" https://angie.software/en/ https://angie.software/en/ https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie
- bklyn11201 3y agoThanks, I've never seen this fork mentioned before. This alone is compelling: "Simplifying configuration: the location directive can define several matching expressions at once, which enables combining blocks with shared settings."
- pests 3y agoAlso owned by a for-profit company who offers a pro version.
- spicykraken 3y agoGotta pay the bills somehow
- Rapzid 3y agoMaybe a coop of sorts could be formed where they pull in funds from sponsorships. A non-profit maybe. Devs could "lease" themselves to corporate sponsors and work on the project + some percentage time towards features they need. Sponsored development.. IDK could be a way to do it, pay the bills and some, and also limit the negative impacts public business or VC funded growth startup.
- HackerThemAll 3y agoThat doesn't work. For example Apple, benefiting from FreeBSD Foundation's work, never gave back any single penny to them, never sponsored any project within the Foundation. 1 million a year would mean a world to the Foundation, and would be less than a rounding error in Apple balance sheet.
- sevg 3y agoWorth noting that there are only two active "core" devs, Maxim Dounin (the OP) and Roman Arutyunyan. Maxim is the biggest contributor that is still active. Maxim and Roman account for basically 99% of current development. So this is a pretty impactful fork. It's not like one of 8 core devs or something. This is 50% of the team. Edit: Just noticed Sergey Kandaurov isn't listed on GitHub "contributors" because he doesn't have a GitHub account (my bad). So it's more like 33% of the team. Previous releases have been tagged by Maxim, but the latest (today's 1.25.4) was tagged by Sergey.
- sschueller 3y agoIs this what the security disagreements is about https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6M...?
- MZMegaZone 3y agoYep. Maxim did not want CVEs assigned.
- tptacek 3y agoMegaZone as in Usenet MegaZone?
- MZMegaZone 3y agoNo, a MegaZone. Haven't you heard, we come in six packs now. ;-) Yeah, very, very likely one and the same. Since 1989.
- tptacek 3y agoWow, that's a throwback. I was an ISP person back in the Portmaster era. You're at F5 now, I guess! Can you say more about the CVE thing? That seems like the opposite of what Maxim Dounin was saying.
- MZMegaZone 3y agoYeah, I've been with F5 since 2010 - gotta love those old PortMasters though, Livingston was good times, until Lucent took over. I was there 95-98. I don't know what else there is to say really. The QUIC/HTTP/3 vuln was found in NGINX OSS, which is also the basis for the commercial NGINX+ product. We looked at the issue and decided that, by our disclosure policies, we needed to assign a CVE and make a disclosure. And I was firmly in that camp - my personal motto is "Our customers cannot make informed decisions about their networks if we do not inform them." I fight for the users. Anyway, Maxim did not seem to agree with that position. There wasn't much debate about it - the policy was pretty clear and we said we're issuing a CVE. And this is the result as near I can tell. Honestly, anyone could have gone to a CNA and demanded a CVE and he would not have been able to stop it. That's how it works.
- ComputerGuru 3y agoThis isn’t just “a core nginx dev” — this is Maxim Dounin! He is nginx. I would consider putting his name in the title. (And if I were F5, I’d have given him anything he asked for to not leave, including concessions on product vision.) That said, I’m not sure how much leg he has to stand on for using the word nginx itself in the new product’s name and domain…
- amne 3y agoHe *is* nginx ? https://freenginx.org/hg/nginx https://freenginx.org/hg/nginx I don't see it. Sure, he contributes. But in the last 3-4 years he definitely does not look like he is nginx based on that log. Or am I looking in the wrong place?
- ComputerGuru 3y agoThere's something wrong with the list. It's ostensibly sorted reverse chronologically but scroll further and you'll see it go from 2020-03-03 to "9 months ago" and from there on it's all him.
- jcranmer 3y agoJudging from the graph view (https://freenginx.org/hg/nginx/graph https://freenginx.org/hg/nginx/graph), it has to do with the QUIC branch landing onto the main branch, suggesting he had little role in the QUIC development but heavy role outside of it.
- flawi 3y agoI think the mercurial log is not doing us any favors here, most of the first few pages is the history of the `quic` http/3 support branch which indeed Maxim is not working on. Scroll past it and he'll be much more prevalent. See for example the log of stable-1.24: https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac
- jbverschoor 3y agoAnd that's how 100x developers don't get the recognition they deserve.
- pbaam 3y agoWhat a coincidence, some days ago I was reading some HN posts related to lighttpd and I found [1]. The link is dead and it has inappropriate content, so use arhive.org. The author doesn't go too much in detail of why nginx being purchased is a problem, but in how to configure lighttpd. And the first comment predicts the hypothetical case of F5 being problematic. [1] https://news.ycombinator.com/item?id=19413901 https://news.ycombinator.com/item?id=19413901
- synergy20 3y agoI have been using lighttpd which can also host static content and do proxying, on top of those lighttpd supports cgi/fastcgi/etc out of the box as well, and it takes 4MB memory only by default at start, so it works for both low end embedded systems and large servers.
- nullify88 3y agoI've recently needed to build a docker image to run a static site. I compiled busybox with only it's httpd server. It runs with 300kb of ram with a scratch image and tini. I didn't compile in fastcgi support in to my build, but it can be enabled.
- synergy20 3y agoyes busybox httpd or civetweb is even smaller, both around 300kb. for tini you mean https://github.com/krallin/tini https://github.com/krallin/tini? how large is your final docker image, why not just alpine in that case which is musl+busybox
- nullify88 3y agoYep that tini. The docker image is about 1.90mb. It's a repack of https://homer-demo.netlify.app/ https://homer-demo.netlify.app/ I pre-gzipped a few of the compressible file extensions too so they can be served compressed. In this case, I didn't need alpine. I generally aim to get the image as minimal as possible without too much hassle. I end up doing stuff like this alot when I feel like a community image maybe too bloated when something like alpine or distroless can be used. Entry point scripts have all kinds of envars and a shell dependency, I'd rather rebuild the image to cater for my needs and execute the binary directly, and mount in any config via k8s.
- arter4 3y agoI admit I haven't followed closely this issue, but what is he talking about? >In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.
- MZMegaZone 3y agoWe (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.
- tky 3y agoThis seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?
- MZMegaZone 3y agoYes, those are the two CVEs I was referring to. All I know is he objected to our decision to assign CVEs, was not happy that we did, and the timing does not appear coincidental.
- mike_d 3y agoQUIC in Nginx is experimental and not enabled by default. I tend to agree with him here that a WIP codebase will have bugs that might have security implications, but they aren't CVE worthy.
- MZMegaZone 3y agoWe know a number of customers/users have the code in production, experimental or not. And that was part of decision process. The security advisories we published do state the feature is experimental. When in doubt, err on the side of doing the right thing for the users. I find that's the best approach. I don't consider CVE a bad thing - it shouldn't be treated like a scarlet letter to be avoided. It is a unique identifier that makes it easy to talk about a specific issue and get the word out to customers/users so they can protect themselves. And that's a good thing. The question I ask is "Why not assign a CVE?" You have to have a solid reason why not to do it, because of default is to assign and disclose. I don't think having the CVEs should reflect poorly on NGINX or Maxim. I'm sorry he feels the way he does, but I hold no ill will toward him and wish him success, seriously.
- qwertox 3y agoTime for me to slowly start looking for an alternative. There was a time when I wanted to move away from it and was eyeing HAProxy, but the lack of the ability to serve static files didn't convince me. Then there was Traefik, but I never looked too much into it, because Nginx is working just fine for me. My biggest hope was Cloudflare's Rust-based Pingora pre-announcement, which was then never published as Open Source. Now that I googled for the Pingora name I found Oxy, which might be Pingora? Googling for this yields > Although Pingora, another proxy server developed by us in Rust, shares some similarities with Oxy, it was intentionally designed as a separate proxy server with a different objective. Any non-Apache recommendations? It should be able to serve static files.
- pablopr3 3y agoMaybe take a look at Caddy (https://caddyserver.com/ https://caddyserver.com/)
- jbverschoor 3y agoWell, until you read https://news.ycombinator.com/item?id=39351026 https://news.ycombinator.com/item?id=39351026
- mholt 3y agoAnd? (That isn't about Caddy, rather a third-party plugin.)
- petecooper 3y agoPage won't load for me, Wayback Machine caught it: https://web.archive.org/web/20240214184151/https://mailman.nginx.org/pipermail/nginx-devel/2024-February/K5IC6VYO2PB7N4HRP2FUQIBIBCGP4WAU.html https://web.archive.org/web/20240214184151/https://mailman.n...
- petecooper 3y agoMailing list discussion: https://forum.nginx.org/read.php?2,299130 https://forum.nginx.org/read.php?2,299130
- 687m786m78 3y agoIt is scary to think about how much of web relies on projects maintained by 1 or 2 people.
- hadlock 3y agoThis is your semi-annual reminder to fork and archive offline copies of everything you use in your stack.
- Dylan16807 3y agoThere's plenty of copies of the code. That doesn't help with the actual problems with the setup.
- ironmagma 3y agoNot that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.
- yjftsjthsd-h 3y agoThat only helps if it stays static. For example, if the Linux TTY interface was unchanged for decades to such a degree that nobody worked on it, but then had a vulnerability, who would be able to fix it quickly?
- ironmagma 3y agoPerhaps someone with more knowledge can chime in. But, my impression is that there are vulnerabilities with TTY, it's just that we stay educated on what those are. And we build systems around it (e.g. SSH) that are secure enough to mitigate the effects of those issues.
- codetrotter 3y ago
- q2dg 3y agoJust use Apache
- jdoss 3y agoAs someone who used Apache 1.3.x through 2.x heavily from 2000 to 2015, I respectfully disagree with this statement. Nginx and Traefik are easier to configure, have better communities and in most cases perform better. Traefik Opensource is my go to for almost all of my use cases theses days and I have never stopped and said hmmm I wonder if Apache would do better here. It is that good.
- stop50 3y agoApacge still can't work as an reverse proxy for servers that utilize unix sockets.
- notsosubtle 3y agohttps://my.f5.com/manage/s/article/K59427339 https://my.f5.com/manage/s/article/K59427339 All F5 contributions to NGINX open source projects have been moved to other global locations. No code, either commercial or open source, is located in Russia. yeah, yeah
- BadHumans 3y agoTangent, but I got curious about contributing so I went to the Freenginx homepage, it looks like this project will be organized over mailing list. I would love if someone would create a product that gives mailing list a tolerable UI.
- fmajid 3y agoSourceHut? It’s a forge organized around an email rather than pull request workflow.
- dqv 3y agoHave you tried HyperKitty/Postorious? Does it get closer to what you would consider tolerable? https://mail.python.org/archives/list/mailman-users@python.org/ https://mail.python.org/archives/list/mailman-users@python.o...
- darkhorn 3y agoI don't understand why some people use a Russian software! Especially in this age.
- LinuxBender 3y agoIn some cases there are not great alternatives that fit the needs. I have not found anything that matches LFTP Using the mirror subsystem with SFTP and connecting to chroot SFTP servers. It replicates the behavior of rsync in a chroot SFTP-only environment. Only downside is that since there isn't a syncing daemon on the other side, directory enumeration is much slower. File transfers are exponentially faster however as it can do as many SFTP sessions as desired for batches of files or even one big file with the only limit being the bandwidth from client to server. For NGinx I have been able to make use of HAProxy and Apache just fine. Long ago Apache was slower than NGinx but ever since APR 1.7 and Apache 2.4 there are about the same performance wise. Some here don't like the configuration syntax but I am used to it.
- ijhuygft776 3y agoBecause they aren't short sighted like some others?
- WesolyKubeczek 3y agoWhile I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrains, for example. But there is also core-js which is a little polyfill library being used by like way more than half of high profile websites. Also written by a Russian national. If you excise all contributions by Russian nationals to PostgreSQL or the Linux kernel, they will be left in a not very runnable state, I’m afraid. On the other hand, it’s not like you are giving them money directly, unless you do; I also can see that in, say, both Linux and PostgreSQL there is also enough people from the “geopolitical opposition” so that even if the Russian contributors are asked by some stern people from the Apparat to sneak something backdoory in, it will be sniffed rather quickly and prevented from going much further. So tl;dr is that there is no simple response.
- 3y ago
- rdl 3y agoCurious how to support Maxim despite Russia complications.
- fareesh 3y agobitcoin solves this
- dmacvicar 3y agoIt seems every time I read about a project being forked, they use the (probably) trademarked name in the project's fork, just to need a rename a few weeks after.
- web3-is-a-scam 3y agoApache my beloved
- stop50 3y agoI only use apache on one server: as an dav server, since i could not find a simple dav server(nextcloud is for that already too much) and nginx as an frontend for that, since i use some servers with unix sockets which apache still doesn't support.
- davecheney 3y agoOh snap, F5 just Hudson’d themselves.
- chrisweekly 3y agoNote for some reason Maxim chose to link to http://freenginx.org http://freenginx.org, instead of https://freenginx.org https://freenginx.org
- deleted 3y ago[deleted]
- INTPenis 3y agoIf I ever need nginx I'll use freenginx. But funny enough all my services run in Traefik these days. 15 years ago Apache httpd was the norm, and lately nginx has been, and now I can't even think of a reason to use it.
- resolutebat 3y agoPer the discussion at https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312, this cryptic shade: > Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Refers to F5's decision to publish two vulnerabilities as CVEs, when Maxim did not want them to be published.
- fl0ki 3y agoGiven this fork still boasts a 2-clause BSD license, the corporate nginx can still make the effort to backport patches. It's certainly harder than requiring a single converged development branch, but how closely they track Maxim's work is ultimately up to them. If nginx continues to receive more attention from security researchers, I imagine Maxim will have good reasons to backport fixes the other way too, or at least benefit from the same disclosures even if he does prefer to write his own patches as things do diverge. Though history also shows that hostile forks rarely survive 6 months. They either get merged if they had enough marginal value, or abandoned outright if they didn't. Time will tell.
- WhyNotHugo 3y agoI'm curious to see where this fork will go. The whole situation is a mess: - nginx is "open core", with some useful features in the proprietary version. - angie (a fork by several core devs) has a CLA, which sounds like a bait and switch waiting to happen and distro's won't package it - freenginx is at least open source. But who knows if it'll still be around by June.
- spindle 3y agoFWIW, nixpkgs packages angie
- perlgeek 3y agoI remember being surprised by the open core thing some years ago. I had been an Apache user for quite some time, and thought I'd take a look at the (at that point, a few years old) "new" shiny thing. I found that something as simple as LDAP authentication required a payed plugin; a free Apache module has been available for this for ages. That made nginx a non-starter for this particular use case. I wonder if the fork will accumulate free plugins for things that the old core required payed plugins for, slowly eroding their business case.
- nly 3y agoMost of this simple premium features/plugins were probably funded by companies because they had business value. It's probably unlikely freenginx will re-create them without those contracts. Unpaid Open Source developers tend to focus on interesting/cool core stuff and ignore all the stuff businesses care about (like LDAP authentication).
- thomasjudge 3y agoHow the heck am I supposed to pronounce that? "Free-en-gen-icks"?
- 000ooo000 3y agoFreen Ginks
- lyu07282 3y agoseems like an annoying but necessary thing, so lets give the original a quick death and migrate to freenginx Infrastructure like that should not be run by for-profit corporations anyway, it will always end up like in this case sooner or later
- darylteo 3y agoF5 closing moscow office: Is this a result of US sanctions?
- nginxsjsjn 3y agoWell maybe this core dev can impact some better malware into it and update the defaults. Nginx loves to pretend it’s 1995. It barely has http3 support and does insanely stupid things by default. No wonder people move to haproxy, Traefik, caddy, etc. Cloudflare doesn’t use it anymore for good reason.
- webprofusion 3y agoOne of the most heavily used Russian software projects on the internet https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-nginx/ https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-n... but it's only marginally more modern than Apache httpd. In light of recently announced nginx memory-safety vulnerabilities I'd suggest migrating to Caddy https://caddyserver.com/ https://caddyserver.com/
- andrewstuart 3y agoAfter using Nginx for something like 15 years I dropped it a couple of years ago. Using Caddy instead. A point came where I realised I didn't enjoy Nginx. Configuring it was hard and it felt brittle. A particular pain point is certificates/ssl. I absolutely dreaded doing anything with certificates in Nginx. When I heard that Caddy automatically handles SSL/ certificates I jumped the nginx ship and swam as fast as I could to Caddy.
- someoneinworld 3y agoJust curious how do folks make a living with free contributions not associated to any company? Is it sponsorships or they do some contract work on the side ? It feels these devs are soo underappreciated for the tremendous work they do, so much in software is supported on so many of these projects and companies dont sponsor or do the right thing !
- snizovtsev 3y agoLiving in Russia could be very cheap compared to other countries. If you own a flat and you don't need cars or travel, then it's possible to live a few years just on money saved from your previous software job.
- someoneinworld 3y agoBut its still seems like a massive system failure which cant help folks who have built that is used by so many industries.
- Vosporos 3y agoGodspeed
- udev4096 3y agoJudging from the comments of the guy from F5, it seems that Maxim didn't wanna assign a CVE to the latest vulns. I wonder why
- SomeoneFromCA 3y agoNGINX are FSBs shills.
- apatheticonion 3y agoMy biggest gripe as an internet keyboard warrior with an opinion is not being able to understand the source control and build process of Nginx. Probably a skill issue but when I last tried to compile Nginx from the Github mirror I spent hours trying to figure it out. I wish there was a GitHub page with an easy to understand build process... and that I could just run "cargo build --release" lol
- scandox 3y ago./configure make make install I just ran this to be sure I wasn't delusional and it took only 2 minutes.
- apatheticonion 3y agoReally? https://github.com/nginx/nginx/tree/branches/stable-1.24 https://github.com/nginx/nginx/tree/branches/stable-1.24 I cloned this and it doesn't have a makefile or configure script Neither does the official repo? https://hg.nginx.org/nginx/file/tip https://hg.nginx.org/nginx/file/tip Do you run it from /auto/?
- seunosewa 3y agoI hope he implements the least connection load balancing option for free users.
- aaroninsf 3y agoDissatisfaction, like water, will always find its level.
- deleted 3y ago[deleted]
- aftbit 3y agoI dunno seems like a tempest in a teapot. Not sure why Maxim would not want CVEs to be assigned to something. Maybe it was just the final straw after a series of bad interactions. Every project has a lifespan, sometimes trying to keep them going forever is not the answer. I will miss nginx a lot if I need to migrate though.
- mistrial9 3y agono - the CVE process is at the center of new broad laws in the EU regarding business registration and security assurances. You are exactly wrong about the significance of this fork, basically. see EU CRA
- DeathArrow 3y agoI hope some people will find the time to help him.
- liveoneggs 3y agoThis fork should use the Apache Foundation for its hosting and things.
- deleted 3y ago[deleted]
- soupbowl 3y agoDid we find out why the dev of freenginx did not want the nginx CVE that caused this fork? Some contex would be nice as it seems like a weird reason to fork.
- SushiHippie 3y agohttps://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312
- gertrunde 3y agoIIRC from reading the post, the reasoning was that the bug was in a feature which was marked as experimental (HTTP/3).
- robgibbons 3y agoIt was already mentioned in the other thread, but it looks like F5 owns the trademark for the Nginx name. Maxim should consider rebranding the project to avoid any legal blowback.
- austinjp 3y agoAs I suggested elsewhere [0] if you bump each letter in nginx you get... ohjoy! [0] https://news.ycombinator.com/item?id=39376657 https://news.ycombinator.com/item?id=39376657
- RamRodification 3y agoFun but bad!
- temp0826 3y agoI feel like scrambling the letters to "ginnx" (pronounced jinx?) or something might be better.
- scrps 3y agoBravo!
- not_a_dane 3y agoJust looking at comments here makes me feel like this is pretty much underrated.
- lnxg33k1 3y agoInnovation is being kept hostage by MBAs, marketing, PR and recruiters
- frikkie444 3y agoF5 is spinning this to be about not disclosing CVE's when the truth is more that the experimental code that was flagged was not considered production ready and whomever is running it should know they are on their own. This CVE is an obvious bug, and when your KPI is CVE's per month every bug looks like a CVE F5 wants this feature prioritized over what Maxim planned, and Maxim doesn't have to comply, he is a volunteer.
- Reelix 3y agoSo - The big question... Is the fork going to allow you to change the nginx Server response header (A PAID feature in the current fork...) without requiring you to mod it in and recompile it? :p Yes - You read that correctly. They refuse to accept PR's to add additional functionality because that functionality is restricted to the paid version :p
- egberts1 3y agoI stop using Nginx when i needed ability to assign an Ethernet port (IP address not yet available) and Nginx developers refused to do this. Before you ask why would I do that, Ive got all Ethernet interfaces on dynamically IP created on a on-demand basis and only wanted ONE specific interface (non-public) to host the HTTP/HTTPS protocol. And no, we do not want to jerry-rig some fancy nginx config file shell -script updater whenever an IP address gets assigned/reassigned. Here came lighthttpd and Apache to the rescue.
- devosalain 3y agoIs F5 trying to kill the original nginx. [Cfr hostile take-overs of Microsoft]