8 ms·

Freenginx: Core Nginx Developer Announces Fork of Popular Web Server

136 points by kungfudoi 3y ago

qwertox 3y ago
Discussed previously Freenginx: Core Nginx developer announces fork https://news.ycombinator.com/item?id=39373327 https://news.ycombinator.com/item?id=39373327 2024-02-14, 475 comments
roschdal 3y ago
Excellent, I wish this project success!
- yesbut 3y ago
  Absolutely. This is great news.
murkt 3y ago
[flagged]
- jesprenj 3y ago
  What?
  - tetris11 3y ago
    he might he referring to Angie, a fork of Nginx after a bunch of Russian software devs were fired from F5. I guess there were implications there.
RedShift1 3y ago
I'm glad I stuck with Apache httpd whilst everyone was moving to nginx. None of this drama with httpd.
- tetris11 3y ago
  I'm having a great time with Caddy. My whole Jupyter stack is reverse proxied to Caddy, and the Caddy config is a single line compared to the 100 line mess that they reccomend people use for Apache or nginx (yes caddy takes care of upgrading your headers, websockets, certificates, all of it)
  - infofarmer 3y ago
    once you actually need to configure Caddy, it is an abomination beyond imagination — the docs, Caddyfile, JSON config — all of them lack coherence or sensible design never touching it again good defaults matter; nginx configs were very concise and readable in 2005-2015 when I was using it heavily; http/3, ws, acme — perhaps new tech is yet to be incorporated properly (and maybe it never will)
    - tetris11 3y ago
      I genuinely haven't had a problem with it -- I use it for all my projects, and it's seamless at rewriting baseurls handling subdomains, proxies, all of it.
- citrin_ru 3y ago
  A fork is not necessary bad for users. Nginx is already a great product and I believe both Nginx Inc version and freenginx will not become worse over the time. Likely they would gain different features, will have different release schedules e. t. c.
- blowski 3y ago
  Is it that much of a drama? Seems more like this is the whole selling point of open source - if you don't like something, you fork it, and people can vote with their installations. This kind of stuff happens all the time in private companies, but we as users have much less influence over the outcome.
- Joel_Mckay 3y ago
  Apache needs slowloris mitigation, and a dozen other tweaks to get it secure (mpm-itk, fail2ban rules, and anti-spammer mods etc.) It can be good, but most people run the vanilla install. Sometimes it is the only solution... ;-) However, Nginx gets over 20% more concurrent users per host... Hence the main reason people put up with its lack of features and silly HA design. Forks can be healthy, but it usually quickly degrades into a competition for users. Hope everyone has fun =)
gudzpoz 3y ago
> “Nginx is an incredible software and platform, but I was wondering if it wouldn't be time to just bite the bullet and create a more modern solution based on Rust.” I actually don't understand why I am seeing arguments like this all the time. Rewrite takes time and effort. It may be OK for new projects. But for a mature project that has a quarter million lines of code and load-tested for cross-platform compatibility and security, it is way more than "just biting the bullet". (Not to mention that memory safety in Rust is ... still improvable. [1]) Rust is not a panacea. [2] When a corporate tries to seize control of a open source project, some one (or some entity?) has to do something, and rewriting in Rust by no means reclaims the freedom and openness of the project. [1] https://news.ycombinator.com/item?id=39440808 https://news.ycombinator.com/item?id=39440808 [2] https://ariadne.space/2023/12/07/most-breaches-actually-begin-in-corp/ https://ariadne.space/2023/12/07/most-breaches-actually-begi...
- jhgb 3y ago
  Is it a rewrite...or a completely new piece of software that simply takes the NginX experience into consideration when designing its features?
  - wccrawford 3y ago
    The blogger keeps saying "Fork", but I can't find anything from the actual developer that says that. Instead, they keep saying it's a new project and that it "understands the nginx configuration language". So I think it's pretty clear that it's not a fork. To add to the confusion, it seems like they copied the site with all the bug reports as-is, which obviously would only apply to a fork, not to a project that hasn't even got any code yet.
    - rascul 3y ago
      A quick glance at the commit log (or whatever it's called for mercurial) makes it look like a fork to me, but so far not much more beside name changing. http://freenginx.org/hg/nginx/ http://freenginx.org/hg/nginx/ https://hg.nginx.org/nginx https://hg.nginx.org/nginx
technion 3y ago
I know its early days but I think it's really broken to directly copy the upstream website, and impacts on how usable the product appears. For example, https://freenginx.org/en/security_advisories.html https://freenginx.org/en/security_advisories.html states "All nginx security issues should be reported to security-alert@freenginx.org." and then has a complete history of bugs from prior to the fork (and thus were never freenginx issues).
- creatonez 3y ago
  > For example, https://freenginx.org/en/security_advisories.html https://freenginx.org/en/security_advisories.html states "All nginx security issues should be reported to security-alert@freenginx.org." and then has a complete history of bugs from prior to the fork (and thus were never freenginx issues). What exactly to display on the security advisories page on a brand new fork project with no vulnerabilities yet seems like it could be a particularly hairy problem. You want users to visit the page and see the schema of information they would get in a security advisory, so they are prepared to use the website if they need to. So you could display an example advisory if none are available. But at that point it would be easier to keep the old advisories, because they also help to inform users on why they should upgrade from pre-fork versions.
- jtc331 3y ago
  Because it’s a fork those issues were in fact issues with freenginx IMO.
tinco 3y ago
Now that pingora is open source, it might make a lot of sense to build that project on top of pingora. You'd get the battle tested quality that nginx is lauded for. I wouldn't switch to a "fork" of nginx if it's a from scratch rewrite with no proven track record, regardless of the track record of the author.
sergioisidoro 3y ago
This might be a controversial opinion, but with the current Russian invasion of Ukraine and tensions between East/West, forking a project like Nginx to be maintained by a Russian company, by a person living in Russia, raises additional questions, especially considering how security critical nginx is when it comes to accessing all traffic of services. I'm thinking here as well about the case of Pavel Durov and his struggles with Russian government. From the post it seems their intention are good, and towards better secured software, and against business interfering with security. But the part where they say "I no longer able to control which changes are made in nginx within F5" might be a good thing. Should a single person have that much control over a critical piece of infrastructure?
- justsomehnguy 3y ago
  Like some guy from Finland?
  - sergioisidoro 3y ago
    To the best of my knowledge, Finnish government hasn't made any attempts at interfering with software development built in Finland, or spying on software users. The same cannot be said of Russia. I'm not saying Russian people cannot make safe and secure software, just saying that people living in Russia have historically been targets of pressure. * and to be honest, the USA and China do not have the cleanest of records either.
  - tipiirai 3y ago
    Pretty sure this is a reference to Linus Torwalds
- sneak 3y ago
  The same argument based on the “Russia vs the global west” narrative can be leveled perfectly accurately against western-citizen maintained software. Everyday Russian developers are no more or less involved in their country’s empire-building than everyday American developers are in theirs (lest we forget about the 12(!) foreign countries in which US forces are currently invading). “Russian” is not synonymous with “suspect”; or, if indeed it is, perhaps “American” should be, too.
bjourne 3y ago
More power to him! But calling the fork freenginx is perhaps not the best decision since there is nothing unfree about nginx. Call it rustnginx instead.
- imiric 3y ago
  Agreed about the current name, but a "rusty engine" doesn't inspire confidence in a web server. :)
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
ChrisArchitect 3y ago
Another one? https://news.ycombinator.com/item?id=39373327 https://news.ycombinator.com/item?id=39373327

136 points by kungfudoi 3y ago

Discussed previously Freenginx: Core Nginx developer announces fork https://news.ycombinator.com/item?id=39373327 https://news.ycombinator.com/item?id=39373327 2024-02-14, 475 comments

roschdal 3y ago

Excellent, I wish this project success!

yesbut 3y ago
Absolutely. This is great news.

murkt 3y ago

[flagged]

jesprenj 3y ago
What?
- tetris11 3y ago
  he might he referring to Angie, a fork of Nginx after a bunch of Russian software devs were fired from F5. I guess there were implications there.

RedShift1 3y ago

I'm glad I stuck with Apache httpd whilst everyone was moving to nginx. None of this drama with httpd.

tetris11 3y ago
I'm having a great time with Caddy. My whole Jupyter stack is reverse proxied to Caddy, and the Caddy config is a single line compared to the 100 line mess that they reccomend people use for Apache or nginx (yes caddy takes care of upgrading your headers, websockets, certificates, all of it)
- infofarmer 3y ago
  once you actually need to configure Caddy, it is an abomination beyond imagination — the docs, Caddyfile, JSON config — all of them lack coherence or sensible design never touching it again good defaults matter; nginx configs were very concise and readable in 2005-2015 when I was using it heavily; http/3, ws, acme — perhaps new tech is yet to be incorporated properly (and maybe it never will)
  - tetris11 3y ago
    I genuinely haven't had a problem with it -- I use it for all my projects, and it's seamless at rewriting baseurls handling subdomains, proxies, all of it.
citrin_ru 3y ago
A fork is not necessary bad for users. Nginx is already a great product and I believe both Nginx Inc version and freenginx will not become worse over the time. Likely they would gain different features, will have different release schedules e. t. c.
blowski 3y ago
Is it that much of a drama? Seems more like this is the whole selling point of open source - if you don't like something, you fork it, and people can vote with their installations. This kind of stuff happens all the time in private companies, but we as users have much less influence over the outcome.
Joel_Mckay 3y ago
Apache needs slowloris mitigation, and a dozen other tweaks to get it secure (mpm-itk, fail2ban rules, and anti-spammer mods etc.) It can be good, but most people run the vanilla install. Sometimes it is the only solution... ;-) However, Nginx gets over 20% more concurrent users per host... Hence the main reason people put up with its lack of features and silly HA design. Forks can be healthy, but it usually quickly degrades into a competition for users. Hope everyone has fun =)

gudzpoz 3y ago

> “Nginx is an incredible software and platform, but I was wondering if it wouldn't be time to just bite the bullet and create a more modern solution based on Rust.” I actually don't understand why I am seeing arguments like this all the time. Rewrite takes time and effort. It may be OK for new projects. But for a mature project that has a quarter million lines of code and load-tested for cross-platform compatibility and security, it is way more than "just biting the bullet". (Not to mention that memory safety in Rust is ... still improvable. [1]) Rust is not a panacea. [2] When a corporate tries to seize control of a open source project, some one (or some entity?) has to do something, and rewriting in Rust by no means reclaims the freedom and openness of the project. [1] https://news.ycombinator.com/item?id=39440808 https://news.ycombinator.com/item?id=39440808 [2] https://ariadne.space/2023/12/07/most-breaches-actually-begin-in-corp/ https://ariadne.space/2023/12/07/most-breaches-actually-begi...

jhgb 3y ago
Is it a rewrite...or a completely new piece of software that simply takes the NginX experience into consideration when designing its features?
- wccrawford 3y ago
  The blogger keeps saying "Fork", but I can't find anything from the actual developer that says that. Instead, they keep saying it's a new project and that it "understands the nginx configuration language". So I think it's pretty clear that it's not a fork. To add to the confusion, it seems like they copied the site with all the bug reports as-is, which obviously would only apply to a fork, not to a project that hasn't even got any code yet.
  - rascul 3y ago
    A quick glance at the commit log (or whatever it's called for mercurial) makes it look like a fork to me, but so far not much more beside name changing. http://freenginx.org/hg/nginx/ http://freenginx.org/hg/nginx/ https://hg.nginx.org/nginx https://hg.nginx.org/nginx

technion 3y ago

I know its early days but I think it's really broken to directly copy the upstream website, and impacts on how usable the product appears. For example, https://freenginx.org/en/security_advisories.html https://freenginx.org/en/security_advisories.html states "All nginx security issues should be reported to security-alert@freenginx.org." and then has a complete history of bugs from prior to the fork (and thus were never freenginx issues).

creatonez 3y ago
> For example, https://freenginx.org/en/security_advisories.html https://freenginx.org/en/security_advisories.html states "All nginx security issues should be reported to security-alert@freenginx.org." and then has a complete history of bugs from prior to the fork (and thus were never freenginx issues). What exactly to display on the security advisories page on a brand new fork project with no vulnerabilities yet seems like it could be a particularly hairy problem. You want users to visit the page and see the schema of information they would get in a security advisory, so they are prepared to use the website if they need to. So you could display an example advisory if none are available. But at that point it would be easier to keep the old advisories, because they also help to inform users on why they should upgrade from pre-fork versions.
jtc331 3y ago
Because it’s a fork those issues were in fact issues with freenginx IMO.

tinco 3y ago

Now that pingora is open source, it might make a lot of sense to build that project on top of pingora. You'd get the battle tested quality that nginx is lauded for. I wouldn't switch to a "fork" of nginx if it's a from scratch rewrite with no proven track record, regardless of the track record of the author.

sergioisidoro 3y ago

This might be a controversial opinion, but with the current Russian invasion of Ukraine and tensions between East/West, forking a project like Nginx to be maintained by a Russian company, by a person living in Russia, raises additional questions, especially considering how security critical nginx is when it comes to accessing all traffic of services. I'm thinking here as well about the case of Pavel Durov and his struggles with Russian government. From the post it seems their intention are good, and towards better secured software, and against business interfering with security. But the part where they say "I no longer able to control which changes are made in nginx within F5" might be a good thing. Should a single person have that much control over a critical piece of infrastructure?

justsomehnguy 3y ago
Like some guy from Finland?
- sergioisidoro 3y ago
  To the best of my knowledge, Finnish government hasn't made any attempts at interfering with software development built in Finland, or spying on software users. The same cannot be said of Russia. I'm not saying Russian people cannot make safe and secure software, just saying that people living in Russia have historically been targets of pressure. * and to be honest, the USA and China do not have the cleanest of records either.
- tipiirai 3y ago
  Pretty sure this is a reference to Linus Torwalds
sneak 3y ago
The same argument based on the “Russia vs the global west” narrative can be leveled perfectly accurately against western-citizen maintained software. Everyday Russian developers are no more or less involved in their country’s empire-building than everyday American developers are in theirs (lest we forget about the 12(!) foreign countries in which US forces are currently invading). “Russian” is not synonymous with “suspect”; or, if indeed it is, perhaps “American” should be, too.

bjourne 3y ago

More power to him! But calling the fork freenginx is perhaps not the best decision since there is nothing unfree about nginx. Call it rustnginx instead.

imiric 3y ago
Agreed about the current name, but a "rusty engine" doesn't inspire confidence in a web server. :)

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

ChrisArchitect 3y ago

Another one? https://news.ycombinator.com/item?id=39373327 https://news.ycombinator.com/item?id=39373327