4 ms·

Freenginx 1.26.0

38 points by petecooper 3y ago

hwbunny 3y ago
The big question is whether If is still evil... :D
- ndsipa_pomu 3y ago
  Yes it is, or at least when used in location contexts. https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/ https://www.nginx.com/resources/wiki/start/topics/depth/ifis...
TiredOfLife 3y ago
Reminder that this was forked from nginx because the author was angry that F5 (company that sells the commercial version of nginx) disclosed security vulnerabilities.
- Smeevy 3y ago
  Reminder that we don't know what manner of other silliness he had to deal with.
- andy_ppp 3y ago
  Can you provide a source for this claim? It seems likely to be extremely one sided…
  - unltedcontrov 3y ago
    https://freenginx.org/pipermail/nginx-announce/2024/thread.html https://freenginx.org/pipermail/nginx-announce/2024/thread.h... Here's an unbiased primary source, and a copy: > Hello! > As you probably know, F5 closed Moscow office in 2022, and I no longer work for F5 since then. Still, we’ve reached an agreement that I will maintain my role in nginx development as a volunteer. And for almost two years I was working on improving nginx and making it better for everyone, for free. > Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. > That’s quite understandable: they own the project, and can do anything with it, including doing marketing-motivated actions, ignoring developers position and community. Still, this contradicts our agreement. And, more importantly, I no longer able to control which changes are made in nginx within F5, and no longer see nginx as a free and open source project developed and maintained for the public good. > As such, starting from today, I will no longer participate in nginx development as run by F5. Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities: > http://freenginx.org/ http://freenginx.org/ > The goal is to keep nginx development free from arbitrary corporate actions. Help and contributions are welcome. Hope it will be beneficial for everyone. > -- > Maxim Dounin > http://freenginx.org/ http://freenginx.org/
    - ranger_danger 3y ago
      that doesn't sound anything like the extraordinary claim made earlier.
  - TiredOfLife 3y ago
    https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312
- bravetraveler 3y ago
  I don't know the situation, but not all disclosure is equal. The shortness/brevity of this feels intended to mislead
- ranger_danger 3y ago
  that was not the reasoning I read in the original post about it
- deleted 3y ago
  [deleted]
- Brian_K_White 3y ago
  They did not disclose security vulnerabilities. They took unfinished disabled testing code and called it a security vulnerability. Do you really need it unpacked and explained exactly how and why that is a monumentally stupid thing to do? Everything, from code to a chair to a sandwich, is unfit for purpose until it is finished. It serves no purpose to raise an alarm about that when it is a baseline that applies equally to everything in the world. If one person does it it's just stupid and annoying and not meaningful or useful. But if you didn't understand that and thought it was a logical thing to do, then everyone else should do the same. If everyone else did the same, this would mean that every single new commit to every single open source codebase would qualify exactly the same. That is not a useful thing to try to do. Eleventy seven gobqillion CVEs every hour for every project in existence. Great. Useful. OF COURSE the bathroom is not safe to use yet when the plumber has not yet told you it's done. This isn't a defective or unsafe bathroom, it's not yet declared to BE a bathroom at all in the first place yet. A pile of materials isn't an unsafe and defective bathroom, nor is a half-built bathroom, nor is a bathroom that is practically done and even the plumber thinks it might be done but is still just doing the final checks before signing off on it. No matter what state it's in, if the contractor has not yet signed off on it, then it's still the same as the pile of raw materials from the start of the job, and it's not useful to anyone to go on some world wide reporting site and warn everyone that this bathroom has leaks and electrical hazards. It's not just being safer than neccessary, it's not even merely illogical and stupid but harmless, it's actively counter-productive and harmful by diluting the meaning of all other actual CVEs.
deleted 3y ago
[deleted]
LinuxBender 3y ago
I have not seen this fork of Nginx in any Linux repositories yet. Are they reaching out to nginx package maintainers to add this one? Will it be able to coexist side-by-side with the F5 version without any cross-dependencies on the other package/libraries? Anyone seeing this in their repos yet?
- vermaden 3y ago
  Try FreeBSD - its available in both Ports and pkg(8) packages :) https://freshports.org/www/freenginx

Freenginx 1.26.0

38 points by petecooper 3y ago

hwbunny 3y ago

The big question is whether If is still evil... :D

ndsipa_pomu 3y ago
Yes it is, or at least when used in location contexts. https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/ https://www.nginx.com/resources/wiki/start/topics/depth/ifis...

TiredOfLife 3y ago

Reminder that this was forked from nginx because the author was angry that F5 (company that sells the commercial version of nginx) disclosed security vulnerabilities.

Smeevy 3y ago
Reminder that we don't know what manner of other silliness he had to deal with.
andy_ppp 3y ago
Can you provide a source for this claim? It seems likely to be extremely one sided…
- unltedcontrov 3y ago
  https://freenginx.org/pipermail/nginx-announce/2024/thread.html https://freenginx.org/pipermail/nginx-announce/2024/thread.h... Here's an unbiased primary source, and a copy: > Hello! > As you probably know, F5 closed Moscow office in 2022, and I no longer work for F5 since then. Still, we’ve reached an agreement that I will maintain my role in nginx development as a volunteer. And for almost two years I was working on improving nginx and making it better for everyone, for free. > Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. > That’s quite understandable: they own the project, and can do anything with it, including doing marketing-motivated actions, ignoring developers position and community. Still, this contradicts our agreement. And, more importantly, I no longer able to control which changes are made in nginx within F5, and no longer see nginx as a free and open source project developed and maintained for the public good. > As such, starting from today, I will no longer participate in nginx development as run by F5. Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities: > http://freenginx.org/ http://freenginx.org/ > The goal is to keep nginx development free from arbitrary corporate actions. Help and contributions are welcome. Hope it will be beneficial for everyone. > -- > Maxim Dounin > http://freenginx.org/ http://freenginx.org/
  - ranger_danger 3y ago
    that doesn't sound anything like the extraordinary claim made earlier.
- TiredOfLife 3y ago
  https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312
bravetraveler 3y ago
I don't know the situation, but not all disclosure is equal. The shortness/brevity of this feels intended to mislead
ranger_danger 3y ago
that was not the reasoning I read in the original post about it
deleted 3y ago
[deleted]
Brian_K_White 3y ago
They did not disclose security vulnerabilities. They took unfinished disabled testing code and called it a security vulnerability. Do you really need it unpacked and explained exactly how and why that is a monumentally stupid thing to do? Everything, from code to a chair to a sandwich, is unfit for purpose until it is finished. It serves no purpose to raise an alarm about that when it is a baseline that applies equally to everything in the world. If one person does it it's just stupid and annoying and not meaningful or useful. But if you didn't understand that and thought it was a logical thing to do, then everyone else should do the same. If everyone else did the same, this would mean that every single new commit to every single open source codebase would qualify exactly the same. That is not a useful thing to try to do. Eleventy seven gobqillion CVEs every hour for every project in existence. Great. Useful. OF COURSE the bathroom is not safe to use yet when the plumber has not yet told you it's done. This isn't a defective or unsafe bathroom, it's not yet declared to BE a bathroom at all in the first place yet. A pile of materials isn't an unsafe and defective bathroom, nor is a half-built bathroom, nor is a bathroom that is practically done and even the plumber thinks it might be done but is still just doing the final checks before signing off on it. No matter what state it's in, if the contractor has not yet signed off on it, then it's still the same as the pile of raw materials from the start of the job, and it's not useful to anyone to go on some world wide reporting site and warn everyone that this bathroom has leaks and electrical hazards. It's not just being safer than neccessary, it's not even merely illogical and stupid but harmless, it's actively counter-productive and harmful by diluting the meaning of all other actual CVEs.

deleted 3y ago

[deleted]

LinuxBender 3y ago

I have not seen this fork of Nginx in any Linux repositories yet. Are they reaching out to nginx package maintainers to add this one? Will it be able to coexist side-by-side with the F5 version without any cross-dependencies on the other package/libraries? Anyone seeing this in their repos yet?

vermaden 3y ago
Try FreeBSD - its available in both Ports and pkg(8) packages :) https://freshports.org/www/freenginx