3 ms·

Aha, "silly". I see your comment is full of arguments why this was the case all these years. Most Apache security issues didn't affect or had lesser impact on O

by tobiasu 13y ago

Aha, "silly". I see your comment is full of arguments why this was the case all these years. Most Apache security issues didn't affect or had lesser impact on OpenBSDs fork. The only thing silly here is your opinion.

SwellJoe 13y ago
The OpenBSD fork was ancient. The only people using it were those who didn't actually need a modern web server...which is to say, not even OpenBSD users were using it, if they were using their OpenBSD server for serious web service. While I understand the motivation behind it, I believe it would be silly to build a web service on top of an effectively 15 year old version of Apache (1.3 was first released in 1998 and was EOL, even for security releases, years ago). What is also silly is for a project that has so few serious developers to take on a project as massive as maintaining a fork of a project as large as Apache. When Apache had security issues that didn't affect the OpenBSD fork it was often because the OpenBSD fork didn't have the module in question (most security issues in Apache in the past decade have been in modules, often not frequently used ones). People not using those modules wouldn't have had those security issues, and people using those modules on OpenBSD (after building from source to get those modules and a modern version of Apache) would have also been affected. I'll admit that there is a certain charm to software that has few bugs because it does very little, but Apache is what it is because people need it to be those things. It is certainly not through incompetence. So, my opinion may be silly. But, it is not unconsidered. I've thought a lot about web service for the past 15 years, as it's a core part of my business. I could very well be wrong. Maybe OpenBSD would have been even less successful for web service had they opted to include a modern version of Apache. (And, before you say "popularity isn't a measure of being right", I will point out that no matter how secure software is, it is useless if no one uses it.)
- norswap 13y ago
  I always get funny feelings when people use "ancient" and "modern" as argument, without further explanation. Not that it is an invalid point, mind you. But certainly one that would bear expanding on.
  - SwellJoe 13y ago
    I mentioned one reason above. The Apache developers are far from incompetent, and all the changes in Apache since 1.3 have been because somebody (usually a lot of people) needed or wanted those changes. In most things I agree with you; I use vim, bash, shell scripts for automation, Perl, etc. All things that get the ancient vs. modern argument used against them...but, when it comes to software security old nearly always means "exploitable". Since Apache 1.3 became EOL in 2010, OpenBSD developers have been solely responsible for finding and fixing 1.3 security issues. That's a lot of work. If I were responsible for Apache packages (and I am; we ship a custom build of Apache for some of our supported operating systems in Virtualmin repos), I would want to leverage the knowledge and efforts of the people who primarily work on Apache. To continue... There have been major architectural changes in Apache from 1.3 to 2.x. Performance on a number of use cases has nearly doubled in those 15 years, for example. Modern web standards are more widely supported by recent versions, as well, either through modules or core HTTP protocol support changes. Wanna use SPDY? Yeah...gotta have 2.x. A ton of security and QoS oriented capabilities are also "new" in 2.x. Given OpenBSDs security focus, I believe tools to help prevent exploits and DoS of web apps should also be considered...not just whether the web server has any directly exploitable bugs. Very few people are just serving flat files with their web server today. The code interacting with clients is often mostly in Python, Ruby, Perl, PHP, etc. Those are as much potential attack vectors as the web server itself, and 2.x has better tools for managing that risk.
- danielweber 13y ago
  Yeah, in my OpenBSD work, we all skipped httpd and put in something else. Personally, lighttpd for a long time, but then it failed to be maintained in keeping with OpenSSL libraries, so it was dropped for nginx, and no looking back since.

by tobiasu 13y ago

SwellJoe 13y ago

The OpenBSD fork was ancient. The only people using it were those who didn't actually need a modern web server...which is to say, not even OpenBSD users were using it, if they were using their OpenBSD server for serious web service. While I understand the motivation behind it, I believe it would be silly to build a web service on top of an effectively 15 year old version of Apache (1.3 was first released in 1998 and was EOL, even for security releases, years ago). What is also silly is for a project that has so few serious developers to take on a project as massive as maintaining a fork of a project as large as Apache. When Apache had security issues that didn't affect the OpenBSD fork it was often because the OpenBSD fork didn't have the module in question (most security issues in Apache in the past decade have been in modules, often not frequently used ones). People not using those modules wouldn't have had those security issues, and people using those modules on OpenBSD (after building from source to get those modules and a modern version of Apache) would have also been affected. I'll admit that there is a certain charm to software that has few bugs because it does very little, but Apache is what it is because people need it to be those things. It is certainly not through incompetence. So, my opinion may be silly. But, it is not unconsidered. I've thought a lot about web service for the past 15 years, as it's a core part of my business. I could very well be wrong. Maybe OpenBSD would have been even less successful for web service had they opted to include a modern version of Apache. (And, before you say "popularity isn't a measure of being right", I will point out that no matter how secure software is, it is useless if no one uses it.)

norswap 13y ago
I always get funny feelings when people use "ancient" and "modern" as argument, without further explanation. Not that it is an invalid point, mind you. But certainly one that would bear expanding on.
- SwellJoe 13y ago
  I mentioned one reason above. The Apache developers are far from incompetent, and all the changes in Apache since 1.3 have been because somebody (usually a lot of people) needed or wanted those changes. In most things I agree with you; I use vim, bash, shell scripts for automation, Perl, etc. All things that get the ancient vs. modern argument used against them...but, when it comes to software security old nearly always means "exploitable". Since Apache 1.3 became EOL in 2010, OpenBSD developers have been solely responsible for finding and fixing 1.3 security issues. That's a lot of work. If I were responsible for Apache packages (and I am; we ship a custom build of Apache for some of our supported operating systems in Virtualmin repos), I would want to leverage the knowledge and efforts of the people who primarily work on Apache. To continue... There have been major architectural changes in Apache from 1.3 to 2.x. Performance on a number of use cases has nearly doubled in those 15 years, for example. Modern web standards are more widely supported by recent versions, as well, either through modules or core HTTP protocol support changes. Wanna use SPDY? Yeah...gotta have 2.x. A ton of security and QoS oriented capabilities are also "new" in 2.x. Given OpenBSDs security focus, I believe tools to help prevent exploits and DoS of web apps should also be considered...not just whether the web server has any directly exploitable bugs. Very few people are just serving flat files with their web server today. The code interacting with clients is often mostly in Python, Ruby, Perl, PHP, etc. Those are as much potential attack vectors as the web server itself, and 2.x has better tools for managing that risk.
danielweber 13y ago
Yeah, in my OpenBSD work, we all skipped httpd and put in something else. Personally, lighttpd for a long time, but then it failed to be maintained in keeping with OpenSSL libraries, so it was dropped for nginx, and no looking back since.