30 ms·

Freenginx: Core Nginx developer announces fork

1131 points by bkallus 3y ago

davecheney 3y ago
Oh snap, F5 just Hudson’d themselves.
illusive4080 3y ago
Anyone have more info about the changes nginx made?
karolist 3y ago
> Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Ah, I completely forgot F5 was involved in this, probably most of everyone else and F5 gets no money from this. Shouldn't matter to them, do they even have competition in enterprise load balancer space? I spent 9 years of my career managing these devices, they're rock solid and I remember some anecdotes about MS buying them by the truckloads. They should be able to cover someone working on nginx, maybe advertise it more for some OSS goodwill.
- SteveNuts 3y ago
  The last two companies I've worked for have paid for Nginx+ since software LB is all we really need. Handling a few thousand RPS is nothing to nginx, and doesn't require fancy hardware. That said, it replaced Kemp load balancers, which it seems is the next biggest competitor in the hardware load balancer appliance space.
  - karolist 3y ago
    The world has moved on in the sense that "good enough" and cloud eats into their balance sheets I'm sure, but there's loads and loads of banks and legacy enterprises that maintain their ivory tower data centers and there's nothing to replace these with AFAIK. Google has Maglev, AWS perhaps something similar, MS no idea, everyone else just buys F5 or doesn't need it.
    - JackSlateur 3y ago
      Lots of people are using haproxy
      - eddieroger 3y ago
        My org moved off nginx for haproxy after we learned that (at the time, maybe it changed) reloading an nginx config, even if done gracefully through kernel signals, would drop existing connections, where haproxy could handle it gracefully. That was a fun week of diving in to some C code looking for why it was behaving that way.
        nullify88 3y ago
        How did you come to that conclusion? I always believed a reload spawned new workers and let the old one drain off.
        CogitoCogito 3y ago
        Yes I reload nginx all the time and it doesn’t drop connections. I just use the debian nginx package. Not sure what the gp is talking about.
        nvarsj 3y ago
        Nginx abruptly drops http/1.1 persistent connections on reloads. This has been an issue forever and Maxim refused to ever fix it, saying it was to spec (yes it was, but there are better ways to deal with it). It’s a reason why many large, modern infra deployments have moved away from nginx.
        xorcist 3y ago
        It doesn't drop it, it's just not persistent on reload, isn't that what you mean? Actually dropping a connection mid-request is something I haven't seen nginx (or indeed Apache) do for many years despite doing some weird things with it. I can see where you're coming from, but it's not unreasonable behaviour, is it? Connections needs to migrated over to the new worker and that's how all major servers do it. If that's a problem then maybe something designed as proxy only instead of a real server is the way to go?
  - downrightmike 3y ago
    AVI if you're using VMware already
    - bkallus 3y ago
      I'm pretty sure that AVI just wraps Nginx, even though they claim otherwise. I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.
- reactordev 3y ago
  HAProxy is an enterprise load balancer that's available through Red Hat or other OSS Vendor. Nginx is just so easy to configure...
  - bklyn11201 3y ago
    HAProxy is a wonderful load balancer that doesn't serve static files thus forcing many of us to learn Nginx to fill the static-file-serving scenarios. Caddy seems like a wonderful alternative that does load balancing and static file serving but has wild config file formats for people coming from Apache/Nginx-land.
    - mholt 3y ago
      That's the best part -- you can choose your config format when using Caddy! https://caddyserver.com/docs/config-adapters https://caddyserver.com/docs/config-adapters
      - bklyn11201 3y ago
        True and I've made use of the Nginx adapter, but the resulting series of error messages and JSON was too scary to dive in further. The workflow that would make the most sense to me (to exit Nginx-world) would be loading my complex Nginx configs (100+ files) with the adapter, summarizing what could not be interpreted, and then writing the entirety to Caddyfile-format for me to modify further. I understand that JSON to Caddyfile would be lossy, but reading or editing 10k lines of JSON just seems impossible and daunting.
        mholt 3y ago
        Thanks for the feedback, that's good to know.
    - dingnuts 3y ago
      I keep a Caddy server around and the config format is actually much, much nicer than nginx's in my experience. The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This works for me because I already knew a fair bit about nginx configuration before picking up Caddy but it really kills me to see just how many projects don't even bother to explain the nginx config they provide. An example of this is Mattermost, which requires WebSockets and a few other config tweaks when running behind a reverse proxy. How does Mattermost document this? With an example nginx config! Want to use a different reverse proxy? Well, I hope you know how to read nginx configuration because there's no English description of what the example configuration does. Mastodon is another project that has committed this sin. I'm sure the list is never-ending.
- salmo 3y ago
  I dunno about rock solid. I’ve had plenty of issues forcing a failover/reboot, multiple complicated tickets open a year, etc. But we have a sh ton of them. To be fair, some are kernel bugs with connection table leaks, SNAT + UDP, etc. Buuuut, they have by far the best support. They’re as responsive as Cisco, but every product isn’t a completely different thing, team, etc. And they work really well in a big company used to having Network Engineering as a silo. I’d only use them as physical hardware, though. As a virtual appliance, they’re too resource hungry. Nginx or HA-Proxy are technically great for anything reasonable and when fronting a small set of applications. I prefer nginx because the config is easier to read for someone coming in behind me. But they take a modern IT structure to support because “Developers” don’t get them and “Network Engineers” don’t have a CLI. For VMWare, NSX-V HA-Proxy and NSX-T nginx config are like someone read the HOWTO and never got into production ready deployments. They’re poorly tuned and failure recovery is sloooow. AVI looked so promising, but development slowed down and seemed to lose direction post acquisition. And that was before Broadcom. Sigh.
  - kevin_nisbet 3y ago
    I'm very out of date so take my opinion with a grain of salt. The customer support I received from F5 when they acquired a telco product was about the worst support I've ever seen. Now this wasn't the general LB equipment that F5 has the reputation around, it's some specific equipment for LTE networks. We'd get completely bogus explanations for bugs, escalate up the chain to VPs and leadership because there was an obvious training, understanding, and support for complex issues problem, and get the VPs trying to gaslight us into believing their explanations were valid. We're talking things like on our IPv4 only network, the reason we're having issues is due to bugs in the equipment receiving IPv6 packets. So it's one of those things where I've personally been burned so hard by F5 that I'd probably to an unreasonable level look for other vendors. The only thing is, this was awhile ago, and the rumor's I've heard are that no one involved is still employed by F5.
    - karolist 3y ago
      When was this? I worked with them 2009-2018, support was really top notch. We could get super technical guys on the call and even custom patches for our issues, but our usage was relatively simple. I contrast them with McAfee products we've used, now that was a complete shitshow as a product and support.
pornel 3y ago
I'm hoping the fork will allow having code comments.
system2 3y ago
There is no news other than this individual post. I wish he could describe it more. It says it is free but where is the github page for it?
- Y-bar 3y ago
  Source code repo is here, not everything need a Github account to be free: http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
- Kluggy 3y ago
  They don’t use GitHub http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
- cogman10 3y ago
  http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
  - patates 3y ago
    They are using mercurial! This is such a breath of fresh air.
    - fmajid 3y ago
      Fossil would be a breath of fresh air, and I use mercurial at work.
- deleted 3y ago
  [deleted]
- dvko 3y ago
  > It says it is free but where is the github page for it? Not sure if serious, but you do realise that free is not at all about having a GitHub page? Maxim has been working on nginx for years and just forked the project so that he can continue working on it. The license remains the same as the original nginx project and you can already download its sources here: https://freenginx.org/en/download.html https://freenginx.org/en/download.html
larodi 3y ago
Is called "rage-fork" perhaps this. So proposed title: nginx dev rage-forks over security disagreement with boss company But then perhaps he also has every right to do it, even though AFAIR the original author was somebody else.
- water-your-self 3y ago
  Why does the identity of the original author matter here?
  - allanrbo 3y ago
    In my opinion the original author did a really good job, so I found it interesting to know where and whether he might continue his vision. Edit: I see now from the hg history that Igor hasn't been coding on Nginx for a decade actually.
    - larodi 3y ago
      Indeed, the original work done by single dev (Igor) to get the nginx project running was very impressive timewise, and as a volume of code produced. I can't really recall why he left, but with other comments around the thread implies such forks have happened more than once. As a sidenote I believe the people who start projects that they themselves run in excellent manner, should be praised, supported, noted and there is nothing more for their identities to matter. It very much matters some particular person with weird nick burntsushi created this wonderful tool rg, and kept growing it for long time. Besides, I can bet for projects such as Cosmopolitan C, it absolutely matters that jart started/did it.
- allanrbo 3y ago
  Igor, the original author, left in 2022 according to wikipedia: https://en.wikipedia.org/wiki/Igor_Sysoev https://en.wikipedia.org/wiki/Igor_Sysoev
- Kluggy 3y ago
  Rage-fork doesn’t show up anywhere in their announcement, nor does it read like they’re doing something specifically out of rage. Everyone has a right to forking the project. Only time will tell if they get critical mass of developers to keep it going.
caycep 3y ago
wondering also whether Igor and Maxim are ok, what w/ the geopolitical situation there.
schneems 3y ago
Can it un-swap the behavior of SIGTERM and SIGKILL please?
- tyingq 3y ago
  Swap SIGTERM and SIGQUIT behavior? I don't think you can catch SIGKILL.
  - QuinnyPig 3y ago
    Correct. The only other untrappable signal is SIGSTOP.
  - schneems 3y ago
    You are correct I meant QUIT https://devcenter.heroku.com/articles/rails-unicorn https://devcenter.heroku.com/articles/rails-unicorn
stefanos82 3y ago
I don't get it...does not he knows about angie [1]? It was created by NGINX core devs after F5 acquisition if I'm not mistaken and it's a drop-in replacement for NGINX. [1] https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie
- bemusedthrow75 3y ago
  This surely is the question. Why not Angie?
  - sodality2 3y ago
    Could be related to the fact that Angie offers 'pro' version: https://wbsrv.ru/angie-pro/docs/en/ https://wbsrv.ru/angie-pro/docs/en/ From statement: "Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities"
    - bemusedthrow75 3y ago
      Hm. I guess this consultancy-on-a-paid-version model doesn't bother me (and clearly didn't bother the developer of freenginx while they were paying him). But a double fork can't be good.
      - bklyn11201 3y ago
        I assume USA companies are by far the highest revenue source for Nginx Plus. Both of these forks seem to be based in Russia. How is a USA company supposed to pay either of these vendors for their consulting or Pro versions? How long until F5 submits requests for domain ownership of freenginx.org, and how quickly does Angie get takedown requests for their features that look remarkably similar to Nginx Plus features (e.g., the console)?
        pests 3y ago
        > features that look remarkably similar to Nginx Plus features (e.g., the console) Its illegal for products in the same space to have similar features?
deleted 3y ago
[deleted]
nginxforks2402 3y ago
There is another fork already from some "ex-devs from the original team" https://angie.software/en/ https://angie.software/en/ https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie
- bklyn11201 3y ago
  Thanks, I've never seen this fork mentioned before. This alone is compelling: "Simplifying configuration: the location directive can define several matching expressions at once, which enables combining blocks with shared settings."
  - pests 3y ago
    Also owned by a for-profit company who offers a pro version.
    - spicykraken 3y ago
      Gotta pay the bills somehow
      - Rapzid 3y ago
        Maybe a coop of sorts could be formed where they pull in funds from sponsorships. A non-profit maybe. Devs could "lease" themselves to corporate sponsors and work on the project + some percentage time towards features they need. Sponsored development.. IDK could be a way to do it, pay the bills and some, and also limit the negative impacts public business or VC funded growth startup.
        HackerThemAll 3y ago
        That doesn't work. For example Apple, benefiting from FreeBSD Foundation's work, never gave back any single penny to them, never sponsored any project within the Foundation. 1 million a year would mean a world to the Foundation, and would be less than a rounding error in Apple balance sheet.
sevg 3y ago
Worth noting that there are only two active "core" devs, Maxim Dounin (the OP) and Roman Arutyunyan. Maxim is the biggest contributor that is still active. Maxim and Roman account for basically 99% of current development. So this is a pretty impactful fork. It's not like one of 8 core devs or something. This is 50% of the team. Edit: Just noticed Sergey Kandaurov isn't listed on GitHub "contributors" because he doesn't have a GitHub account (my bad). So it's more like 33% of the team. Previous releases have been tagged by Maxim, but the latest (today's 1.25.4) was tagged by Sergey.
ComputerGuru 3y ago
This isn’t just “a core nginx dev” — this is Maxim Dounin! He is nginx. I would consider putting his name in the title. (And if I were F5, I’d have given him anything he asked for to not leave, including concessions on product vision.) That said, I’m not sure how much leg he has to stand on for using the word nginx itself in the new product’s name and domain…
- amne 3y ago
  He *is* nginx ? https://freenginx.org/hg/nginx https://freenginx.org/hg/nginx I don't see it. Sure, he contributes. But in the last 3-4 years he definitely does not look like he is nginx based on that log. Or am I looking in the wrong place?
  - ComputerGuru 3y ago
    There's something wrong with the list. It's ostensibly sorted reverse chronologically but scroll further and you'll see it go from 2020-03-03 to "9 months ago" and from there on it's all him.
    - jcranmer 3y ago
      Judging from the graph view (https://freenginx.org/hg/nginx/graph https://freenginx.org/hg/nginx/graph), it has to do with the QUIC branch landing onto the main branch, suggesting he had little role in the QUIC development but heavy role outside of it.
  - flawi 3y ago
    I think the mercurial log is not doing us any favors here, most of the first few pages is the history of the `quic` http/3 support branch which indeed Maxim is not working on. Scroll past it and he'll be much more prevalent. See for example the log of stable-1.24: https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac
  - jbverschoor 3y ago
    And that's how 100x developers don't get the recognition they deserve.
sschueller 3y ago
Is this what the security disagreements is about https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6M...?
- MZMegaZone 3y ago
  Yep. Maxim did not want CVEs assigned.
  - tptacek 3y ago
    MegaZone as in Usenet MegaZone?
    - MZMegaZone 3y ago
      No, a MegaZone. Haven't you heard, we come in six packs now. ;-) Yeah, very, very likely one and the same. Since 1989.
      - tptacek 3y ago
        Wow, that's a throwback. I was an ISP person back in the Portmaster era. You're at F5 now, I guess! Can you say more about the CVE thing? That seems like the opposite of what Maxim Dounin was saying.
        MZMegaZone 3y ago
        Yeah, I've been with F5 since 2010 - gotta love those old PortMasters though, Livingston was good times, until Lucent took over. I was there 95-98. I don't know what else there is to say really. The QUIC/HTTP/3 vuln was found in NGINX OSS, which is also the basis for the commercial NGINX+ product. We looked at the issue and decided that, by our disclosure policies, we needed to assign a CVE and make a disclosure. And I was firmly in that camp - my personal motto is "Our customers cannot make informed decisions about their networks if we do not inform them." I fight for the users. Anyway, Maxim did not seem to agree with that position. There wasn't much debate about it - the policy was pretty clear and we said we're issuing a CVE. And this is the result as near I can tell. Honestly, anyone could have gone to a CNA and demanded a CVE and he would not have been able to stop it. That's how it works.
pbaam 3y ago
What a coincidence, some days ago I was reading some HN posts related to lighttpd and I found [1]. The link is dead and it has inappropriate content, so use arhive.org. The author doesn't go too much in detail of why nginx being purchased is a problem, but in how to configure lighttpd. And the first comment predicts the hypothetical case of F5 being problematic. [1] https://news.ycombinator.com/item?id=19413901 https://news.ycombinator.com/item?id=19413901
- synergy20 3y ago
  I have been using lighttpd which can also host static content and do proxying, on top of those lighttpd supports cgi/fastcgi/etc out of the box as well, and it takes 4MB memory only by default at start, so it works for both low end embedded systems and large servers.
  - nullify88 3y ago
    I've recently needed to build a docker image to run a static site. I compiled busybox with only it's httpd server. It runs with 300kb of ram with a scratch image and tini. I didn't compile in fastcgi support in to my build, but it can be enabled.
    - synergy20 3y ago
      yes busybox httpd or civetweb is even smaller, both around 300kb. for tini you mean https://github.com/krallin/tini https://github.com/krallin/tini? how large is your final docker image, why not just alpine in that case which is musl+busybox
      - nullify88 3y ago
        Yep that tini. The docker image is about 1.90mb. It's a repack of https://homer-demo.netlify.app/ https://homer-demo.netlify.app/ I pre-gzipped a few of the compressible file extensions too so they can be served compressed. In this case, I didn't need alpine. I generally aim to get the image as minimal as possible without too much hassle. I end up doing stuff like this alot when I feel like a community image maybe too bloated when something like alpine or distroless can be used. Entry point scripts have all kinds of envars and a shell dependency, I'd rather rebuild the image to cater for my needs and execute the binary directly, and mount in any config via k8s.
arter4 3y ago
I admit I haven't followed closely this issue, but what is he talking about? >In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.
- MZMegaZone 3y ago
  We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.
  - tky 3y ago
    This seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?
    - MZMegaZone 3y ago
      Yes, those are the two CVEs I was referring to. All I know is he objected to our decision to assign CVEs, was not happy that we did, and the timing does not appear coincidental.
      - mike_d 3y ago
        QUIC in Nginx is experimental and not enabled by default. I tend to agree with him here that a WIP codebase will have bugs that might have security implications, but they aren't CVE worthy.
        MZMegaZone 3y ago
        We know a number of customers/users have the code in production, experimental or not. And that was part of decision process. The security advisories we published do state the feature is experimental. When in doubt, err on the side of doing the right thing for the users. I find that's the best approach. I don't consider CVE a bad thing - it shouldn't be treated like a scarlet letter to be avoided. It is a unique identifier that makes it easy to talk about a specific issue and get the word out to customers/users so they can protect themselves. And that's a good thing. The question I ask is "Why not assign a CVE?" You have to have a solid reason why not to do it, because of default is to assign and disclose. I don't think having the CVEs should reflect poorly on NGINX or Maxim. I'm sorry he feels the way he does, but I hold no ill will toward him and wish him success, seriously.
qwertox 3y ago
Time for me to slowly start looking for an alternative. There was a time when I wanted to move away from it and was eyeing HAProxy, but the lack of the ability to serve static files didn't convince me. Then there was Traefik, but I never looked too much into it, because Nginx is working just fine for me. My biggest hope was Cloudflare's Rust-based Pingora pre-announcement, which was then never published as Open Source. Now that I googled for the Pingora name I found Oxy, which might be Pingora? Googling for this yields > Although Pingora, another proxy server developed by us in Rust, shares some similarities with Oxy, it was intentionally designed as a separate proxy server with a different objective. Any non-Apache recommendations? It should be able to serve static files.
- pablopr3 3y ago
  Maybe take a look at Caddy (https://caddyserver.com/ https://caddyserver.com/)
  - jbverschoor 3y ago
    Well, until you read https://news.ycombinator.com/item?id=39351026 https://news.ycombinator.com/item?id=39351026
    - mholt 3y ago
      And? (That isn't about Caddy, rather a third-party plugin.)
      - kuschku 3y ago
        Have you finally decided to match FQDN URLs correctly? I'd love to get rid of the part of my clients' codebase that starts with // workaround for broken caddy servers
      - SuperQue 3y ago
        Also, it's not always about vulnerabilities directly, but how well / fast things are patched.
petecooper 3y ago
Page won't load for me, Wayback Machine caught it: https://web.archive.org/web/20240214184151/https://mailman.nginx.org/pipermail/nginx-devel/2024-February/K5IC6VYO2PB7N4HRP2FUQIBIBCGP4WAU.html https://web.archive.org/web/20240214184151/https://mailman.n...
petecooper 3y ago
Mailing list discussion: https://forum.nginx.org/read.php?2,299130 https://forum.nginx.org/read.php?2,299130
687m786m78 3y ago
It is scary to think about how much of web relies on projects maintained by 1 or 2 people.
- ironmagma 3y ago
  Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.
  - szundi 3y ago
    Not the web though
    - ironmagma 3y ago
      Certainly the web can mostly coast indefinitely. There are webpages from decades ago that still function fine, even that use JavaScript. The web is an incredibly stable platform all things considered. In contrast, it's hard to get a program that links to a version of Zlib from 10 years ago running on a modern Linux box.
      - quickthrower2 3y ago
        The web is the calm looking duck that is paddling frantically. You want to be using SSL from the 90s, or IE vs. Netscape as your choice etc. Nostalgia aside!
      - 5- 3y ago
        this problem -- great forward compatibility of the web -- has been taken care of with application layer encryption, deceitfully called "transport layer" security (tls)
      - KronisLV 3y ago
        > Certainly the web can mostly coast indefinitely. I'm not sure about that, for anything besides static resources, given the rate at which various vulnerabilities are found at and how large automated attacks can be, unless you want an up to date WAF in front of everything to be a pre-requisite. Well, either that or using mTLS or other methods of only letting trusted parties access your resources (which I do for a lot of my homelab), but that's not the most scalable approach. Back end code does tend to rot a lot, for example, like log4shell showed. Everything was okay one moment and then BOOM, RCEs all over the place the next. I'm all for proven solutions, but I can't exactly escape needing to do everything from OS updates, to language runtime and library updates.
q2dg 3y ago
Just use Apache
- jdoss 3y ago
  As someone who used Apache 1.3.x through 2.x heavily from 2000 to 2015, I respectfully disagree with this statement. Nginx and Traefik are easier to configure, have better communities and in most cases perform better. Traefik Opensource is my go to for almost all of my use cases theses days and I have never stopped and said hmmm I wonder if Apache would do better here. It is that good.
- stop50 3y ago
  Apacge still can't work as an reverse proxy for servers that utilize unix sockets.
notsosubtle 3y ago
https://my.f5.com/manage/s/article/K59427339 https://my.f5.com/manage/s/article/K59427339 All F5 contributions to NGINX open source projects have been moved to other global locations. No code, either commercial or open source, is located in Russia. yeah, yeah
BadHumans 3y ago
Tangent, but I got curious about contributing so I went to the Freenginx homepage, it looks like this project will be organized over mailing list. I would love if someone would create a product that gives mailing list a tolerable UI.
- fmajid 3y ago
  SourceHut? It’s a forge organized around an email rather than pull request workflow.
- dqv 3y ago
  Have you tried HyperKitty/Postorious? Does it get closer to what you would consider tolerable? https://mail.python.org/archives/list/mailman-users@python.org/ https://mail.python.org/archives/list/mailman-users@python.o...
darkhorn 3y ago
I don't understand why some people use a Russian software! Especially in this age.
- LinuxBender 3y ago
  In some cases there are not great alternatives that fit the needs. I have not found anything that matches LFTP Using the mirror subsystem with SFTP and connecting to chroot SFTP servers. It replicates the behavior of rsync in a chroot SFTP-only environment. Only downside is that since there isn't a syncing daemon on the other side, directory enumeration is much slower. File transfers are exponentially faster however as it can do as many SFTP sessions as desired for batches of files or even one big file with the only limit being the bandwidth from client to server. For NGinx I have been able to make use of HAProxy and Apache just fine. Long ago Apache was slower than NGinx but ever since APR 1.7 and Apache 2.4 there are about the same performance wise. Some here don't like the configuration syntax but I am used to it.
- ijhuygft776 3y ago
  Because they aren't short sighted like some others?
- WesolyKubeczek 3y ago
  While I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrains, for example. But there is also core-js which is a little polyfill library being used by like way more than half of high profile websites. Also written by a Russian national. If you excise all contributions by Russian nationals to PostgreSQL or the Linux kernel, they will be left in a not very runnable state, I’m afraid. On the other hand, it’s not like you are giving them money directly, unless you do; I also can see that in, say, both Linux and PostgreSQL there is also enough people from the “geopolitical opposition” so that even if the Russian contributors are asked by some stern people from the Apparat to sneak something backdoory in, it will be sniffed rather quickly and prevented from going much further. So tl;dr is that there is no simple response.
  - 3y ago
rdl 3y ago
Curious how to support Maxim despite Russia complications.
- fareesh 3y ago
  bitcoin solves this
dmacvicar 3y ago
It seems every time I read about a project being forked, they use the (probably) trademarked name in the project's fork, just to need a rename a few weeks after.
web3-is-a-scam 3y ago
Apache my beloved
- stop50 3y ago
  I only use apache on one server: as an dav server, since i could not find a simple dav server(nextcloud is for that already too much) and nginx as an frontend for that, since i use some servers with unix sockets which apache still doesn't support.
chrisweekly 3y ago
Note for some reason Maxim chose to link to http://freenginx.org http://freenginx.org, instead of https://freenginx.org https://freenginx.org
- EasyMark 3y ago
  typo? it forwards to https anyway.
  - brunoqc 3y ago
    Are you sure? not for me
  - tehbeard 3y ago
    Pretty sure that's an extension on your part. Neither chrome/firefox/cURL redirects that to https for me.
    - EasyMark 3y ago
      you're right I forgot about https auto forwarding in my browser as default.
deleted 3y ago
[deleted]
INTPenis 3y ago
If I ever need nginx I'll use freenginx. But funny enough all my services run in Traefik these days. 15 years ago Apache httpd was the norm, and lately nginx has been, and now I can't even think of a reason to use it.
nimbius 3y ago
>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.
- tiffanyh 3y ago
  They could take the Postgres naming approach. Ingress was forked; the Post fork version of Ingress was called "Post"gres. So maybe name this new project "PostX" (for Post + nginx). Though that might sound too similar to posix.
  - virtualwhys 3y ago
    "Postginx" has a nice ring to it, could be an alcoholic beverage, a name of a generation, or even a web server.
    - diego_sandoval 3y ago
      gintonx
      - agateau 3y ago
        Sounds like an character from the Asterix comic book :)
  - icybox 3y ago
    ... and postfix
  - anotherhue 3y ago
    Go roman? nginxii ?
    - bandie91 3y ago
      are we at the twelfth fork? :)
  - 3y ago
resolutebat 3y ago
Per the discussion at https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312, this cryptic shade: > Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Refers to F5's decision to publish two vulnerabilities as CVEs, when Maxim did not want them to be published.
fl0ki 3y ago
Given this fork still boasts a 2-clause BSD license, the corporate nginx can still make the effort to backport patches. It's certainly harder than requiring a single converged development branch, but how closely they track Maxim's work is ultimately up to them. If nginx continues to receive more attention from security researchers, I imagine Maxim will have good reasons to backport fixes the other way too, or at least benefit from the same disclosures even if he does prefer to write his own patches as things do diverge. Though history also shows that hostile forks rarely survive 6 months. They either get merged if they had enough marginal value, or abandoned outright if they didn't. Time will tell.
- WhyNotHugo 3y ago
  I'm curious to see where this fork will go. The whole situation is a mess: - nginx is "open core", with some useful features in the proprietary version. - angie (a fork by several core devs) has a CLA, which sounds like a bait and switch waiting to happen and distro's won't package it - freenginx is at least open source. But who knows if it'll still be around by June.
  - spindle 3y ago
    FWIW, nixpkgs packages angie
  - perlgeek 3y ago
    I remember being surprised by the open core thing some years ago. I had been an Apache user for quite some time, and thought I'd take a look at the (at that point, a few years old) "new" shiny thing. I found that something as simple as LDAP authentication required a payed plugin; a free Apache module has been available for this for ages. That made nginx a non-starter for this particular use case. I wonder if the fork will accumulate free plugins for things that the old core required payed plugins for, slowly eroding their business case.
    - nly 3y ago
      Most of this simple premium features/plugins were probably funded by companies because they had business value. It's probably unlikely freenginx will re-create them without those contracts. Unpaid Open Source developers tend to focus on interesting/cool core stuff and ignore all the stuff businesses care about (like LDAP authentication).
thomasjudge 3y ago
How the heck am I supposed to pronounce that? "Free-en-gen-icks"?
- 000ooo000 3y ago
  Freen Ginks
lyu07282 3y ago
seems like an annoying but necessary thing, so lets give the original a quick death and migrate to freenginx Infrastructure like that should not be run by for-profit corporations anyway, it will always end up like in this case sooner or later
darylteo 3y ago
F5 closing moscow office: Is this a result of US sanctions?
nginxsjsjn 3y ago
Well maybe this core dev can impact some better malware into it and update the defaults. Nginx loves to pretend it’s 1995. It barely has http3 support and does insanely stupid things by default. No wonder people move to haproxy, Traefik, caddy, etc. Cloudflare doesn’t use it anymore for good reason.
webprofusion 3y ago
One of the most heavily used Russian software projects on the internet https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-nginx/ https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-n... but it's only marginally more modern than Apache httpd. In light of recently announced nginx memory-safety vulnerabilities I'd suggest migrating to Caddy https://caddyserver.com/ https://caddyserver.com/
andrewstuart 3y ago
After using Nginx for something like 15 years I dropped it a couple of years ago. Using Caddy instead. A point came where I realised I didn't enjoy Nginx. Configuring it was hard and it felt brittle. A particular pain point is certificates/ssl. I absolutely dreaded doing anything with certificates in Nginx. When I heard that Caddy automatically handles SSL/ certificates I jumped the nginx ship and swam as fast as I could to Caddy.
someoneinworld 3y ago
Just curious how do folks make a living with free contributions not associated to any company? Is it sponsorships or they do some contract work on the side ? It feels these devs are soo underappreciated for the tremendous work they do, so much in software is supported on so many of these projects and companies dont sponsor or do the right thing !
- snizovtsev 3y ago
  Living in Russia could be very cheap compared to other countries. If you own a flat and you don't need cars or travel, then it's possible to live a few years just on money saved from your previous software job.
  - someoneinworld 3y ago
    But its still seems like a massive system failure which cant help folks who have built that is used by so many industries.
Vosporos 3y ago
Godspeed
udev4096 3y ago
Judging from the comments of the guy from F5, it seems that Maxim didn't wanna assign a CVE to the latest vulns. I wonder why
SomeoneFromCA 3y ago
NGINX are FSBs shills.
apatheticonion 3y ago
My biggest gripe as an internet keyboard warrior with an opinion is not being able to understand the source control and build process of Nginx. Probably a skill issue but when I last tried to compile Nginx from the Github mirror I spent hours trying to figure it out. I wish there was a GitHub page with an easy to understand build process... and that I could just run "cargo build --release" lol
- scandox 3y ago
  ./configure make make install I just ran this to be sure I wasn't delusional and it took only 2 minutes.
  - apatheticonion 3y ago
    Really? https://github.com/nginx/nginx/tree/branches/stable-1.24 https://github.com/nginx/nginx/tree/branches/stable-1.24 I cloned this and it doesn't have a makefile or configure script Neither does the official repo? https://hg.nginx.org/nginx/file/tip https://hg.nginx.org/nginx/file/tip Do you run it from /auto/?
seunosewa 3y ago
I hope he implements the least connection load balancing option for free users.
aaroninsf 3y ago
Dissatisfaction, like water, will always find its level.
deleted 3y ago
[deleted]
aftbit 3y ago
I dunno seems like a tempest in a teapot. Not sure why Maxim would not want CVEs to be assigned to something. Maybe it was just the final straw after a series of bad interactions. Every project has a lifespan, sometimes trying to keep them going forever is not the answer. I will miss nginx a lot if I need to migrate though.
- mistrial9 3y ago
  no - the CVE process is at the center of new broad laws in the EU regarding business registration and security assurances. You are exactly wrong about the significance of this fork, basically. see EU CRA
liveoneggs 3y ago
This fork should use the Apache Foundation for its hosting and things.
- deleted 3y ago
  [deleted]
DeathArrow 3y ago
I hope some people will find the time to help him.
scrps 3y ago
Bravo!
soupbowl 3y ago
Did we find out why the dev of freenginx did not want the nginx CVE that caused this fork? Some contex would be nice as it seems like a weird reason to fork.
- SushiHippie 3y ago
  https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312
- gertrunde 3y ago
  IIRC from reading the post, the reasoning was that the bug was in a feature which was marked as experimental (HTTP/3).
robgibbons 3y ago
It was already mentioned in the other thread, but it looks like F5 owns the trademark for the Nginx name. Maxim should consider rebranding the project to avoid any legal blowback.
- austinjp 3y ago
  As I suggested elsewhere [0] if you bump each letter in nginx you get... ohjoy! [0] https://news.ycombinator.com/item?id=39376657 https://news.ycombinator.com/item?id=39376657
  - RamRodification 3y ago
    Fun but bad!
  - temp0826 3y ago
    I feel like scrambling the letters to "ginnx" (pronounced jinx?) or something might be better.
not_a_dane 3y ago
Just looking at comments here makes me feel like this is pretty much underrated.
lnxg33k1 3y ago
Innovation is being kept hostage by MBAs, marketing, PR and recruiters
Reelix 3y ago
So - The big question... Is the fork going to allow you to change the nginx Server response header (A PAID feature in the current fork...) without requiring you to mod it in and recompile it? :p Yes - You read that correctly. They refuse to accept PR's to add additional functionality because that functionality is restricted to the paid version :p
egberts1 3y ago
I stop using Nginx when i needed ability to assign an Ethernet port (IP address not yet available) and Nginx developers refused to do this. Before you ask why would I do that, Ive got all Ethernet interfaces on dynamically IP created on a on-demand basis and only wanted ONE specific interface (non-public) to host the HTTP/HTTPS protocol. And no, we do not want to jerry-rig some fancy nginx config file shell -script updater whenever an IP address gets assigned/reassigned. Here came lighthttpd and Apache to the rescue.
frikkie444 3y ago
F5 is spinning this to be about not disclosing CVE's when the truth is more that the experimental code that was flagged was not considered production ready and whomever is running it should know they are on their own. This CVE is an obvious bug, and when your KPI is CVE's per month every bug looks like a CVE F5 wants this feature prioritized over what Maxim planned, and Maxim doesn't have to comply, he is a volunteer.
devosalain 3y ago
Is F5 trying to kill the original nginx. [Cfr hostile take-overs of Microsoft]

1131 points by bkallus 3y ago

davecheney 3y ago

Oh snap, F5 just Hudson’d themselves.

illusive4080 3y ago

Anyone have more info about the changes nginx made?

karolist 3y ago

> Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Ah, I completely forgot F5 was involved in this, probably most of everyone else and F5 gets no money from this. Shouldn't matter to them, do they even have competition in enterprise load balancer space? I spent 9 years of my career managing these devices, they're rock solid and I remember some anecdotes about MS buying them by the truckloads. They should be able to cover someone working on nginx, maybe advertise it more for some OSS goodwill.

SteveNuts 3y ago
The last two companies I've worked for have paid for Nginx+ since software LB is all we really need. Handling a few thousand RPS is nothing to nginx, and doesn't require fancy hardware. That said, it replaced Kemp load balancers, which it seems is the next biggest competitor in the hardware load balancer appliance space.
- karolist 3y ago
  The world has moved on in the sense that "good enough" and cloud eats into their balance sheets I'm sure, but there's loads and loads of banks and legacy enterprises that maintain their ivory tower data centers and there's nothing to replace these with AFAIK. Google has Maglev, AWS perhaps something similar, MS no idea, everyone else just buys F5 or doesn't need it.
  - JackSlateur 3y ago
    Lots of people are using haproxy
    - eddieroger 3y ago
      My org moved off nginx for haproxy after we learned that (at the time, maybe it changed) reloading an nginx config, even if done gracefully through kernel signals, would drop existing connections, where haproxy could handle it gracefully. That was a fun week of diving in to some C code looking for why it was behaving that way.
      - nullify88 3y ago
        How did you come to that conclusion? I always believed a reload spawned new workers and let the old one drain off.
        CogitoCogito 3y ago
        Yes I reload nginx all the time and it doesn’t drop connections. I just use the debian nginx package. Not sure what the gp is talking about.
        nvarsj 3y ago
        Nginx abruptly drops http/1.1 persistent connections on reloads. This has been an issue forever and Maxim refused to ever fix it, saying it was to spec (yes it was, but there are better ways to deal with it). It’s a reason why many large, modern infra deployments have moved away from nginx.
        xorcist 3y ago
        It doesn't drop it, it's just not persistent on reload, isn't that what you mean? Actually dropping a connection mid-request is something I haven't seen nginx (or indeed Apache) do for many years despite doing some weird things with it. I can see where you're coming from, but it's not unreasonable behaviour, is it? Connections needs to migrated over to the new worker and that's how all major servers do it. If that's a problem then maybe something designed as proxy only instead of a real server is the way to go?
- downrightmike 3y ago
  AVI if you're using VMware already
  - bkallus 3y ago
    I'm pretty sure that AVI just wraps Nginx, even though they claim otherwise. I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.
reactordev 3y ago
HAProxy is an enterprise load balancer that's available through Red Hat or other OSS Vendor. Nginx is just so easy to configure...
- bklyn11201 3y ago
  HAProxy is a wonderful load balancer that doesn't serve static files thus forcing many of us to learn Nginx to fill the static-file-serving scenarios. Caddy seems like a wonderful alternative that does load balancing and static file serving but has wild config file formats for people coming from Apache/Nginx-land.
  - mholt 3y ago
    That's the best part -- you can choose your config format when using Caddy! https://caddyserver.com/docs/config-adapters https://caddyserver.com/docs/config-adapters
    - bklyn11201 3y ago
      True and I've made use of the Nginx adapter, but the resulting series of error messages and JSON was too scary to dive in further. The workflow that would make the most sense to me (to exit Nginx-world) would be loading my complex Nginx configs (100+ files) with the adapter, summarizing what could not be interpreted, and then writing the entirety to Caddyfile-format for me to modify further. I understand that JSON to Caddyfile would be lossy, but reading or editing 10k lines of JSON just seems impossible and daunting.
      - mholt 3y ago
        Thanks for the feedback, that's good to know.
  - dingnuts 3y ago
    I keep a Caddy server around and the config format is actually much, much nicer than nginx's in my experience. The main problem with it is that everybody provides example configurations in the nginx config format, so I have to read them, understand them, and translate them. This works for me because I already knew a fair bit about nginx configuration before picking up Caddy but it really kills me to see just how many projects don't even bother to explain the nginx config they provide. An example of this is Mattermost, which requires WebSockets and a few other config tweaks when running behind a reverse proxy. How does Mattermost document this? With an example nginx config! Want to use a different reverse proxy? Well, I hope you know how to read nginx configuration because there's no English description of what the example configuration does. Mastodon is another project that has committed this sin. I'm sure the list is never-ending.
salmo 3y ago
I dunno about rock solid. I’ve had plenty of issues forcing a failover/reboot, multiple complicated tickets open a year, etc. But we have a sh ton of them. To be fair, some are kernel bugs with connection table leaks, SNAT + UDP, etc. Buuuut, they have by far the best support. They’re as responsive as Cisco, but every product isn’t a completely different thing, team, etc. And they work really well in a big company used to having Network Engineering as a silo. I’d only use them as physical hardware, though. As a virtual appliance, they’re too resource hungry. Nginx or HA-Proxy are technically great for anything reasonable and when fronting a small set of applications. I prefer nginx because the config is easier to read for someone coming in behind me. But they take a modern IT structure to support because “Developers” don’t get them and “Network Engineers” don’t have a CLI. For VMWare, NSX-V HA-Proxy and NSX-T nginx config are like someone read the HOWTO and never got into production ready deployments. They’re poorly tuned and failure recovery is sloooow. AVI looked so promising, but development slowed down and seemed to lose direction post acquisition. And that was before Broadcom. Sigh.
- kevin_nisbet 3y ago
  I'm very out of date so take my opinion with a grain of salt. The customer support I received from F5 when they acquired a telco product was about the worst support I've ever seen. Now this wasn't the general LB equipment that F5 has the reputation around, it's some specific equipment for LTE networks. We'd get completely bogus explanations for bugs, escalate up the chain to VPs and leadership because there was an obvious training, understanding, and support for complex issues problem, and get the VPs trying to gaslight us into believing their explanations were valid. We're talking things like on our IPv4 only network, the reason we're having issues is due to bugs in the equipment receiving IPv6 packets. So it's one of those things where I've personally been burned so hard by F5 that I'd probably to an unreasonable level look for other vendors. The only thing is, this was awhile ago, and the rumor's I've heard are that no one involved is still employed by F5.
  - karolist 3y ago
    When was this? I worked with them 2009-2018, support was really top notch. We could get super technical guys on the call and even custom patches for our issues, but our usage was relatively simple. I contrast them with McAfee products we've used, now that was a complete shitshow as a product and support.

pornel 3y ago

I'm hoping the fork will allow having code comments.

system2 3y ago

There is no news other than this individual post. I wish he could describe it more. It says it is free but where is the github page for it?

Y-bar 3y ago
Source code repo is here, not everything need a Github account to be free: http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
Kluggy 3y ago
They don’t use GitHub http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
cogman10 3y ago
http://freenginx.org/hg/nginx http://freenginx.org/hg/nginx
- patates 3y ago
  They are using mercurial! This is such a breath of fresh air.
  - fmajid 3y ago
    Fossil would be a breath of fresh air, and I use mercurial at work.
deleted 3y ago
[deleted]
dvko 3y ago
> It says it is free but where is the github page for it? Not sure if serious, but you do realise that free is not at all about having a GitHub page? Maxim has been working on nginx for years and just forked the project so that he can continue working on it. The license remains the same as the original nginx project and you can already download its sources here: https://freenginx.org/en/download.html https://freenginx.org/en/download.html

larodi 3y ago

Is called "rage-fork" perhaps this. So proposed title: nginx dev rage-forks over security disagreement with boss company But then perhaps he also has every right to do it, even though AFAIR the original author was somebody else.

water-your-self 3y ago
Why does the identity of the original author matter here?
- allanrbo 3y ago
  In my opinion the original author did a really good job, so I found it interesting to know where and whether he might continue his vision. Edit: I see now from the hg history that Igor hasn't been coding on Nginx for a decade actually.
  - larodi 3y ago
    Indeed, the original work done by single dev (Igor) to get the nginx project running was very impressive timewise, and as a volume of code produced. I can't really recall why he left, but with other comments around the thread implies such forks have happened more than once. As a sidenote I believe the people who start projects that they themselves run in excellent manner, should be praised, supported, noted and there is nothing more for their identities to matter. It very much matters some particular person with weird nick burntsushi created this wonderful tool rg, and kept growing it for long time. Besides, I can bet for projects such as Cosmopolitan C, it absolutely matters that jart started/did it.
allanrbo 3y ago
Igor, the original author, left in 2022 according to wikipedia: https://en.wikipedia.org/wiki/Igor_Sysoev https://en.wikipedia.org/wiki/Igor_Sysoev
Kluggy 3y ago
Rage-fork doesn’t show up anywhere in their announcement, nor does it read like they’re doing something specifically out of rage. Everyone has a right to forking the project. Only time will tell if they get critical mass of developers to keep it going.

caycep 3y ago

wondering also whether Igor and Maxim are ok, what w/ the geopolitical situation there.

schneems 3y ago

Can it un-swap the behavior of SIGTERM and SIGKILL please?

tyingq 3y ago
Swap SIGTERM and SIGQUIT behavior? I don't think you can catch SIGKILL.
- QuinnyPig 3y ago
  Correct. The only other untrappable signal is SIGSTOP.
- schneems 3y ago
  You are correct I meant QUIT https://devcenter.heroku.com/articles/rails-unicorn https://devcenter.heroku.com/articles/rails-unicorn

stefanos82 3y ago

I don't get it...does not he knows about angie [1]? It was created by NGINX core devs after F5 acquisition if I'm not mistaken and it's a drop-in replacement for NGINX. [1] https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie

bemusedthrow75 3y ago
This surely is the question. Why not Angie?
- sodality2 3y ago
  Could be related to the fact that Angie offers 'pro' version: https://wbsrv.ru/angie-pro/docs/en/ https://wbsrv.ru/angie-pro/docs/en/ From statement: "Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities"
  - bemusedthrow75 3y ago
    Hm. I guess this consultancy-on-a-paid-version model doesn't bother me (and clearly didn't bother the developer of freenginx while they were paying him). But a double fork can't be good.
    - bklyn11201 3y ago
      I assume USA companies are by far the highest revenue source for Nginx Plus. Both of these forks seem to be based in Russia. How is a USA company supposed to pay either of these vendors for their consulting or Pro versions? How long until F5 submits requests for domain ownership of freenginx.org, and how quickly does Angie get takedown requests for their features that look remarkably similar to Nginx Plus features (e.g., the console)?
      - pests 3y ago
        > features that look remarkably similar to Nginx Plus features (e.g., the console) Its illegal for products in the same space to have similar features?

deleted 3y ago

[deleted]

nginxforks2402 3y ago

There is another fork already from some "ex-devs from the original team" https://angie.software/en/ https://angie.software/en/ https://github.com/webserver-llc/angie https://github.com/webserver-llc/angie

bklyn11201 3y ago
Thanks, I've never seen this fork mentioned before. This alone is compelling: "Simplifying configuration: the location directive can define several matching expressions at once, which enables combining blocks with shared settings."
- pests 3y ago
  Also owned by a for-profit company who offers a pro version.
  - spicykraken 3y ago
    Gotta pay the bills somehow
    - Rapzid 3y ago
      Maybe a coop of sorts could be formed where they pull in funds from sponsorships. A non-profit maybe. Devs could "lease" themselves to corporate sponsors and work on the project + some percentage time towards features they need. Sponsored development.. IDK could be a way to do it, pay the bills and some, and also limit the negative impacts public business or VC funded growth startup.
      - HackerThemAll 3y ago
        That doesn't work. For example Apple, benefiting from FreeBSD Foundation's work, never gave back any single penny to them, never sponsored any project within the Foundation. 1 million a year would mean a world to the Foundation, and would be less than a rounding error in Apple balance sheet.

sevg 3y ago

Worth noting that there are only two active "core" devs, Maxim Dounin (the OP) and Roman Arutyunyan. Maxim is the biggest contributor that is still active. Maxim and Roman account for basically 99% of current development. So this is a pretty impactful fork. It's not like one of 8 core devs or something. This is 50% of the team. Edit: Just noticed Sergey Kandaurov isn't listed on GitHub "contributors" because he doesn't have a GitHub account (my bad). So it's more like 33% of the team. Previous releases have been tagged by Maxim, but the latest (today's 1.25.4) was tagged by Sergey.

ComputerGuru 3y ago

This isn’t just “a core nginx dev” — this is Maxim Dounin! He is nginx. I would consider putting his name in the title. (And if I were F5, I’d have given him anything he asked for to not leave, including concessions on product vision.) That said, I’m not sure how much leg he has to stand on for using the word nginx itself in the new product’s name and domain…

amne 3y ago
He *is* nginx ? https://freenginx.org/hg/nginx https://freenginx.org/hg/nginx I don't see it. Sure, he contributes. But in the last 3-4 years he definitely does not look like he is nginx based on that log. Or am I looking in the wrong place?
- ComputerGuru 3y ago
  There's something wrong with the list. It's ostensibly sorted reverse chronologically but scroll further and you'll see it go from 2020-03-03 to "9 months ago" and from there on it's all him.
  - jcranmer 3y ago
    Judging from the graph view (https://freenginx.org/hg/nginx/graph https://freenginx.org/hg/nginx/graph), it has to do with the QUIC branch landing onto the main branch, suggesting he had little role in the QUIC development but heavy role outside of it.
- flawi 3y ago
  I think the mercurial log is not doing us any favors here, most of the first few pages is the history of the `quic` http/3 support branch which indeed Maxim is not working on. Scroll past it and he'll be much more prevalent. See for example the log of stable-1.24: https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac https://freenginx.org/hg/nginx/shortlog/420f96a6f7ac
- jbverschoor 3y ago
  And that's how 100x developers don't get the recognition they deserve.

sschueller 3y ago

Is this what the security disagreements is about https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6M...?

MZMegaZone 3y ago
Yep. Maxim did not want CVEs assigned.
- tptacek 3y ago
  MegaZone as in Usenet MegaZone?
  - MZMegaZone 3y ago
    No, a MegaZone. Haven't you heard, we come in six packs now. ;-) Yeah, very, very likely one and the same. Since 1989.
    - tptacek 3y ago
      Wow, that's a throwback. I was an ISP person back in the Portmaster era. You're at F5 now, I guess! Can you say more about the CVE thing? That seems like the opposite of what Maxim Dounin was saying.
      - MZMegaZone 3y ago
        Yeah, I've been with F5 since 2010 - gotta love those old PortMasters though, Livingston was good times, until Lucent took over. I was there 95-98. I don't know what else there is to say really. The QUIC/HTTP/3 vuln was found in NGINX OSS, which is also the basis for the commercial NGINX+ product. We looked at the issue and decided that, by our disclosure policies, we needed to assign a CVE and make a disclosure. And I was firmly in that camp - my personal motto is "Our customers cannot make informed decisions about their networks if we do not inform them." I fight for the users. Anyway, Maxim did not seem to agree with that position. There wasn't much debate about it - the policy was pretty clear and we said we're issuing a CVE. And this is the result as near I can tell. Honestly, anyone could have gone to a CNA and demanded a CVE and he would not have been able to stop it. That's how it works.

pbaam 3y ago

What a coincidence, some days ago I was reading some HN posts related to lighttpd and I found [1]. The link is dead and it has inappropriate content, so use arhive.org. The author doesn't go too much in detail of why nginx being purchased is a problem, but in how to configure lighttpd. And the first comment predicts the hypothetical case of F5 being problematic. [1] https://news.ycombinator.com/item?id=19413901 https://news.ycombinator.com/item?id=19413901

synergy20 3y ago
I have been using lighttpd which can also host static content and do proxying, on top of those lighttpd supports cgi/fastcgi/etc out of the box as well, and it takes 4MB memory only by default at start, so it works for both low end embedded systems and large servers.
- nullify88 3y ago
  I've recently needed to build a docker image to run a static site. I compiled busybox with only it's httpd server. It runs with 300kb of ram with a scratch image and tini. I didn't compile in fastcgi support in to my build, but it can be enabled.
  - synergy20 3y ago
    yes busybox httpd or civetweb is even smaller, both around 300kb. for tini you mean https://github.com/krallin/tini https://github.com/krallin/tini? how large is your final docker image, why not just alpine in that case which is musl+busybox
    - nullify88 3y ago
      Yep that tini. The docker image is about 1.90mb. It's a repack of https://homer-demo.netlify.app/ https://homer-demo.netlify.app/ I pre-gzipped a few of the compressible file extensions too so they can be served compressed. In this case, I didn't need alpine. I generally aim to get the image as minimal as possible without too much hassle. I end up doing stuff like this alot when I feel like a community image maybe too bloated when something like alpine or distroless can be used. Entry point scripts have all kinds of envars and a shell dependency, I'd rather rebuild the image to cater for my needs and execute the binary directly, and mount in any config via k8s.

arter4 3y ago

I admit I haven't followed closely this issue, but what is he talking about? >In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.

MZMegaZone 3y ago
We (F5) published two CVEs today against NGINX+ & NGINX OSS. Maxim was against us assigning CVEs to these issues. F5 is a CNA and follows CVE program rules and guidelines, and we will err on the side of security and caution. We felt there was a risk to customers/users and it warranted a CVE, he did not.
- tky 3y ago
  This seems like a much larger story than the fork, given the install base of nginx. For clarity are you referring to CVE-2024-24989 and -24990 (HTTP/3)?
  - MZMegaZone 3y ago
    Yes, those are the two CVEs I was referring to. All I know is he objected to our decision to assign CVEs, was not happy that we did, and the timing does not appear coincidental.
    - mike_d 3y ago
      QUIC in Nginx is experimental and not enabled by default. I tend to agree with him here that a WIP codebase will have bugs that might have security implications, but they aren't CVE worthy.
      - MZMegaZone 3y ago
        We know a number of customers/users have the code in production, experimental or not. And that was part of decision process. The security advisories we published do state the feature is experimental. When in doubt, err on the side of doing the right thing for the users. I find that's the best approach. I don't consider CVE a bad thing - it shouldn't be treated like a scarlet letter to be avoided. It is a unique identifier that makes it easy to talk about a specific issue and get the word out to customers/users so they can protect themselves. And that's a good thing. The question I ask is "Why not assign a CVE?" You have to have a solid reason why not to do it, because of default is to assign and disclose. I don't think having the CVEs should reflect poorly on NGINX or Maxim. I'm sorry he feels the way he does, but I hold no ill will toward him and wish him success, seriously.

qwertox 3y ago

Time for me to slowly start looking for an alternative. There was a time when I wanted to move away from it and was eyeing HAProxy, but the lack of the ability to serve static files didn't convince me. Then there was Traefik, but I never looked too much into it, because Nginx is working just fine for me. My biggest hope was Cloudflare's Rust-based Pingora pre-announcement, which was then never published as Open Source. Now that I googled for the Pingora name I found Oxy, which might be Pingora? Googling for this yields > Although Pingora, another proxy server developed by us in Rust, shares some similarities with Oxy, it was intentionally designed as a separate proxy server with a different objective. Any non-Apache recommendations? It should be able to serve static files.

pablopr3 3y ago
Maybe take a look at Caddy (https://caddyserver.com/ https://caddyserver.com/)
- jbverschoor 3y ago
  Well, until you read https://news.ycombinator.com/item?id=39351026 https://news.ycombinator.com/item?id=39351026
  - mholt 3y ago
    And? (That isn't about Caddy, rather a third-party plugin.)
    - kuschku 3y ago
      Have you finally decided to match FQDN URLs correctly? I'd love to get rid of the part of my clients' codebase that starts with // workaround for broken caddy servers
    - SuperQue 3y ago
      Also, it's not always about vulnerabilities directly, but how well / fast things are patched.

petecooper 3y ago

Page won't load for me, Wayback Machine caught it: https://web.archive.org/web/20240214184151/https://mailman.nginx.org/pipermail/nginx-devel/2024-February/K5IC6VYO2PB7N4HRP2FUQIBIBCGP4WAU.html https://web.archive.org/web/20240214184151/https://mailman.n...

petecooper 3y ago

Mailing list discussion: https://forum.nginx.org/read.php?2,299130 https://forum.nginx.org/read.php?2,299130

687m786m78 3y ago

It is scary to think about how much of web relies on projects maintained by 1 or 2 people.

ironmagma 3y ago
Not that scary when you remember there are some systems that haven't been significantly updated for decades (e.g. the Linux TTY interface). A lot of stuff can just coast indefinitely, you'll get quirks but people will find workarounds. Also this is kind of why everything is ever so slightly broken, IMHO.
- szundi 3y ago
  Not the web though
  - ironmagma 3y ago
    Certainly the web can mostly coast indefinitely. There are webpages from decades ago that still function fine, even that use JavaScript. The web is an incredibly stable platform all things considered. In contrast, it's hard to get a program that links to a version of Zlib from 10 years ago running on a modern Linux box.
    - quickthrower2 3y ago
      The web is the calm looking duck that is paddling frantically. You want to be using SSL from the 90s, or IE vs. Netscape as your choice etc. Nostalgia aside!
    - 5- 3y ago
      this problem -- great forward compatibility of the web -- has been taken care of with application layer encryption, deceitfully called "transport layer" security (tls)
    - KronisLV 3y ago
      > Certainly the web can mostly coast indefinitely. I'm not sure about that, for anything besides static resources, given the rate at which various vulnerabilities are found at and how large automated attacks can be, unless you want an up to date WAF in front of everything to be a pre-requisite. Well, either that or using mTLS or other methods of only letting trusted parties access your resources (which I do for a lot of my homelab), but that's not the most scalable approach. Back end code does tend to rot a lot, for example, like log4shell showed. Everything was okay one moment and then BOOM, RCEs all over the place the next. I'm all for proven solutions, but I can't exactly escape needing to do everything from OS updates, to language runtime and library updates.

q2dg 3y ago

Just use Apache

jdoss 3y ago
As someone who used Apache 1.3.x through 2.x heavily from 2000 to 2015, I respectfully disagree with this statement. Nginx and Traefik are easier to configure, have better communities and in most cases perform better. Traefik Opensource is my go to for almost all of my use cases theses days and I have never stopped and said hmmm I wonder if Apache would do better here. It is that good.
stop50 3y ago
Apacge still can't work as an reverse proxy for servers that utilize unix sockets.

notsosubtle 3y ago

https://my.f5.com/manage/s/article/K59427339 https://my.f5.com/manage/s/article/K59427339 All F5 contributions to NGINX open source projects have been moved to other global locations. No code, either commercial or open source, is located in Russia. yeah, yeah

BadHumans 3y ago

Tangent, but I got curious about contributing so I went to the Freenginx homepage, it looks like this project will be organized over mailing list. I would love if someone would create a product that gives mailing list a tolerable UI.

fmajid 3y ago
SourceHut? It’s a forge organized around an email rather than pull request workflow.
dqv 3y ago
Have you tried HyperKitty/Postorious? Does it get closer to what you would consider tolerable? https://mail.python.org/archives/list/mailman-users@python.org/ https://mail.python.org/archives/list/mailman-users@python.o...

darkhorn 3y ago

I don't understand why some people use a Russian software! Especially in this age.

LinuxBender 3y ago
In some cases there are not great alternatives that fit the needs. I have not found anything that matches LFTP Using the mirror subsystem with SFTP and connecting to chroot SFTP servers. It replicates the behavior of rsync in a chroot SFTP-only environment. Only downside is that since there isn't a syncing daemon on the other side, directory enumeration is much slower. File transfers are exponentially faster however as it can do as many SFTP sessions as desired for batches of files or even one big file with the only limit being the bandwidth from client to server. For NGinx I have been able to make use of HAProxy and Apache just fine. Long ago Apache was slower than NGinx but ever since APR 1.7 and Apache 2.4 there are about the same performance wise. Some here don't like the configuration syntax but I am used to it.
ijhuygft776 3y ago
Because they aren't short sighted like some others?
WesolyKubeczek 3y ago
While I may share the general sentiment, there’s a freaking lot of “Russian software” out there which you may be knowingly or unknowingly use. There is JetBrains, for example. But there is also core-js which is a little polyfill library being used by like way more than half of high profile websites. Also written by a Russian national. If you excise all contributions by Russian nationals to PostgreSQL or the Linux kernel, they will be left in a not very runnable state, I’m afraid. On the other hand, it’s not like you are giving them money directly, unless you do; I also can see that in, say, both Linux and PostgreSQL there is also enough people from the “geopolitical opposition” so that even if the Russian contributors are asked by some stern people from the Apparat to sneak something backdoory in, it will be sniffed rather quickly and prevented from going much further. So tl;dr is that there is no simple response.
- 3y ago

rdl 3y ago

Curious how to support Maxim despite Russia complications.

fareesh 3y ago
bitcoin solves this

dmacvicar 3y ago

It seems every time I read about a project being forked, they use the (probably) trademarked name in the project's fork, just to need a rename a few weeks after.

web3-is-a-scam 3y ago

Apache my beloved

stop50 3y ago
I only use apache on one server: as an dav server, since i could not find a simple dav server(nextcloud is for that already too much) and nginx as an frontend for that, since i use some servers with unix sockets which apache still doesn't support.

chrisweekly 3y ago

Note for some reason Maxim chose to link to http://freenginx.org http://freenginx.org, instead of https://freenginx.org https://freenginx.org

EasyMark 3y ago
typo? it forwards to https anyway.
- brunoqc 3y ago
  Are you sure? not for me
- tehbeard 3y ago
  Pretty sure that's an extension on your part. Neither chrome/firefox/cURL redirects that to https for me.
  - EasyMark 3y ago
    you're right I forgot about https auto forwarding in my browser as default.

deleted 3y ago

[deleted]

INTPenis 3y ago

If I ever need nginx I'll use freenginx. But funny enough all my services run in Traefik these days. 15 years ago Apache httpd was the norm, and lately nginx has been, and now I can't even think of a reason to use it.

nimbius 3y ago

>freenginx.org IANAL, but i strongly recommend reconsidering the name as the current one contains a trademark.

tiffanyh 3y ago
They could take the Postgres naming approach. Ingress was forked; the Post fork version of Ingress was called "Post"gres. So maybe name this new project "PostX" (for Post + nginx). Though that might sound too similar to posix.
- virtualwhys 3y ago
  "Postginx" has a nice ring to it, could be an alcoholic beverage, a name of a generation, or even a web server.
  - diego_sandoval 3y ago
    gintonx
    - agateau 3y ago
      Sounds like an character from the Asterix comic book :)
- icybox 3y ago
  ... and postfix
- anotherhue 3y ago
  Go roman? nginxii ?
  - bandie91 3y ago
    are we at the twelfth fork? :)
- 3y ago

resolutebat 3y ago

Per the discussion at https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312, this cryptic shade: > Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position. Refers to F5's decision to publish two vulnerabilities as CVEs, when Maxim did not want them to be published.

fl0ki 3y ago

Given this fork still boasts a 2-clause BSD license, the corporate nginx can still make the effort to backport patches. It's certainly harder than requiring a single converged development branch, but how closely they track Maxim's work is ultimately up to them. If nginx continues to receive more attention from security researchers, I imagine Maxim will have good reasons to backport fixes the other way too, or at least benefit from the same disclosures even if he does prefer to write his own patches as things do diverge. Though history also shows that hostile forks rarely survive 6 months. They either get merged if they had enough marginal value, or abandoned outright if they didn't. Time will tell.

WhyNotHugo 3y ago
I'm curious to see where this fork will go. The whole situation is a mess: - nginx is "open core", with some useful features in the proprietary version. - angie (a fork by several core devs) has a CLA, which sounds like a bait and switch waiting to happen and distro's won't package it - freenginx is at least open source. But who knows if it'll still be around by June.
- spindle 3y ago
  FWIW, nixpkgs packages angie
- perlgeek 3y ago
  I remember being surprised by the open core thing some years ago. I had been an Apache user for quite some time, and thought I'd take a look at the (at that point, a few years old) "new" shiny thing. I found that something as simple as LDAP authentication required a payed plugin; a free Apache module has been available for this for ages. That made nginx a non-starter for this particular use case. I wonder if the fork will accumulate free plugins for things that the old core required payed plugins for, slowly eroding their business case.
  - nly 3y ago
    Most of this simple premium features/plugins were probably funded by companies because they had business value. It's probably unlikely freenginx will re-create them without those contracts. Unpaid Open Source developers tend to focus on interesting/cool core stuff and ignore all the stuff businesses care about (like LDAP authentication).

thomasjudge 3y ago

How the heck am I supposed to pronounce that? "Free-en-gen-icks"?

000ooo000 3y ago
Freen Ginks

lyu07282 3y ago

seems like an annoying but necessary thing, so lets give the original a quick death and migrate to freenginx Infrastructure like that should not be run by for-profit corporations anyway, it will always end up like in this case sooner or later

darylteo 3y ago

F5 closing moscow office: Is this a result of US sanctions?

nginxsjsjn 3y ago

Well maybe this core dev can impact some better malware into it and update the defaults. Nginx loves to pretend it’s 1995. It barely has http3 support and does insanely stupid things by default. No wonder people move to haproxy, Traefik, caddy, etc. Cloudflare doesn’t use it anymore for good reason.

webprofusion 3y ago

One of the most heavily used Russian software projects on the internet https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-nginx/ https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-n... but it's only marginally more modern than Apache httpd. In light of recently announced nginx memory-safety vulnerabilities I'd suggest migrating to Caddy https://caddyserver.com/ https://caddyserver.com/

andrewstuart 3y ago

After using Nginx for something like 15 years I dropped it a couple of years ago. Using Caddy instead. A point came where I realised I didn't enjoy Nginx. Configuring it was hard and it felt brittle. A particular pain point is certificates/ssl. I absolutely dreaded doing anything with certificates in Nginx. When I heard that Caddy automatically handles SSL/ certificates I jumped the nginx ship and swam as fast as I could to Caddy.

someoneinworld 3y ago

Just curious how do folks make a living with free contributions not associated to any company? Is it sponsorships or they do some contract work on the side ? It feels these devs are soo underappreciated for the tremendous work they do, so much in software is supported on so many of these projects and companies dont sponsor or do the right thing !

snizovtsev 3y ago
Living in Russia could be very cheap compared to other countries. If you own a flat and you don't need cars or travel, then it's possible to live a few years just on money saved from your previous software job.
- someoneinworld 3y ago
  But its still seems like a massive system failure which cant help folks who have built that is used by so many industries.

Vosporos 3y ago

Godspeed

udev4096 3y ago

Judging from the comments of the guy from F5, it seems that Maxim didn't wanna assign a CVE to the latest vulns. I wonder why

SomeoneFromCA 3y ago

NGINX are FSBs shills.

apatheticonion 3y ago

My biggest gripe as an internet keyboard warrior with an opinion is not being able to understand the source control and build process of Nginx. Probably a skill issue but when I last tried to compile Nginx from the Github mirror I spent hours trying to figure it out. I wish there was a GitHub page with an easy to understand build process... and that I could just run "cargo build --release" lol

scandox 3y ago
./configure make make install I just ran this to be sure I wasn't delusional and it took only 2 minutes.
- apatheticonion 3y ago
  Really? https://github.com/nginx/nginx/tree/branches/stable-1.24 https://github.com/nginx/nginx/tree/branches/stable-1.24 I cloned this and it doesn't have a makefile or configure script Neither does the official repo? https://hg.nginx.org/nginx/file/tip https://hg.nginx.org/nginx/file/tip Do you run it from /auto/?

seunosewa 3y ago

I hope he implements the least connection load balancing option for free users.

aaroninsf 3y ago

Dissatisfaction, like water, will always find its level.

deleted 3y ago

[deleted]

aftbit 3y ago

I dunno seems like a tempest in a teapot. Not sure why Maxim would not want CVEs to be assigned to something. Maybe it was just the final straw after a series of bad interactions. Every project has a lifespan, sometimes trying to keep them going forever is not the answer. I will miss nginx a lot if I need to migrate though.

mistrial9 3y ago
no - the CVE process is at the center of new broad laws in the EU regarding business registration and security assurances. You are exactly wrong about the significance of this fork, basically. see EU CRA

liveoneggs 3y ago

This fork should use the Apache Foundation for its hosting and things.

deleted 3y ago
[deleted]

DeathArrow 3y ago

I hope some people will find the time to help him.

scrps 3y ago

Bravo!

soupbowl 3y ago

Did we find out why the dev of freenginx did not want the nginx CVE that caused this fork? Some contex would be nice as it seems like a weird reason to fork.

SushiHippie 3y ago
https://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312
gertrunde 3y ago
IIRC from reading the post, the reasoning was that the bug was in a feature which was marked as experimental (HTTP/3).

robgibbons 3y ago

It was already mentioned in the other thread, but it looks like F5 owns the trademark for the Nginx name. Maxim should consider rebranding the project to avoid any legal blowback.

austinjp 3y ago
As I suggested elsewhere [0] if you bump each letter in nginx you get... ohjoy! [0] https://news.ycombinator.com/item?id=39376657 https://news.ycombinator.com/item?id=39376657
- RamRodification 3y ago
  Fun but bad!
- temp0826 3y ago
  I feel like scrambling the letters to "ginnx" (pronounced jinx?) or something might be better.

not_a_dane 3y ago

Just looking at comments here makes me feel like this is pretty much underrated.

lnxg33k1 3y ago

Innovation is being kept hostage by MBAs, marketing, PR and recruiters

Reelix 3y ago

So - The big question... Is the fork going to allow you to change the nginx Server response header (A PAID feature in the current fork...) without requiring you to mod it in and recompile it? :p Yes - You read that correctly. They refuse to accept PR's to add additional functionality because that functionality is restricted to the paid version :p

egberts1 3y ago

I stop using Nginx when i needed ability to assign an Ethernet port (IP address not yet available) and Nginx developers refused to do this. Before you ask why would I do that, Ive got all Ethernet interfaces on dynamically IP created on a on-demand basis and only wanted ONE specific interface (non-public) to host the HTTP/HTTPS protocol. And no, we do not want to jerry-rig some fancy nginx config file shell -script updater whenever an IP address gets assigned/reassigned. Here came lighthttpd and Apache to the rescue.

frikkie444 3y ago

F5 is spinning this to be about not disclosing CVE's when the truth is more that the experimental code that was flagged was not considered production ready and whomever is running it should know they are on their own. This CVE is an obvious bug, and when your KPI is CVE's per month every bug looks like a CVE F5 wants this feature prioritized over what Maxim planned, and Maxim doesn't have to comply, he is a volunteer.

devosalain 3y ago

Is F5 trying to kill the original nginx. [Cfr hostile take-overs of Microsoft]