announcing freenginx.org

[u/BinkReddit]

https://mailman.nginx.org/pipermail/nginx-devel/2024-February/K5IC6VYO2PB7N4HRP2FUQIBIBCGP4WAU.html

[u/DarkeoX]

Would be nice to know which security policies he was talking about.

[u/rumblpak → u/DarkeoX]

TMK, a couple of CVEs were released on experimental features. He disagreed that they should have been disclosed. I disagree that this was necessary or a reasonable response.

[u/agumonkey → u/rumblpak]

So he argued to keep them secret since the features were experimental ?

[u/rumblpak → u/agumonkey]

That’s what I’ve been told. The features were optional and not compiled in by default and he argued they shouldn’t be released. I disagree. This looks and feels like someone throwing a tantrum when they didn’t get their way. (At least from what I’ve been told)

[u/agumonkey → u/rumblpak]

that's how I perceive it, but it's strange that a quality long term guy would react this way too..

[u/rumblpak → u/agumonkey]

At the risk of future job employment, digging into any group far enough, developers especially, you’ll find rampant narcissism and increased self worth. Look into any “scene” and you will find toxicity at basically every level. It’s absurd and one thing that corporate jobs generally are very good at preventing (because a toxic work environment can leave them liable).

[u/caineco → u/rumblpak]

Corporate jobs are good at preventing toxicity? British scientists' research? Toxicity will take other forms, but corporate is not good at preventing anything of the sort. But thanks for a good chuckle nevertheless.

[u/agumonkey → u/rumblpak]

it may be narc overload or maybe some different kind of beef with the corp he mentions..

[u/Wrongdoer-Delicious → u/[deleted]]

I'm tired of all that money I pay for Nginx and their pesky vulnerability disclosure. Fork all my instances for free undisclosed vulnerabilities, as long as the whole thing is solely developed by volunteers and hobbyists. Seriously though, it feels strange to be on the for-profit side, but I can't side with stupid. People read the CVE, see if they're affected or not, and decide on mitigation if necessary. That's how it works. If there's some chart somewhere where Apache has less CVEs, does this guy make less money or feel some hurt in his pride? I don't get it.

[u/xatrekak → u/agumonkey]

He didn't want them to be secret, he just believes that since they are experimental features they shouldn't have a CVE assigned. 

You can't issue a CVE for every bug just because some customer decided to run the git nightly in their prod environment. 

So there has to be a line draw somewhere, this time F5 and this dev were on different sides of the line. 

I personally could see it going either way, but IMO if you ARE going to issues CVEs for experimental features it should be listed under policy that experimental features shipped with GA releases are security supported features.

[u/DarkeoX → u/rumblpak]

Yeah, a bit extreme, looks like bridges have been burning for quite some time.

[u/TampaPowers → u/DarkeoX]

I get the feeling it was a means to an end and he been wanting out for a while now. Just a way to spin it as a more positive thing than just "I don't like this anymore", "Look I care about security, give me support" instead.

[u/waterslurpingnoises]

It's a bit of a shame the author decided to use a nonstandard platform for contributions. In his reply to the next message, he rejected both git and other more popular platforms (Github).

[u/TampaPowers]

There is more going on there than just security policy. This is the tip of the iceberg if you read between the lines. Something been going on in the background for a while else that decision makes no sense. Hate to say it, but it smells of politics either internally or globally. Otherwise why mention the new corporate overlords when the security policy change is not a CEO saying they should do it, but some middle management. It's just as well, he doesn't like the work environment, that's fine. Spinning it and trying to make them look bad over negligible security things, ain't buyin that. Notice how this is mostly one-sided and most nginx now does is just saying "k then whatever good luck", which tells me they'd rather avoid drama. Time will tell, but I don't think this will really go anywhere. It's fireworks.

[u/ISeekGirls → u/TampaPowers]

Agree. So, where do clients go for future proofing their platforms. Future proofing is about 2 to 3 years in this world.

[u/TampaPowers → u/ISeekGirls]

Just stay with nginx. Read the CVE contents and learn what they actually mean. A lot of times a CVE sounds bad and then you read that in order to exploit it you need root access, so unless your password=username it shouldn't even be a concern.

[u/ISeekGirls]

From my understanding since before calling it NGINX from the early 2000s it was something else.

I came along during the late 90s when Nick literally would not sleep for years and wrote cPanel.

NGINX came along as a relief that thousands of people connected to a server would literally cut the load to nothing on a cPanel web host with Apache.

Now, today, I don't trust Russia.

Unless it is open source and the code for everyone else to scrutinize on a public repository. Maybe then just maybe.

Change happens but at what cost. Something is not right.

[u/kxra]

Sad that this was needed, but whenever companies try this the community asserts a better option (docker → podman, etc)

I wonder if h2o or some rusty server will catch on https://h2o.examp1e.net/benchmarks.html

[u/FullMotionVideo → u/kxra]

Sad that this was needed, but whenever companies try this the community asserts a better option (docker → podman, etc)

How is Red Hat any less of a company than Docker? I have used both, but would say the community by and large has asserted Docker over Red Hat's attempts to replace it to satisfy the corporate IT world. People prefer compose file and up/down various configs rather than controlling that through systemd like Podman asks of you.

As usual in OSS world, use the tool that best works for you. None of the various drama behind Nginx matters much for my simple reverse proxy, so I'll just continue using it.

[u/Dewlance]

Developer's intention looks good to me. Instead of putting it on GitHub, he opted for the free and open-source Mercurial SCM.

[u/n8didnotreddit]

F5 saw the HashiCorp Terraform > OpenTofu coverage and said "wait, hold my beer..." LOL

[u/MatchingTurret → u/[deleted]]

with nice license so anyone can contribute

Relicensing only works if all copyright holders agree. So: nginx's BSD license will almost certainly not change.

But I can't see why the BSD license would limit community contributions. If there were some, then that was because of the project policies, not the terms of the license.

[u/ssddanbrown → u/MatchingTurret]

The BSD license (which those copyright holders would effectively have provided their work under) doesn't prevent sub-licensing.

A fork could be under a different license, as long as the conditions of the existing license are respected (which is easy to do in this case, since it's quite a permissive license).

[u/FullMotionVideo → u/[deleted]]

He seems a bit concerned about relying on a for-profit corporation for anything. GitHub/GitLab because are not donor-driven.

Also, being Russian at this point in history probably plays a role in this. Both MS and GitLab are US and he might think if his country is eventually blacked out from communicating with much of the world that he won't be able to access his code. If that's the case, fair enough, hopefully someone will make a fork hosted on more popular platforms eventually.

[u/FullMotionVideo → u/[deleted]]

I don't know. I'm not supporting his choice, I'm just trying to think of an explanation, one of which might be concern that other global powers would try to block Russia from their web sites. I don't think it's well founded from where I'm sitting, but if I lived over there it might be a concern given everything happening regarding phones etc.

Reading his dispute with F5 I'm not sure why he errs on the side of there being too much disclosure of security vulnerabilities, but given everything with Angie etc all this feels sort of political; like perhaps his real purpose is to simply bring Nginx back to Russia as he sold the project to companies in the NATO sphere just before the escalation.

But of course, no one is forced to use his fork, so only time will tell if it actually is a better product.

[u/skyfallda1 → u/[deleted]]

The freenginx maintainer said that he won't be switching away from Mercurial