News for hackers. Stuff that matters.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by trey-jones on Friday September 24, 2021 @02:19PM (#28646005)
About a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share.

A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine for most applications.

There are other reasons to use nginx, and there are other reasons to use Apache. Both are fine, and I hear https://caddyserver.com/ is coming in hot!

Re:Developers fix multitude of vulnerabilities in Apache HTT... by jart on Friday September 24, 2021 @04:57PM (#28647728)
redbean is a pure fork() web server and according to ab it is much faster than nginx. I feel like we've come full circle with history. Apache started off with fork() since it offers the strongest security versus other i/o models. The problem is that code bloat makes fork() go slower so as Apache ballooned over the years there was this race to the bottom in terms of i/o models, caused by tragedy of the commons. https://youtu.be/1ZTRb-2DZGs?t=761
Re:Developers fix multitude of vulnerabilities in Apache HTT... by xorcist on Friday September 24, 2021 @05:00PM (#28647759)
To be fair, the event worker in Apache and nginx are roughly the same age, 2004.

Smaller web servers have been event based since they first showed up, it is the natural way to build them. There was no epoll() available, but a select() loop is pretty much the same thing. The super useful thttpd had been around a long time at that time.

What caused people to start using non-forking web servers for regular public web applications was probably that PHP finally got a stable FastCGI mode going about ten years ago. Because, honestly, most of the web is PHP and it was even more dominant back them.

And when people posted their web server configs in forums at that time, nginx configs were much more readable and concise. The easier config format is what caused its popularity to soar, not that it used a particular syscall half a decade earlier.

Re:Developers fix multitude of vulnerabilities in Apache HTT... by innocenat on Friday September 24, 2021 @11:31PM (#28650247)
I agree wholeheartedly that php-fpm rapidly speed up nginx adoption.

Before nginx, lighttpd was a thing. It also comes with `spawn-fcgi` to handle fastcgi, but it's a little complex to set up. Back then people were also using `spawn-fcgi` with nginx, too. I remembered reading some tutorial and decided that I will continue to use Apache with mod_php due to complexity. When php-fpm come, I immediately switched.

Re:Developers fix multitude of vulnerabilities in Apache HTT... by trulyme on Friday September 24, 2021 @05:29PM (#28648055)
Nginx configs do look more readable, but they have a lot of gotchas themselves. Quite surprising actually.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by mholt on Friday September 24, 2021 @03:16PM (#28646659)
Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by throw_m239339 on Friday September 24, 2021 @04:07PM (#28647210)
> Yeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.

At the expense of the memory footprint because developed with Go. Hi Caddy creator!

Re:Developers fix multitude of vulnerabilities in Apache HTT... by eric_h on Friday September 24, 2021 @05:26PM (#28648040)
> At the expense of the memory footprint because developed with Go. Hi Caddy creator!

Makes sense to me that something built in a language with more memory safety than C would use more memory, but is it really significant in practice? I use go every day and memory usage has not been a significant issue for many applications.

Re:Developers fix multitude of vulnerabilities in Apache HTT... by arp242 on Saturday September 25, 2021 @02:42AM (#28651025)
I don't use Caddy, but I've written plenty of Go apps (which usually implement their own HTTP server with net/http) with plenty of users, and memory usage has never been much of a concern.

There are other performance concerns of course, e.g. GC latencies, and at times the GC may bite you. See e.g. the "taming Go memory usage" story from a few days ago[1], but this usually isn't a huge concern for many use cases.

[1]: https://news.ycombinator.com/item?id=28608083

Re:Developers fix multitude of vulnerabilities in Apache HTT... by whateveracct on Saturday September 25, 2021 @12:31AM (#28650557)
We're talking about shaving megs here rofl

cmon now

terminal systems engineer brain is everywhere

Re:Developers fix multitude of vulnerabilities in Apache HTT... by SahAssar on Friday September 24, 2021 @04:32PM (#28647450)
Might be nice to disclose your involvement when commenting on caddy-related threads.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by mholt on Friday September 24, 2021 @04:40PM (#28647535)
> I'm the author of the Caddy web server.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by SahAssar on Friday September 24, 2021 @05:05PM (#28647804)
I'm guessing you mean the about section of your profile. I'm just saying that it's nice to make that more visible when you have that sort of involvement in the topic and it is not obvious.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by 0des on Saturday September 25, 2021 @12:38AM (#28650585)
Why? I prefer when people don't flash their badge at me to support their statements. Words should stand on their own without appeals to authority.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by SahAssar on Saturday September 25, 2021 @03:57AM (#28651375)
It's more the other way around, when saying things about your own product it's nice to disclose your involvement since that definitely colors your view. Especially in cases like this where it's hyping the product.
Re:Developers fix multitude of vulnerabilities in Apache HTT... by klaussilveira on Friday September 24, 2021 @05:00PM (#28647750)
Definitely not the right place, but thank you for creating Caddy. :)
Re:Developers fix multitude of vulnerabilities in Apache HTT... by mholt on Friday September 24, 2021 @06:17PM (#28648414)
Thanks, you're welcome!
Re:Developers fix multitude of vulnerabilities in Apache HTT... by killingtime74 on Friday September 24, 2021 @04:18PM (#28647324)
Caddy also does the whole Let’s Encrypt thing for you for SSL
Re:Developers fix multitude of vulnerabilities in Apache HTT... by yourad_io on Friday September 24, 2021 @06:01PM (#28648308)
There's a plugin for nginx that works well:

$ apt-get install python3-certbot-nginx

$ sudo certbot --nginx -d example.com -d www.example.com

https://www.nginx.com/blog/using-free-ssltls-certificates-fr...

On the other hand, caddy seems to auto renew them as well - one less cron job:

> Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed.

https://caddyserver.com/docs/automatic-https

Neat, but still not sold.

Re:Developers fix multitude of vulnerabilities in Apache HTT... by arp242 on Saturday September 25, 2021 @02:38AM (#28651009)
I never cared much for certbot because "sudo certbot" and it works by rewriting config files. I don't really fancy running it as root (which can probably be avoided with some muckery, but still) or a program automatically rewriting my configs.

Overall, the entire thing seems very complex automagic black box last time I tried it (already years ago). Sometimes trying to make something easier can make it harder.

Re:Developers fix multitude of vulnerabilities in Apache HTT... by yjftsjthsd-h on Friday September 24, 2021 @07:41PM (#28648998)
certbot works with apache, if you're willing to spend that effort
Re:Developers fix multitude of vulnerabilities in Apache HTT... by francislavoie on Friday September 24, 2021 @11:47PM (#28650335)
What are you not sold on?