announcing freenginx.org
announcing freenginx.org
Maxim Dounin announces the freenginx project.
As such, starting from today, I will no longer participate in nginx development as run by F5. Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities:
The name of this project is a death sentence. F5 owns the NGINX trademark. A successful fork of this will need to have a new name.
When Oracle ruined Hudson, the community forked it and renamed it to Jenkins, and Oracle lost their investment. The same should be possible with NGINX (BSD vs. MIT, IANAL).
He's russian. Trademarks and copyright doesn't matter.
That might be true inside Russia, but not in the rest of the world. F5 could sue in the US and force the registrar responsible for the .org TLD to hand the domain to them.
In his place, I would chosen something related but different enough to avoid trademark infringement, like "Freeginx". IANAL, but I believe sometimes all it takes is one letter to keep lawyers away.
IMO he would have been better off reversing the letters to something like XNGIN2 or some other clever play on the old theme.
Besides the new name being problematic it's plain aweful.
Feels like Gentoo ==> Funtoo -- Gentoo is a infinitely better name IMO.
TLDR; F5 owns Nginx. Making corporate over security decisions. New community fork from one of the core devs at http://freenginx.org/. Too new to know if it will be adopted by other mainstream projects that currently leverage/embed nginx.
Note: If you use nginx and are concerned about security, consider a look at projects such as
owasp/modsecurity-crswhich include security layers on top of nginx.That doesn't seem to be the case. From what I read on HN, the dev quit because he thought it didn't make sense to submit CVEs for temporary/wip solutions, and F5 thought otherwise.
So as I see it, the developer quit because he didn't agree that a CVE should be opened for a work-in-progress solution that was live on Nginx.
So basically just drama?
That's what I read, too.
It gives a new perspective on the subject.Sad to see the workforce being split up, though.
Making corporate over security decisions.
I read the opposite essentially, that F5 is publishing CVEs and the dev did not want them to.
Yeh, seems like the CVEs were against an alpha branch.
So, perhaps its a good reminder not to use alpha in production... But I feel it warranted a bug report instead of a "Common Vulnerabilities and Exploits" notice, normally something used to notify potentially production deployed systems of an issue.That would be like Pepsi issuing a product recall to all retail outlers for a product that has only been tested internally (kinda)
I'll justbuse this excuse to repost my thoughts from the other threas https://lemmy.ml/comment/8358568
Sad to see such an established project split up
Kudos!
Does it actually make sense to call it free nginx? It seems like that'd just cause confusion, especially if the projects diverge. Most of the time when this happens they choose a new name (like MariaDB vs MySQL)
That being said, I wish the project all the best. I use nginx both professionally and personally so I'll be keeping an eye on this.
probably wont be the name for long anyway.
aparently F5 Networks. owns a trademark for nginx.
That makes it even worse then 😅. The whole thing seems kind of silly
A few years ago some other nginx devs also split off to create the fork Angie. I wonder why they didn't join forces. My guess would be egos.
The "angie" fork shares the same problem as nginx run by F5: it's run by a for-profit corporate entity. Even if it's good enough now, things might change unexpectedly, like it happened with F5.
https://mailman.nginx.org/pipermail/nginx-devel/2024-February/YIFSHIYSKDFBYZ2QRA3WF6SRPGIBDBKI.html
Sounds great. I hope this project succeeds.
Does nginx give me anything over apache httpd in the year of our lord 2024? I've used both for hosting servers but never really understood the difference, as apache seems to have incorporated the important improvements that nginx made iirc.
Using both, too.
Supposedly NGINX gives you better peak performance and the configuration file format is more popular.
I would guess that peak performance is only a concern when being google/netflix/amazon, otherwise I would bet the bottleneck is somewhere else.
Further, NGINX seems to have become the default reverse proxy for all start ups, companies etc. around 10 years ago and thanks to group thinking by now one has to explain when using something else than NGINX.
What I really miss from Apache is Apaches awesome letsencrypt module w/o the need for certbot. (If somebody knows about a module for NGINX which takes care of letsencrypt w/o certbot, please enlighten me.)
In summary: Technical Apache and NGINX are IMHO mostly interchangeable (outside of peek performance demands), but the market/herd/group think prefers NGINX.
Sorry, but you don’t get to claim groupthink while ignoring state of Apache when Nginx got released.
Apache was a mess of modules with confusing documentation, an arsenal of foot guns, and generally a PITA to deal with. Nginx was simpler, more performant, and didn’t have the extra complexity that Apache was failing to manage.
My personal first encounter was about hosting PHP applications in a multiuser environment, and god damn was nginx a better tool.
Apache caught up in a few years, but by then people were already solving different problems. Would nginx arrive merely a year later, it would get lost to history, but it arrived exactly when everyone was fed up with Apache just the right amount.
Nowadays, when people choose a web server, they choose one they are comfortable with. With both httpds being mature, that’s the strongest objective factor to influence the choice. It’s not groupthink, it’s a consequence of concrete events.
It's weird but I'm siding with the company on this one. With what little context we've been given the dev sounds like a stereotypical reddit moderator.
How so?
From what I understood the company who owns Nginx decided to give CVE ratings to experimental features, but those were for the stable branch. The dev disagreed because they were "experimental" but the company wanted to give them anyway because it was the stable branch used in production.
I don't understand what was so bad about this direction that the company wanted to take that the dev threw a hissy fit about corpos bad, decided to leave, and start his own fork. It's an insane overreaction IMO, maybe I've misunderstood something so IDK which is why my opinion is that the dev is a moron.
"Freen Ginks"
I sympathise with the dude dev but corporate loves corporate; I dont think the project is going to attract much funding if it's purely a 'libre' fork.