Nginx web server forked as Freenginx to escape corporate overlords
- Reference: 1708104785
- News link: https://www.theregister.co.uk/2024/02/16/freenginx_fork/
- Source link:
US networking vendor F5 [1]acquired Russian web server Nginx for $670 million in 2019. Some of F5's decisions, such as the recent [2]disclosure of CVE-2024-24989 , have not gone down well with at least some of the product's core developers, notably [3]Maxim Dounin , who vocally [4]disagreed with this disclosure. As a result, he [5]announced a fork, called [6]Freenginx .
Dounin told The Reg : "F5 forced developers to make a security release for bugs in the experimental HTTP/3 code, despite the fact that such issues are expected to be handled as ordinary bugs per the existing project security policy, and all developers agree with it. Essentially, F5 ignored both the project policy and joint developers' position, without any discussion."
[7]
Nginx is one of the higher-profile pieces of software to emerge from Russia in recent years. In 2013, The Reg [8]reported it was thriving , and again the following year when [9]it got some additional funding .
[10]
[11]
The takeover by a US company has not gone totally smoothly. Soon after the company was acquired, [12]its Moscow offices were raided due to Rambler Group claiming ownership of the code. Then, in early 2022, F5 [13]closed its Moscow office in response to the Russian invasion of Ukraine.
[14]Forgetting the history of Unix is coding us into a corner
[15]Damn Small Linux returns after a 12-year gap
[16]Drowning in code: The ever-growing problem of ever-growing codebases
[17]PiStorm turbocharges vintage Amigas with the Raspberry Pi
That too resulted in an earlier fork of the Nginx codebase, called [18]Angie . This is also [19]open source , but is owned by Russian vendor [20]Web Server . Speaking of the closure, Web Server co-founder Valentin Bartenev told us: "As a result, many of the most experienced engineers who had been working at Nginx since its founding in 2011 lost their jobs. Naturally, they were not happy with the situation and worried about the fate of Nginx, in which they had invested so much time and effort. So they decided to fork Nginx and start a new company to continue development and go beyond the previous vision."
We asked Dounin why he started a separate fork, rather than working with Angie. He told us: "Angie shares the same problem as Nginx run by F5: it's run by a for-profit corporate entity. Even if it's good enough now, things might change unexpectedly, like what happened with F5."
It is not yet clear how this will pan out, although Bartenev told us that he and his team wish Dounin luck and are happy to work with both F5 and Freenginx. He pointed out that Web Server [21]offered a patch upstream for the HTTP/3 issue already.
[22]
In 2022, we reported how the war in Ukraine had been good for [23]some Russian Linux vendors , and last year on how it had resulted in [24]Russian coders being blocked from contributing. Although F5 has told us that it remains "committed to delivering successful open source projects that require a large and diverse community of contributors," geopolitics will continue to get in the way of international cooperation. ®
Get our [25]Tech Resources
[1] https://www.theregister.com/2019/03/12/f5_networks_nginx_acquisition/
[2] https://my.f5.com/manage/s/article/K000138444
[3] http://mdounin.ru/
[4] https://mailman.nginx.org/pipermail/nginx/2024-February/FRVX4M5JLFSFESRG7RLWWRBZ6D4AKKQU.html
[5] https://mailman.nginx.org/pipermail/nginx-devel/2024-February/K5IC6VYO2PB7N4HRP2FUQIBIBCGP4WAU.html
[6] http://freenginx.org/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zc-pGqkj@KBlRikOhxKi1gAAARA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://www.theregister.com/2013/02/06/open_and_shut/
[9] https://www.theregister.com/2014/12/10/nginx_scores_20_meelllion_to_remind_people_it_sells_stuff/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zc-pGqkj@KBlRikOhxKi1gAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zc-pGqkj@KBlRikOhxKi1gAAARA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2019/12/12/nginx_moscow_office_raided/
[13] https://my.f5.com/manage/s/article/K59427339
[14] https://www.theregister.com/2024/02/16/what_is_unix/
[15] https://www.theregister.com/2024/02/14/damn_small_linux_returns/
[16] https://www.theregister.com/2024/02/12/drowning_in_code/
[17] https://www.theregister.com/2024/02/12/pistorm_accelerated_amiga_pi/
[18] https://angie.software/en/
[19] https://github.com/webserver-llc/angie
[20] https://wbsrv.ru/
[21] https://mailman.nginx.org/pipermail/nginx-devel/2023-December/THMZAQ36SN5BICJSCLX6FLEUI45FHR4H.html
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zc-pGqkj@KBlRikOhxKi1gAAARA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://www.theregister.com/2022/07/09/russian_debianderivative_vendor_plans_ipo/
[24] https://www.theregister.com/2023/03/21/russian_foss_contributions_blocked/
[25] https://whitepapers.theregister.com/
Re: West Good, Russia Bad
Russia is bad. West may or may not be good, but Russia as a country is definitely bad.
Re: West Good, Russia Bad
Exactly.
Russia is a problem. Everybody sane knows Russia is a problem. Attempted genocide isn't something that good countries do.
(Looking at you too, Israel.)
Re: West Good, Russia Bad
Don't confuse governments with people .... you don't get to choose where you are born.
And equally don't confuse religion with countries and governments .... most often you don't get to choose your religion either
Experimental code in mainline
If you don't want the headache of CVEs & the resulting prioritized bug fixes in your experimental code, don't include that code in your mainline branch. Irrespective of the code being enabled by default or not.
nginx isn't a pet project, it's a core piece that underpins today's internet.
Wait, so this is due to a company being too eager to disclose a security issue?
West Good, Russia Bad
West Good, Russia Bad
Thats all you need to know to pick a side on this and other disputes
Carry on