Libressl.org is running apache1

http://www.libressl.org/contact.html

by mrmondo • 12 years ago

6 16 12 years ago

mrmondo3• 12 years ago

Theres a good chance they could be using a version that has backported security fixes, but seriously, look at the amount of known vulnerabilities Apache 1.3.29 has: http://httpd.apache.org/security/vulnerabilities_13.html

userbinator• 12 years ago

1.3.29 was 10 years ago, and the latest 1.3.42 has only one "moderate" flaw. I think there's a pretty good reason why they're not using 2.x.

ams61102• 12 years ago

From the FAQ:

Why isn't a newer version of Apache included? The license on newer versions is unacceptable. Users interested in more modern web servers are encouraged to look at nginx(8) which will hopefully be replacing Apache in base.

(the latter has actually happened as of 5.4)

Also the Apache 1.3 in OpenBSD had been audited as it was part of the base distribution (i.e. not just a port) and it ran chrooted by default.

byroot2• 12 years ago

I don't know much about OpenBSD but I know that they upgraded to Apache 2.X only very recently (1 year max IIRC) and it seems that they still maintain the 1.x version: http://openports.se/www/apache-httpd-openbsd

mrmondo3• 12 years ago

I had someone describe the OpenBSD fork as 'FrankenApache', After they forked it, they clearly struggled to maintain and keep it updated.

copergi• 12 years ago

That someone was mistaken. How exactly do you think they "struggled to maintain" a fork of software that was barely active in the first place? How does "apache but chrooted by default" constitute "frankenapache" exactly? Given that their struggling was so clear to you, could you point me to something that would make it clear to the rest of us?

borando2• 12 years ago

OpenBSD did not upgrade to 2.X. You're talking about ports, which are separate from the base operating system. For accurate information about OpenBSD, right now, check:

http://www.openbsd.org/55.html

Regarding ports, they're basically a compilation build system that complements binary packages (which OpenBSD also has) for 3rd party software not installed with the base system . See:

http://www.openbsd.org/faq/faq15.html#Ports

byroot2• 12 years ago

My bad. So OpenBSD included Apache will still be 1.3 even in the upcoming 5.5. (along a more modern nginx)

Thanks for the info.

thaumaturgy• 12 years ago

Post another submission if you manage to root their server in a way that's relevant to LibreSSL.

borando2• 12 years ago

This is OpenBSD's fork of Apache 1.3. It runs chroot and privsep'd by default, and of course is patched for security issues where necessary. (OpenBSD recently dropped Apache from the base build and is now fully committed to nginx, moving forward.)

mrmondo3• 12 years ago

Thanks for the info, That's great news about Nginx.

psgbg2• 12 years ago

I did just saw a blink tag in http://www.libressl.org/ ?

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/bl...

ams61102• 12 years ago

Check the note at the bottom of the page:

This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

psgbg2• 12 years ago

Hahaha, didn't see that.

The thing was the surprise to see my browser did render it and nostalgia of course.

pieterza• 12 years ago

This is obviously also to annoy hipsters such as mrmondo. ;)

Libressl.org is running apache1

Related Stories