Slashdot Mirror
Virgin Apache is Hard to Find
markcox writes "Apache Week had written an article examining the Apache packages distributed by 10 popuplar Linux vendors. The survey found that all the vendors added some patches to virgin Apache including build patches, backported security patches, changing the product name through to dubious patches, and missed security fixes."
From the apache site:
http://www.apache.org/dist/httpd/
...when they read about trying to find virgin Apache? Perhaps headlines like this are part of the reason the tribes don't like native American references on sports teams, products, etc.
The strangness that various distros impart to apache is why I usually start with Apache Toolbox. This uses wget to automatically download any missing source, and currently supports 60+ third party modules in addition to the 36 apache modules which are included in standard source distribution. For redhatters, this even halts appropriately for RPMs that cause problems. Works on slowaris, and pretty much any BSD/*NIX with gcc. I'm not a member of this project or anything, just a fan: it just works.
http://tinyurl.com/4ny52
It shouldn't be too difficult to find plenty of virgins around here :)
*rimshot*
and ... ?
NetBSD's ports patches most software as there are a few things that are specific to NetBSD. Just do a make install and watch it say 'patching...'. Minor things like LD_LIBRARY_PATH and things that if configure is not set up for then it wont find (not sure what their patches do). FreeBSD does the same thing. RedHat can't ship a default kernel they have to ship their own kernel. So what's the point? In order for any vendor to ship apache or any other software they usually have patches applied. This is because the way apache is setup to do things and the way that the vendors setup things is different. To get update and things you have to pretty much wait till they are ready to update the software.
Solution: You want a virgin apache, download the source from apache.org and compile and install yourself. Pass configure the options you want. It's really not that hard.... Is this really worthy news?
Only 'flamers' flame!
...Virgin Apache developers are fairly easy to find...
Sure I'm paranoid, but am I paranoid enough?
An Apache Virgin is hard to find huh? Does this mean that an Apache Slut is easy to find?
---- "Excuse me. Where's the children's gun section?"
Apache is one of those programs that I actually refuse to use a binary distribution of. I just download the latest source, set my preferred options (making sure I build with dynamically loadable modules, which allows me to comment out the ones I don't need in httpd.conf) and away I go. If Apache is installed, I "rpm -e" it and then "make install" my source-built version. If I want to upgrade, usually only the httpd binary and modules need updating and then a quick restart of the server and I'm nicely up-to-date (would you trust "rpm -Uvh" on a live production server's Apache ??!).
And that's the policy for nearly all of the other included packages as well.
"The survey found that all the vendors added some patches to virgin Apache ["a patchy server"] including build patches, backported security patches, changing the product name through to dubious patches, and missed security fixes."
Patches in Apache??? No way! You must be kidding me! I think I'm gonna wet my gay panties! Who'd've thought 'bout that?! This has to be a front page story on Slashdot!!!
Thats because Coke is not open source. Isn't the ability to modify an inherent feature in open source software ?
Charmer
the most funny comment in this article!!! :)))))
Especially when I sub-read the line under it [ Security Hole Found in...]
Use ISO 8601 dates [YYYY-MM-DD]
that distributions are doing precisely what open source software was designed to permit.
Shock is expressed that all users of apache do not bow down to the demands of pencil pansies everywhere but that a free flowing and open marketplace of ideas expressed in different software variations exists.
In good news however, software users can find software that doesn't have many variations or 'dubious patches' at their local Office Depot in boxes produced by Microsoft.
Give me a break. This is news how?
1. Open Mozilla, go to www.apache.org, download source.
I think you can guess what rule #2 is. Yeah, binary distribution for some things is great.
For others, you just label yourself as a great big fscking idiot if you rely on it.
I didn't mod this (obviously since I'm posting), but I do know that moderating can be tricky sometimes.
/. (or some such). I resented the remark because I usually try to keep my posts relatively intelligent, useful, accurate, etc. Hell, I even spell check my posts so I don't develop sloppy habits just because I'm posting on /.
I once modded a comment as "Troll" because the comment concluded with some wise ass remark about their not being real thought put into posts on
Anyway, no one understood the mod I made, so I got battered in meta-moderation. Well, if that wasn't bad enough, I think I also pissed off the local deities, because I got whacked with a couple of subsequent "Off Topic" mods to a couple of posts I made. It's not a big deal, but it was interesting timing.
Anyway, in this case, maybe the mod is just a prick, but it's sometimes hard to tell.
Please mod this post only if you think others should/n't read this. I have enough ego^H^H^Hkarma. Thanks!
I am finding that I mostly only install the base
OS from the distro, and then download the major
packages from their respective sites.
Yes, I noticed this, on my Solaris 8 box, it came with apache... but in RedHat, no apache... there's something called httpd though....
{um that would be +1 "Funny", or possibly -10 "Not Funny", but not -1 "That is apache you idiot"}
-pyrrho
You've definitely posted to the right place!
Did I get that right?
Enough is enough. This time Richard Branson has gone too far.