Apache HTTP Server 1.3.29 Released

Dan writes "The Apache Software Foundation and The Apache HTTP Server Project are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache"). This Announcement notes the significant changes in 1.3.29 as compared to 1.3.28. Release 1.3.29 addresses and fixes a potential security issue CAN-2003-0542 (cve.mitre.org): Fix buffer overflows in mod_alias and mod_rewrite which occurred if one configured a regular expression with more than 9 captures. You can download this release from one of your preferred mirror sites."

Comments

Big Changes ?

[noselasd]

Where are the big changes ? I see 8 more or less minor bugfixes.

The Apache Section's Motto:

[Farley Mullet]

Slashdot's Apache Section: For The Apache Admin Who Just Refuses To Get On The Mailing List.

On the note of that...

[FinestLittleSpace]

...I better make the obligatory comment....

"Cor, at least it's not IIS... we'd be having thousands of bugfixes. Damn M$."

Thanks

[barcodez]

Well I for one appreciate the Apache httpd development team's efforts.

Why list a commercial web site?

[Futurepower(R)]

The Slashdot story said, "... are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache")."

However, that link references only a copy of the release info on a commercial bulletin board, BSDForums.org, that has plenty of advertisements.

The Slashdot story could have said, "... are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache")", which is the official announcement on the apache.org site.

Re:Why list a commercial web site?

[Anonymous Coward]

Yeah, blame it on slashdot. Maybe you should take it up with the person who actually wrote the post? Maybe this Dan fellow runs (or gets some form of compensation from) BSDForums.org?

Re:Why list a commercial web site?

[shrubya]

copy of the release info on a commercial bulletin board, BSDForums.org

Notice that the article was submitted by dan@bsdforums.org and you will achieve enlightenment.

At least he was honest about his affiliation.

Re:Why list a commercial web site?

[a.koepke]

commercial bulletin board, BSDForums.org, that has plenty of advertisements.

All I see are 3 text links near the top

NetBSD 1.6 CDs,T-Mobile's Online Store and The Design & Implementation of 4.3 BSD Unix OS.

Not exactly what I would call plenty of advertisements.

Why Not 2.0?

[4of12]

OK, I'll admit not being on the apache mailing list.

But I'm thinking of installing Apache (and gentoo ) on an unused Athlon box.

Is there any reason not to install the latest Apache 2.0 instead of the 1.3 series?

[I ask because, IIRC, early releases of 2.0 didn't support the latest PHP.]

Re:Why Not 2.0?

[babbage]

I'm not a PHP guy, so I can't be definitive about that, but the two big areas where Apache 2.0 seems to have been un-finished are PHP and mod_perl support. Random poking around on Google suggests anecdotally that this was true at least as recently as July, according to a random blog hit.

You're certainly welcome to try it -- bug testers are always welcome for any open source project -- but last I heard the conventional wisdom was still to avoid Apache2 for any site that needs stable mod_perl or PHP support. I understand that they both work, more or less, but people still seem to have problems with stability.

On the other hand, for other areas, Apache2 is supposed to be wonderful. I've heard reports of web server pool load tests that suggested that a tier of Apache2 servers could handle a load equivalent to something like 4 or 5 times as many Apache 1.3 servers. YMMV of course, but apparently there are real benefits to Apache2 for those that are in a position to take advantage of it.

Re:Why Not 2.0?

[AShocka]

As far as I know the problem isn't so much with Apache2 but with the changing API and modules because they haven't been rewritten /debugged to the specs of A2 to take advantage of it's architecture. Apache 2: Improvements Are Obvious, But Upgrade Choices Aren't

Re:Why Not 2.0?

[dsb3]

FWIW I have a server feeding over 1 million hits per day with Apache 2.0 and PHP.

No stability problems here, yet ... (knock on wood)

Re:Why Not 2.0?

[mrt300]

PHP has been solidified for a few months with Apache 2.0.x. As far as mod_perl goes, they've been slow (6 months between releases) to even put out pre-releases. I can't say I blame them. There's been so much hype around the development of Perl 6 (more specifically, the Perl 6 runtime), that the mod_perl guys have to be wondering about their product's expected lifetime.

FWIW, I've used the mod_perl 1.99 dev code without any issue on a server that handles a significant load of authentication. While doing that, even basic mod_perl functionality was shifting. I tend to think that the mod_perl slowdown isn't due to Apache's APIs, but due to their own.

Re:Why Not 2.0?

[cpghost]

mod_throttle and other non-core modules are normally only available to the 1.3.x series (for now).

Another reason is laziness: If the average admin can't find a package/port/... for an apache 2.x module in their favorite Linux distro or BSD ports collection, they'll normally go for 1.3.x, instead of porting the module to 2.x.

Re:Why Not 2.0?

[Anonymous Coward]

FWIW -- used on of the experimental modules in Apache2 mod_auth_ldap.

Stable isn't something I would use to describe it.

I've had much better succes with other GPL ldap mod's for Apache2.

Here's hoping that problem gets solved.

Apache HTTP Server 2.0.48 is also out

[jimjag]

Released at the same time was 2.0.48.

Apache security documentation

[Anonymous Coward]

http://cgisecurity.com/webservers/apache/

what about 2.0.48?

[bluethundr]

In related news, the 2.48 version of apache was also released. Was this a slashdot moment, as well? Did I miss a memo? I'm assuming I have. I recently read the O'Reilly book on this topic and two things seemed clear. 1) That the authors of the book really preferred the 1.3.x series of httpd to the 2.x series and that 2) BSD is the way to be for Apache (though Linux is an "okay" substitute.) Which really surprised me because threading in Linux is better than BSD.

So my questions are: If they are updating the 2.x series why are they *also* updating the 1.3.x series? Isn't the idea that 2.x will supplant/replace the earlier series? What do you get out of using the older version that you don't with the newer? Other than the ability to work with a tool that's more familiar to you becasue you've been using it for so long...Wouldn't the technological advantages of using the newer version outwiegh the inconvenience of yet another learning curve?

Re:what about 2.0.48?

[WoodstockJeff]

I don't think it is the learning curve, per se... I made the change-over to 2.x with few problems, other than some security issues that are outside of apache's control (Mandrake 9.x won't allow apache to run CGI without as-yet-unfound configuration changes).

The main problem is that some things written for apache 1.x do not work under 2.x, or have significant problems. PHP was one of them; other modules have been problematic, too. Once PHP ran acceptably, we switched...

Re:what about 2.0.48?

[PowerBert]

1.3.x isn't being updated. It's in bug fix mode, which means only bugs and security problems are fixed no active development is being done. I think one of the main reason for sticking with 1.3.x for now is that mod_perl for 2.0 isn't considered stable yet. We find it breaks a lot of our mod_perl server management stuff too. 2.0 hasn't been out that long really. How many people out there still run Windows NT4?

Re:what about 2.0.48?

[mysticalreaper]

If they are updating the 2.x series why are they *also* updating the 1.3.x series? Isn't the idea that 2.x will supplant/replace the earlier series? What do you get out of using the older version that you don't with the newer?

Here, my friend is the beauty of open source. If you want to keep using apache 1.3 (as many are), you can. There's no such thing as a forced upgrade. What version of the software you use is entirely up to you. 2.0 is supposed to be an improvement over 1.3 (and it is), but it's not supposed to 'supplant' 1.3. Just like the Linux kernel 2.4 didn't 'supplant' 2.2, though it WAS an improvement.

As long as there are interested people in the 1.3 series, bugfixes will come in, and holes will be patched. And that's why it's still being updated. Heck, even the 2.0 kernel is actively maintained. The canges are very slow, but if there's an obvious fix, it will be put in.

So basically, it's up to you to decide which version to run. And that's exactly the idea, that you have choice and freedom with your software.

Re:what about 2.0.48?

[morelife]

The main reason I can see is mod_perl.

As another person said, it's not supported (yet).

Understatement... try compiling it in ... it just doesn't work. v2.x is a rewrite. Still a baby and has to pay its dues in the field for a while :)

Re:what about 2.0.48?

[8282now]

I'm sure you've seen for yourself but the reason for the dual development track is that not all 1.3x modules have been migrated to the new 2.x platform.
There are still a number of very popular modules that still require the use of the 1.3x code. So instead of "orphaning" those poor souls dependent (?) on the 1.3x modules, (as mentioned by another poster) the open source world allows for and supports multiple versions to exist.

Just my two cents...

What took so long

[PowerBert]

I posted this to /. 24 hours ago.
Right after openpkg.org made their security alert on bugtrack.
The new code was released very very quickly and was available about 20 hours ago.
For some reason the apache front page has only just been updated.
It seems to take longer to announce a new version than to build one.

webserver written in Postscript!

[satanami69]

Why bother with Apache when you can get the power of PS-HTTPD

PS-HTTPD is a HTTP-server written in Postscript. It can handle the main task of a webserver, serving data.

Re:webserver written in Postscript!

[bofkentucky]

Thats the best laugh I've had in a year, thanks

Re:webserver written in Postscript!

[fred87]

This is great :) thanks for the laugh

money-making scheme

[Futurepower(R)]

So it was a money-making scheme for Dan?

Why don't Slashdot editors catch this kind of thing?

Re:money-making scheme

[Phil John]

Oh come on, you can't be serious? Do you think that they make any profit from the site? I bet the adverts are just there so that Dan doesn't have to cover the cost of hosting out of his own pocket.

This is important because it is security relaited

[aaron_pet]

If you have a web server... You don't want to get hacked... and you have to know about the patches to fix em.

That is what slashdot is doing. It is highly important.

Granted, they could just put it on the side... but hey! slash code is configurable!

You can choose what types of news you want to read!
Just log in and visit your preferences page... and make it so you don't see the apache news!

It is a breach of trust.

[Futurepower(R)]

9 ads on the page.

It is a breach of trust. The original page was available; why not link to that? If that is okay, what is next; will mirrors insert ads?

The money apparently does NOT go to help BSD, but goes to a private company; is that true?

Ads are good, in the right circumstances. Sneakiness is never good.

Re:Apache Problems

[fred87]

/me remembers seeing this word-for-word in a thread yesterday with the word Apache swapped for Linux...