Slashdot Mirror


For OpenBSD, "No More Apache Updates"

joshmccormack writes "On June 6th Henning Brauer, an OpenBSD developer announced on one of the OpenBSD mailing lists that the version of Apache shipped with OpenBSD will stay with 1.3.29, due to Apache's license changes. There will be bug fixes, but no more updates. Discussion on blogs, websites and mailing lists on what's next bring up some interesting ideas and strong opinions. Difference of opinion and control have been catalysts to the growth of OpenBSD in the past. Will this be like the birth of pf in OpenBSD, or even the start of OpenBSD itself?"

21 of 128 comments (clear)

  1. Story: check.. by denisb · · Score: 4, Informative

    Direct links: fail.
    More info to read up on: fail.
    Reference to the relevant list / list archive: fail.

    Perhaps this story could be fleshed out a little ?
    I'll google it or use some other news source to find more about this, but...

    --
    life+universe+everything=42
    1. Re:Story: check.. by albalbo · · Score: 4, Informative

      A link for you.

      But you're right, it's a very content-free post.

      --
      "Elmo knows where you live!" - The Simpsons
    2. Re:Story: check.. by nocomment · · Score: 4, Informative

      no kidding!

      Since I'm subscribed to the mailing list I've gotten to read all about it for the last couple days. Here's a link to the mailing list archive....here

      A page to actually read more on this is here.

      --
      /* oops I accidentally made a comment, sorry */
      /* http://allyourbasearebelongto.us */
    3. Re:Story: check.. by afabbro · · Score: 4, Informative

      Content-free? You mean this doesn't explain everything? ;) "We've been clear: Their new license contains more stuff, and we do not accept MORE STUFF in licenses." - Theo

      --
      Advice: on VPS providers
    4. Re:Story: check.. by molnarcs · · Score: 4, Informative

      You are right, a link or two might have helped. After googling a little, I found this announcment on undeadly.org

  2. So what? by Rick+the+Red · · Score: 4, Informative
    It's not like we can't get Apache somewhere else. This is Yet Another Licensing Dispute, and the solution is -- as always -- to just download whatever you want to run on your own if it doesn't come bundled with the OS.

    The only way this is even close to what happend with ipf/pf would be if the OpenBSD folks decided to write their own web server and release it under the BSD license, which isn't going to happen because they're OS folks, not web server folks.

    --
    If all this should have a reason, we would be the last to know.
    1. Re:So what? by the+morgawr · · Score: 3, Informative

      While I agree with you, it is entirely possible that someone could take the OpenBSD version of Apache (which has a ton of security patches that never got added back to the main tree) and use it to make OpenHTTPD. If enough people and vendors were concerned about the license change, it could even become the new standard.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
    2. Re:So what? by molnarcs · · Score: 4, Informative
      It seems they might consider thttd (well, I'm at the part of the messages when someone brings it up). At first glance it looks pretty nice (the OpenBSD folks only need to add ssl support for it). From their webpage:
      thttpd is a simple, small, portable, fast, and secure HTTP server.

      Simple:
      It handles only the minimum necessary to implement HTTP/1.1. Well, maybe a little more than the minimum.

      Small:
      See the comparison chart. It also has a very small run-time size, since it does not fork and is very careful about memory allocation.

      Portable:
      It compiles cleanly on most any Unix-like OS, specifically including FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF.

      Fast:
      In typical use it's about as fast as the best full-featured servers (Apache, NCSA, Netscape). Under extreme load it's much faster.

      Secure:
      It goes to great lengths to protect the web server machine against attacks and breakins from other sites.

      It also has one extremely useful feature (URL-traffic-based throttling) that no other server currently has. Plus, it supports IPv6 out of the box, no patching required.
      After reading its man page it seems to me they have similar philosophy to pure-ftpd: simplicity and security. (thttpd, just like pure-ftpd, doesn't need a config file, but if you decide to write one, it has a very easy syntax ... not that apache was terribly complex).
    3. Re:So what? by joshmccormack · · Score: 3, Informative

      Here's where you can find info on thttpd running CGIs.

      It appears, from their benchmarks, that performance running test C CGI's is very good for thttpd.

      Seems like it might be best for simpler scripts, tough, as it appears that CGI execution is serialized, so "...one long running
      script will block all other requests." Here's another explanation.

  3. Re:No posts thus far - an omen? by the+morgawr · · Score: 2, Informative

    I disagree, one of OpenBSD's goals has always been to provide a base system that is as unrestricted as possible. It sounds to me like they are just taking steps to ensure they don't introduce a more restrictive license to the base system.

    --
    The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
  4. Re:Bah by Anonymous Coward · · Score: 4, Informative
    Stupid troll. People have harped on this ad-nauseam.

    Theo makes his living by selling packaged OpenBSD install disks (with CVS checkouts of the source, precompiled packages, etc.). The fact that he sells OpenBSD to pay his bills doesn't make it any less free then RedHat selling Linux.

    Also if you want to use a CD based install, try here.

  5. Re:No posts thus far - an omen? by Anonymous Coward · · Score: 5, Informative

    From the OpenBSD perspective, you are completely missing the point:

    GPL: OpenBSD does not consider the GPL to be a "free" license. Becoming more "GPL compatable" may be viewed as a benefit to the GNU and Linux people, but it is VERY much against the goal of the BSD projects. Restricting ANYONE'S use of a product is not a good thing in our mind.

    1) "Legalese" is a bad thing. If you gotta get lawyers involved to understand it, it is bad. BY ITSELF, that's grounds for rejection.

    2) When did software patents or anything regarding patents and software become a good thing (at least as commonly used)?

    The new license is much longer and more complex. This is a bad thing (in a BSD advocate's view).
    The BSD license is very simple: Start with the basic rights of a copyright holder, and release ALL of them except the right to identified as the author, giving the USER FULL RIGHTS TO DO BASICLY ANYTHING WITH THE CODE other than claim/change authorship or sue for dammages.

    Use it. Imbed it. Give it away. Sell it. With or without source code. WHATEVER. Now...add extra words to the license: HOW CAN IT POSSIBLY GET MORE FREE? Anything you add is "taking away" rights. Anything you do to "protect" yourself is again, taking away from the potential userbase of a product.

    The point of the GPL seems to be to keep Open Source software from getting utilized by commercial software vendors. That's a noble goal -- you work for free, you want others to be able to enjoy your work for free. But, you are saying the CODE is free, not the useage of it.

    The Point of the BSD license is to get the software USED in any sense of the word. BSD authors would prefer that their good software be USED in commercial products, rather than having the commercial vendors writing more flawed, or incompatable, or alternative protocols.

    Do you think Cicso would have put a GPL'd SSH into their products? Probably not: they'd have done their own management application, which would only run on Windows machines or a few Unixes, or stuck with telnet. GPL advocates would probably say that was a "victory for freedom of the code", as the (hypothetical) GPL-SSH code wasn't used to make a profit by the evil Cisco. BSD advocates would prefer that the code be FREELY USED by ANYONE, including Cicso, Microsoft, Sun, HP, Intel, Motorola, IBM, and anyone else. Restricting ANYONE, no matter how "evil" they are perceived to be by someone is very much against the point of the BSD license.

  6. Re:Other OS vendors by forlornhope · · Score: 5, Informative

    Debian doesnt distribute stuff based on if it is GPL compatible. It bases it on if the software is DFSG-free. After that is the question of linking and Debian always tries to follow the license of the software. That is where the stuff about the binary only firmware in the kernel came from along with the XFree86 stuf. The linux kernel is not distributable with the firmware and all the GPLed software that depends on xlib cant link against it under the latest XFree86 license.

    --
    "We Don't Need No Truthless Heros!" - Project 86
  7. This is how APACHE got started by Nonesuch · · Score: 5, Informative
    The "APACHE" server project was originally a set of patches to the NCSA HTTPd, the name comes from "a-patchy web server".

    Back around 1995, development of the NCSA sort-of-free web server was starting to die out, and developers who had been producing a set of patches to the NCSA project decided to "fork" their development branch.

    After the fork, the majority of development effort concentrated in the new "Apache" project, and the NCSA HTTPd died out about a year later.

  8. Re:Not a real problem by peacefinder · · Score: 4, Informative
    It appears that the existing 1.3.29 (+ patches) apache will remain in the base OpenBSD install indefinitely. The OpenBSD folks have audited it for security, and it does what a basic web server needs to do. Anything beyond that is not really the OS vendor's problem anyway.

    As always, if the end users need more features, they can install a newer version. But note the warning on the openbsd-misc list:
    Subject: Re: no more apache updates
    From: Henning Brauer

    let me add one more thing.

    it is of course possible to install an apache 1.3.31 or future ones
    from source on OpenBSD.

    however, doing so is one of the dumbest things you can do.

    there is a number of serious security problems in apache that we have
    fixed, and that have been offered them back, and they refused.

    selfmade apache upgrade = security downgrade, ok?
    --
    With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
  9. Re:No posts thus far - an omen? by Pieroxy · · Score: 2, Informative

    they only have to share back their modifications

    Well, if I understand the GPL accurately, you can't use a GPL lib without sharing your entire codebase. That's a bit restrictive to me. As a result, we don't use any GPL code in my company, because we would have to integrate it within our app, and our app would become GPL by that action.

    See how it is restrictive now?

    LGPL, that is a much less restrictive license.

  10. Re:No posts thus far - an omen? by OoSync · · Score: 2, Informative

    Well, if I understand the GPL accurately, you can't use a GPL lib without sharing your entire codebase.

    This is false. Much like the BSD-licensed code, you may GPL'ed code for anything you wish.

    What you cannot do is to distribute GPL code without offering the same rights as you were given under the GPL.

    So, if the app is just some random internal-use-only app, then using GPL code is perfectly reasonable and legal. However, if it is a product the company distributes, then yes, your code will need to be GPL compatible. There is more than one way to do so, some which would not mean disclosing the source of your code.

    --

    I always get the shakes before a drop.
  11. Re:No posts thus far - an omen? by Brandybuck · · Score: 2, Informative

    What you cannot do is to distribute GPL code without offering the same rights as you were given under the GPL.

    For all practical purposes, this is the SAME THING!

    If I am writing an application for the purposes of distributing it, then a GPL library is restricting my ability to distribute it. Even if I distribute it within embedded hardware. This is radically different from the LGPL.

    your code will need to be GPL compatible.

    You've got it backwards. Any code that is considered to be "derivative" by license must be released under the GPL. The "compatibility" refers to linkage/derivation in the other direction.

    Since this is frequently misunderstood, let me offer an example. You can distribute an application that links to a BSD licensed library under the GPL, but you may not distribute an application that links to a GPL library under the BSD license.

    --
    Don't blame me, I didn't vote for either of them!
  12. Re:No posts thus far - an omen? by Brandybuck · · Score: 2, Informative

    I also suspect that available BSD licensed software will stagnate

    You mean like the stagnating Apache the topic is about? The old Apache license was merely the BSD license with a trademark/advert clause.

    Prepubescent Slashdot trolls like to joke about BSD dying, but the fact of the matter is that for the thirty year history of BSD licensed code, it has never once stagnated. FreeBSD, NetBSD and OpenBSD, all under the BSD license, are growing at a tremendous rate.

    --
    Don't blame me, I didn't vote for either of them!
  13. Re:Bah by Anonymous Coward · · Score: 1, Informative
    Also if you want to use a CD based install, try here.

    Note that this link is for booting and loading install/upgrade program only. You can go on with a network install from it. CD's layout are copyrighted by Theo de Raadt. You can, however, download and make your own bootable CD.

  14. Re:Not a real problem by c13v3rm0nk3y · · Score: 4, Informative

    In theory, this should be doable. In practice, it will be a mess of backporting and three-way merging.

    Not to mention something you will have to do every time the Apache people release new versions with their own patches. You can only maintain your own abandoned tree for so long.

    I guess you could build off of your own copy of their CVS tree, and just rebuild based on their tags. This defeats the purpose (to me) of a nice easy ./configure ...; make; make install.

    --
    -- clvrmnky