For OpenBSD, "No More Apache Updates"

joshmccormack writes "On June 6th Henning Brauer, an OpenBSD developer announced on one of the OpenBSD mailing lists that the version of Apache shipped with OpenBSD will stay with 1.3.29, due to Apache's license changes. There will be bug fixes, but no more updates. Discussion on blogs, websites and mailing lists on what's next bring up some interesting ideas and strong opinions. Difference of opinion and control have been catalysts to the growth of OpenBSD in the past. Will this be like the birth of pf in OpenBSD, or even the start of OpenBSD itself?"

Comments

Story: check..

[denisb]

Direct links: fail.
More info to read up on: fail.
Reference to the relevant list / list archive: fail.

Perhaps this story could be fleshed out a little ?
I'll google it or use some other news source to find more about this, but...

Re:Story: check..

[albalbo]

A link for you.

But you're right, it's a very content-free post.

Re:Story: check..

[nocomment]

no kidding!

Since I'm subscribed to the mailing list I've gotten to read all about it for the last couple days. Here's a link to the mailing list archive....here

A page to actually read more on this is here.

Re:Story: check..

[afabbro]

Content-free? You mean this doesn't explain everything? ;) "We've been clear: Their new license contains more stuff, and we do not accept MORE STUFF in licenses." - Theo

Re:Story: check..

[molnarcs]

You are right, a link or two might have helped. After googling a little, I found this announcment on undeadly.org

So what?

[Rick the Red]

It's not like we can't get Apache somewhere else. This is Yet Another Licensing Dispute, and the solution is -- as always -- to just download whatever you want to run on your own if it doesn't come bundled with the OS.

The only way this is even close to what happend with ipf/pf would be if the OpenBSD folks decided to write their own web server and release it under the BSD license, which isn't going to happen because they're OS folks, not web server folks.

Re:So what?

[molnarcs]

It seems they might consider thttd (well, I'm at the part of the messages when someone brings it up). At first glance it looks pretty nice (the OpenBSD folks only need to add ssl support for it). From their webpage:

thttpd is a simple, small, portable, fast, and secure HTTP server.

Simple:
It handles only the minimum necessary to implement HTTP/1.1. Well, maybe a little more than the minimum.

Small:
See the comparison chart. It also has a very small run-time size, since it does not fork and is very careful about memory allocation.

Portable:
It compiles cleanly on most any Unix-like OS, specifically including FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF.

Fast:
In typical use it's about as fast as the best full-featured servers (Apache, NCSA, Netscape). Under extreme load it's much faster.

Secure:
It goes to great lengths to protect the web server machine against attacks and breakins from other sites.

It also has one extremely useful feature (URL-traffic-based throttling) that no other server currently has. Plus, it supports IPv6 out of the box, no patching required.

After reading its man page it seems to me they have similar philosophy to pure-ftpd: simplicity and security. (thttpd, just like pure-ftpd, doesn't need a config file, but if you decide to write one, it has a very easy syntax ... not that apache was terribly complex).

Re:Bah

[Anonymous Coward]

Stupid troll. People have harped on this ad-nauseam.

Theo makes his living by selling packaged OpenBSD install disks (with CVS checkouts of the source, precompiled packages, etc.). The fact that he sells OpenBSD to pay his bills doesn't make it any less free then RedHat selling Linux.

Also if you want to use a CD based install, try here.

Re:No posts thus far - an omen?

[Anonymous Coward]

From the OpenBSD perspective, you are completely missing the point:

GPL: OpenBSD does not consider the GPL to be a "free" license. Becoming more "GPL compatable" may be viewed as a benefit to the GNU and Linux people, but it is VERY much against the goal of the BSD projects. Restricting ANYONE'S use of a product is not a good thing in our mind.

1) "Legalese" is a bad thing. If you gotta get lawyers involved to understand it, it is bad. BY ITSELF, that's grounds for rejection.

2) When did software patents or anything regarding patents and software become a good thing (at least as commonly used)?

The new license is much longer and more complex. This is a bad thing (in a BSD advocate's view).
The BSD license is very simple: Start with the basic rights of a copyright holder, and release ALL of them except the right to identified as the author, giving the USER FULL RIGHTS TO DO BASICLY ANYTHING WITH THE CODE other than claim/change authorship or sue for dammages.

Use it. Imbed it. Give it away. Sell it. With or without source code. WHATEVER. Now...add extra words to the license: HOW CAN IT POSSIBLY GET MORE FREE? Anything you add is "taking away" rights. Anything you do to "protect" yourself is again, taking away from the potential userbase of a product.

The point of the GPL seems to be to keep Open Source software from getting utilized by commercial software vendors. That's a noble goal -- you work for free, you want others to be able to enjoy your work for free. But, you are saying the CODE is free, not the useage of it.

The Point of the BSD license is to get the software USED in any sense of the word. BSD authors would prefer that their good software be USED in commercial products, rather than having the commercial vendors writing more flawed, or incompatable, or alternative protocols.

Do you think Cicso would have put a GPL'd SSH into their products? Probably not: they'd have done their own management application, which would only run on Windows machines or a few Unixes, or stuck with telnet. GPL advocates would probably say that was a "victory for freedom of the code", as the (hypothetical) GPL-SSH code wasn't used to make a profit by the evil Cisco. BSD advocates would prefer that the code be FREELY USED by ANYONE, including Cicso, Microsoft, Sun, HP, Intel, Motorola, IBM, and anyone else. Restricting ANYONE, no matter how "evil" they are perceived to be by someone is very much against the point of the BSD license.

Re:Other OS vendors

[forlornhope]

Debian doesnt distribute stuff based on if it is GPL compatible. It bases it on if the software is DFSG-free. After that is the question of linking and Debian always tries to follow the license of the software. That is where the stuff about the binary only firmware in the kernel came from along with the XFree86 stuf. The linux kernel is not distributable with the firmware and all the GPLed software that depends on xlib cant link against it under the latest XFree86 license.

This is how APACHE got started

[Nonesuch]

The "APACHE" server project was originally a set of patches to the NCSA HTTPd, the name comes from "a-patchy web server".

Back around 1995, development of the NCSA sort-of-free web server was starting to die out, and developers who had been producing a set of patches to the NCSA project decided to "fork" their development branch.

After the fork, the majority of development effort concentrated in the new "Apache" project, and the NCSA HTTPd died out about a year later.

Re:Not a real problem

[peacefinder]

It appears that the existing 1.3.29 (+ patches) apache will remain in the base OpenBSD install indefinitely. The OpenBSD folks have audited it for security, and it does what a basic web server needs to do. Anything beyond that is not really the OS vendor's problem anyway.

As always, if the end users need more features, they can install a newer version. But note the warning on the openbsd-misc list:

Subject: Re: no more apache updates
From: Henning Brauer

let me add one more thing.

it is of course possible to install an apache 1.3.31 or future ones
from source on OpenBSD.

however, doing so is one of the dumbest things you can do.

there is a number of serious security problems in apache that we have
fixed, and that have been offered them back, and they refused.

selfmade apache upgrade = security downgrade, ok?

Re:Not a real problem

[c13v3rm0nk3y]

In theory, this should be doable. In practice, it will be a mess of backporting and three-way merging.

Not to mention something you will have to do every time the Apache people release new versions with their own patches. You can only maintain your own abandoned tree for so long.

I guess you could build off of your own copy of their CVS tree, and just rebuild based on their tags. This defeats the purpose (to me) of a nice easy ./configure ...; make; make install.