Slashdot Mirror
Apache 1.3.32 Released
chipster writes "Apache 1.3.32 has been released. This version of Apache is principally a security and bug fix release. You can read about the new features here, and get Apache 1.3.32 here. Also available is the 1.3 ChangeLog. Additionally, to compliment this release of Apache, mod_ssl- 2.8.21-1.3.32 has also been released."
Is that the new, somewhat unfree, or the old free license?
/* oops I accidentally made a comment, sorry */
Nice job, Chip. And you already have it packaged, don't you?
BTW: First post?
...apt-get update;apt-get upgrade folks ;) At least for the debian folk ;> Now, being a bit more serious, no careful sysadmin does that...right? Reading the changelog and making sure the release isnt broken in the respository is a good practice, at least, in the case of production servers. Its better to stay unprotected against some vulnerabilities for an hour or two then breaking your fine-tuned system. Especially since security should not start at application level.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
If you haven't done so yet, check out Lighttpd! An incredible fast and feature-rich yet minimalistic BSD-licensed webserver! My favourite part is that it runs PHP inside one or several minimal FastCGI-daemon(s) which can be placed on any host, so Lighttpd will act as a load-balancing frontend serving data from several hosts running only PHP (and no webserver at all)...
My other account has a 3-digit UID.
Not very long until 1.3.37!
everyday is another shooter.
1.3 ships with OS X (yes, I am one of those) and has always performed great. Plus, it is integrated in the operating system. I have always been curious about what advantages 2.0 might have and whether I should upgrade. I have installed it a couple of times, both from source and from binary but found it had to be executed from the shell. No big deal but the fact that I have not seen where anyone has integrated 2.0 into OS X's GUI web server makes me wonder why. I also do not want to ignorantly hand my bandwidth and personal files to everyone on the internet so I have been hesitant to simply jump in and begin serving with 2.0 without fully understanding what I am doing. (I am shell comfortable but not savvy.)
I appreciate anyone who is willing to share their experience or knowledge or has a good link.
Thanks.
There is absolutely no reason for a sane webmaster to use Apache 2.0.
1.3 is fine, super-stable and most versions of 1.3 have the old Apache license. 2.0 is distributed under a new Apache license which cannot keep everyone happy. For example, Theo and his OpenBSD team decided to drop support for Apache in their OS.
I have worked both with 1.3 and 2.0. 2.0 is modular and some people like it, but I think that monolithic programs are more stable and much more faster than modular ones.
Even though the 1.3.32 tarballs are available, it wasn't really officially released. The tarballs are placed there "early" so the mirrors can grab them and have them available before we release...
Some differences:
/opt directory). It doesn't have a GUI interface though. I don't know why. Since the GUI only edits the 1.3.x config files and starts/stops the service, there is no technical reason why it couldn't be supported by the GUI. My guess is that Apple, just like any other company, has to pick and choose what it spends effort on. Opportunity costs and all that. They probably started development on the Admin GUI while 2.0.x was still relatively new and untested. At the time, supporting 1.3.x was a no-brainer.
1. mod_proxy has been completely rewritten so as to be fully compatible with HTTP/1.1
2. caching has been removed from mod_proxy and made into its own module, mod_cache, with a couple of implementations available
3. your choice of pre-fork (1.3.x model), single process/multiple threads, and various hybrids
As a point of fact, OS X Server comes with Apache2 as well (check your
The web accelerator's tendency to redirect clients to port 16080 in some configurations is annoying though. It makes me wonder if Apache2 configured as a reverse proxy and using mod_cache would work just as well.
As for your security concerns, switching to 2.0.x will not arbitrarily hand your bandwidth and personal files to everyone on the internet. File and Directory directives still apply.
- I don't need to go outside, my CRT tan'll do me just fine.
It seems like most people are sticking with Apache 1.3.x instead of migrating to Apache 2.x.
I was wondering why this is. Is there something bad about the 2.x release, or are people simply sticking with what they know?
Clearly the parent poster is unknowledgeable to state that no sane webmaster would deply 1.3 on new installations. If you are using client SSL certificates the only option is to deploy 1.3
A design flaw in 2 prevents SSL certificate renegoitation in the POST method, a problem that has gone unaddressed for over 18months. Don't believe me, then read modules/ssl/ssl_engine_kernel.c and find out for yourself and quit posting FUD!
is what's holding me back from going to Apache 2.0. I find the design very awkward and very difficult to integrate C++ into. C++'s memory model is at odds with Apache Portable Runtime's memory pools. A leading researcher in high speed SMP memory allocators had this to say on the subject.
http://www.cgisecurity.com/webservers/apache/