Apache May Stop 1.3, 2.0 Series Releases

Dan Jones writes "The Apache Software Foundation may stop releasing new versions of the older 1.3 and 2.0 series of its flagship Web server product with most development now focused on the 2.2 series. Nothing is final yet, but messages to the Apache httpd developer mailing list recommend the formal deprecation of the 1.3.x branch, with most citing a lack of development activity. The Apache HTTP server project is one of the most successful and popular open source projects and has become an integral part of the technology stack for thousands of Web and SaaS applications. The first generation of Apache was released in 1995, and the 2.0 series began in 2002. Apache httpd 2.2 began in 2005, with the latest release (October 2009) being 2.2.14. However, the most recent releases of the 1.3 and 2.0 series servers were back in January 2008. With the combined total of active 1.3 and 2.0 series Apache Web servers well into the millions, any decision to end-of-life either product will be watched closely."

Comments

Re:Netcraft confirms...

[Sir_Lewk]

Bizarrely enough, this is actually something netcraft might confirm.

Putting closure on a software project is important

[MaraDNS]

Putting closure on a software product is important.

Professional software usually has an EOL schedule. For example, RedHat Enterprise Linux and Windows XP both have EOLs for early 2014. This allows people using the software to plan upgrades and know when they need to be making a transition.

This is equally as important for open-source software. It looks really bad when this is not done. For example, Dan Bernstein's DjbDNS software package has three unpatched security holes. People using this software have to know about these holes and apply third-party patches.

In addition, when the maker of an open-source program says "OK, I'm done with this program.", it allows maintainers to step forward and take over the project. For example, when I announced I would no longer work on a Doom random map generator I had been hacking on for a while, someone expressed interest in maintaining the software, and subsequent updates have since been done.

I think the Apache foundation should either say "OK, we'll still fix security bugs on this program" or "We're no longer maintaining this release". This way, the users of these programs know whether to upgrade, form their own group applying security patches, or just know they're OK from a security prospective if they're current.

I have blogged about putting closure on open-source projects and have well defined EOL dates for older releases of my own MaraDNS.

A lot of open-source projects just languish when the developers lose interest; I feel this is irresponsible and feel EOL dates and putting closure is important.

Re:Surly this is just a formality

[TheRaven64]

With open source, the product doesn't need to die. If ASF isn't going to put any more resources into it, but other people are still using it, then the code is out there and they can hire someone to work on it. There are lots of developers familiar with the Apache codebase who, I'm sure, would be happy for someone to pay them to back-port fixes to the 1.3 and 2.0 series.

It's also worth noting that this has, in fact, already happened. The OpenBSD base systems includes a fork of Apache 1.3.29 and will probably continue to do so for a long time, because Apache 2.x has a new license.

Re:about time

[TheRaven64]

I found the Lighttpd documentation quite good. It was certainly easier to set up (for me) than Apache. The simple vhosts mechanism is great; just create a new directory (or symlink) for each vhost. No need to edit the configuration files.

Re:go for it

[garcia]

almost all of them are running them because upgrading isn't worth it for their application.

Or because the new configuration scheme is not backwards compatible and the time required to get up to speed on the new config is too much of a hassle. There should have been some sort of 1.3->2.0->2.2 configuration updater. If there is and I'm just blind please point in the general direction :)

Re:Surly this is just a formality

[colmmacc]

As per http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/README , the proposal (Full disclosure: I'm colm@apache.org - the proposer), was that we would start distributing security patches via;

    http://www.apache.org/dist/httpd/patches/

The main point is to reduce the overhead and burden of creating full releases. Releases take a large amount of community involvement and time, and are becoming impractical. The 1.3.x branch does not even build on many modern platforms - for example the configure script is incompatible with dash and there is a getline() function which conflicts with a glibc neologism.

Hope that helps.

Re:Surly this is just a formality

[TheRaven64]

If a company that supports a closed-source product wants to end support, their customers can always pay them to continue support for the product somewhat longer

Their customers can always offer to pay them to continue support. The company may accept, or it may decide that discontinuing the product and expecting the customers to upgrade is more profitable.

Re:Fully backwards compatible, or dead end.

[shutdown -p now]

There's no way I can subscribe to the notion that Apache developers (or anyone, really) has an ethical obligation to keep maintaining a 10 year old codebase with any kind of implied guarantee. If there was a contract in place requiring that, then sure; but there isn't such a thing here.

Any people using Apache 1.3 should have really see this coming, and there's absolutely no excuse not to. It's the standard way of doing things in this industry, and if anything, the term was already waaay longer than is common.

Furthermore, the options are also fairly obvious:

1. Upgrade your environment to 2.2 (or pay someone to do so for you and accept responsibility).

2. Keep maintaining 1.3 on your own (or pay someone to do so for you and accept responsibility).

3. Migrate to a different server (or pay... you get the idea).

Now you also say that:

they dont have the funds or possibility to upgrade by themselves

to which I can only reply, "too bad, they should have engaged their brains at some point in the past - they had 10 years to do so". If they're screwed, they have absolutely no-one to blame by themselves.

Of course, in reality, when they realize that the FOSS white knight in shining armor won't save their ass by keeping to provide them quality software for free this time, you can bet the funds will suddenly be found. Furthermore, I suspect that vast majority of those people would actually go with option #1, and just upgrade to 2.2 (and also learn their lesson to keep up with the update curve to a reasonable extent to minimize "late upgrade" expenses).

Or maybe, if there are really that many 1.3 users who absolutely won't move to 2.2, and each one has so little money they can't pay anyone to get them to move to anything else, either (where are they hosting? in the basement?), then, well, the beauty of FOSS is that they can also come together, form some sort of non-profit funded by all of them - with minimal amount of contribution from each - that would hire people to fork and maintain 1.3 for the benefit of all.

Or maybe they can just donate to OpenBSD.

In any case, if people "don't have the means or resources" (which ultimately means "money") to do their business, then they shouldn't stay in that business - it really is as simple as that.