Topic: Apache 2.2.22 and 2.4, some thoughts

[Steffen]

For my feeling the way it goes current at ASF has some concerns to me.

All looks not well organized, and the influence of some *nix dev's is too great. For a non insider it is hard to follow what is going on. Communication looks not open.

In June I already reported issues, in most they were not interested and ignored it. Now suddenly they are important for them and holding 2.4.1. Think the reason is that they are not primarily related to windows only. I feel me (so us) not serious taken by ASF.

2.4.0 can we call a debacle, patches flipping around now and there is no sight yet when 2.4.1 is coming. It is admasing that they released a 2.4.0 GA (or what ever) with a, most for us, not working SSL.

I am holding 2.2.22 for a few weeks, to be sure it is good. The patches were coming from nowhere and are primarily theoretical security things.

Advise: use 2.2.21 for production, it is proven.

Steffen

[glsmith]

2.4.0 was not released as GA, it was not released at all. The last version you will find in at http://www.apache.org/dist/httpd/ is 2.3.16 beta.

I had 2.4.0 ready to put out at the Haus, but I will not do it prior to the source being moved off the dev site to the main distribution site. So, no 2.4.0 for us.

I actually see some improvement here, we seem to have finally gotten some unix devs more interested in thinking "will this work on windows?"

Sadly, I still do not see much improvement on the balancer bug. However, there is one noisy -1 for GA till shm in general is fixed in Windows. With the exception of the balancer, I do not see any shm problem unless trying to run from console on Vista and above. I suspect the UAC is causing it and I see it in mod_auth_digest and mod_heartmonitor. Running as a service, the problem disappears.

As far as us not being taken seriously, we have two sayings on this side of the pond, "the squeaky wheel gets the grease" and "out of sight out of mind."

I've been squeaking for over a year now throughout the development of 2.3, every time I see them break something. Thanks to you jumping on board recently, there are two squeaking wheels, also you test things I do not normally use. Since it's Mario's balancer bug (thanks for reporting it), maybe he should squeak on dev list and you and I can pile some more squeaking on top.

Personally, I am content to let them get the biggest bug in my view (AcceptFilter https none) fixed first, then start squeaking about the balancer bug. When there is yet again a call for 2.4.1, -1 GA till such bug has been squashed.

As for 2.2.22, CVE's mostly get discussed on security@ until such time as they are disclosed in the wild. I doubt they'll be reverting any of this. A 2.2.next in one week to fix some regression is not out of the question on any release (2.2.13, 16, 18, 20). Hopefully it doesn't come to that.

[James Blond]

Well it is getting better with devs and windows lovers. The mod fcgid module has been fixed and more on top that I haven't tested yet. I think we shall not be to hard with the devs. Of cause everyone thinks about his system first as we do with windows. I personaly use apache also on linux and freebsd and there 2.4 is so much better than 2.2 On windows not "so" much has changed. Except of the rest bugs 2.4 is pretty nice. I think on nix system some bugs will popup when 2.4 reaches the mass of people (also windows). Like Gregg said you don't test all scenarios on your own. That was one intension why Jim wanted / wants to release 2.4
It is not that I don't want write more on dev mailing list, it is just too many mails to follow the topics specials as non native speaker
There two ways to go: write friendly on the dev list. Fill out bug reports. I will do both.

Steffen some ppl already honored you for helping make mod sec run again. Helping the php guys with mod php is also a great thing. Don't underestimate that!

Speaking of 2.2.22 I think it is worthy since the CVE stuff has been fixed and the apr-? 1.4.1 is a good direction.


Send some sun!!! It is -8 C and 95 % huminity

[James Blond]

I forgot: we want mod mem cache back



Send from my toaster via IPv6

[James Blond]

It is done: Apache HTTP Server 2.2.22 Released

[James Blond]

I pinged Mladen Turk who wanted to take a closer look at the balancer bug PR 52402. His answer was