On 9/8/2014 7:22 PM, Maxim Dounin wrote:
Hello!
On Mon, Sep 08, 2014 at 01:01:02PM +0200, Richard Fussenegger, BSc wrote:
Wouldn't it be better to drop support for ancient OpenSSL versions? It would
be a great step for performance and security. Are there any good reasons to
support old OpenSSL versions?
Dropping support doesn't changes anything for ones who uses modern
versions of the OpenSSL library. And will upset ones who, for
some reason, have to use old versions.
The only benefit of dropping support for older OpenSSL versions is
slightly lower code maintenance costs on nginx side.
The nginx project could be a forerunner by removing support. Of course
you would upset some admins but you know as well as I that many of those
could easily upgrade but are unwilling to do so. If they can stick to
outdated OpenSSL versions that have SERIOUS vulnerabilities regarding
security and performance, why would they need an updated nginx?
Honestly, I don't understand this kind of politics. It would be much
better to implement a policy that says (e.g.) current nginx versions
supports two versions back of OpenSSL from the time of release of both.
That would be a clear rule that anyone can easily understand and it
would ensure proper updates and fixes for security problems of the
complete Internet infrastructure. I think that you underestimate the
scope of engagement that nginx is playing now as second most used web
server of the world. I think that the project should take that role much
more serious. (Please don't answer with some like "but Apache httpd",
the project shouldn't reiterate problems of other projects.)
And of course we could take the reduced maintenance costs and benefit
from it.
Richard
---
This email is free from viruses and malware because avast! Antivirus protection
is active.
http://www.avast.com
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
