Re: ApacheCon call for presentations, httpd content
I can always do my "httpd 2.4 overview" as well as my "httpd 2.4 reverse proxy" talk. > On May 2, 2019, at 10:39 AM, Daniel Ruggeri wrote: > > Hi, Rich; > I was looking at the CFP and didn't quite see something that aligns with > httpd. These are the categories allowed: > General > Community > Tomcat > Big Data > Machine Learning > IoT > Geospatial > Cassandra > Traffic Control Summit > Cloudstack Collaboration Conference > Integration > Graph Processing > Karaf > Drill > Observability > Beam > > *maybe* that has has an effect on folks' submissions? Dunno... I just > submitted in "general" > -- > Daniel Ruggeri > > On 2019/05/01 20:35:49, Rich Bowen wrote: >> Hi, folks. >> >> The call for presentations for ApacheCon North America closes in a >> little less than two weeks. As of right now, as far as I can tell, there >> is exactly zero httpd content. >> >> If we want to have our project represented at ApacheCon this year, what >> would you want to see? Is there any chance we can fill a half-day of >> content (ie, 3-4 talks) with what new things have happened in the past >> year, and what's important now? >> >> Personally, I'd like to see a presentation on using mod_md, and perhaps >> something on the benefits of, and use of, http2 in httpd? >> >> The CFP is here - https://www.apachecon.com/acna19/cfp.html - and closes >> May 13th. >> >> Thanks! >> >> --Rich >>
Re: ApacheCon call for presentations, httpd content
On 08/05/2019 20:19, Stefan Eissing wrote: > Hi Jean-Frederic, > > no plans for H3, need to grow more arms and another head for that. > But who knows? Same here ;-) > > Great that you plan to present mod_md. I am starting to make a > version 2 for that with ACMEv2 support and an alternate OCSP stapling > implementation. Maybe that is something to mention as well. > OK I will propose something tomorrow, I can also explain on the OCSP and its limitations. > Cheers, Stefan > >> Am 08.05.2019 um 19:55 schrieb jean-frederic clere >> : >> >> On 04/05/2019 11:53, Stefan Eissing wrote: >>> Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : > Personally, I'd like to see a presentation on using mod_md, > and perhaps something on the benefits of, and use of, http2 > in httpd? >>> >>> If anyone wants to present about that and has questions, I'm >>> happy to help. >>> >>> -Stefan >>> >> >> What about HTTP/3 there is https://github.com/ngtcp2/nghttp3, do >> you plan to work on it? >> >> I have a mod_proxy for tomcat, http/2 or 3 for tomcat, I can do a >> mod_md/ let's encrypt one for httpd (someone else will do the >> tomcat one) >> >> -- Cheers >> >> Jean-Frederic > > -- Cheers Jean-Frederic
Re: ApacheCon call for presentations, httpd content
Sounds excellent. What comes to mind in this regard is - TLS 1.3 support - the OCSP stapling situation where we are at the moment not the strongest. We should recommend a persistent cache for that - online docs often mention only a memory cache. When OCSP responders have outages while we find out cached responses invalid, people are out of luck. - Stefan > Am 08.05.2019 um 20:17 schrieb Dan Ehrlich : > > I would like to give a presentation on hardening / security if possible. > > I realize this is broad and a little simple for a conference, but the last > extensive Apache Security Book was in 2009. > > It is in no way ready yet and I am extremely self-conscious, but some > possible topics that I have written about here and there and could combine: > > - set many many HTTP security headers (there are 9 you can do in Chrome now) > - an updated SSLCipherSuite list > - the importance of using ECDHE keys when possible > - how to properly structure your /var/www folder regarding static content, > executables, uploads, and downloads. > - Using both a reverse proxy firewall along with outbound exfilitration > scanning with ModSecurity > - GeoIP Blocking with the new MaxMind API within Apache2 > - followsymlinks danger and how to remediate > - other things > - any suggestions ppl have or areas they suggest I research :) > > >> On May 8, 2019, at 12:55 PM, jean-frederic clere wrote: >> >>> On 04/05/2019 11:53, Stefan Eissing wrote: >>> > Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : > > Personally, I'd like to see a presentation on using mod_md, and perhaps > something on the benefits of, and use of, http2 in httpd? >>> >>> If anyone wants to present about that and has questions, I'm happy to help. >>> >>> -Stefan >>> >> >> What about HTTP/3 there is https://github.com/ngtcp2/nghttp3, do you >> plan to work on it? >> >> I have a mod_proxy for tomcat, http/2 or 3 for tomcat, I can do a >> mod_md/ let's encrypt one for httpd (someone else will do the tomcat one) >> >> -- >> Cheers >> >> Jean-Frederic
Re: ApacheCon call for presentations, httpd content
Hi Jean-Frederic, no plans for H3, need to grow more arms and another head for that. But who knows? Great that you plan to present mod_md. I am starting to make a version 2 for that with ACMEv2 support and an alternate OCSP stapling implementation. Maybe that is something to mention as well. Cheers, Stefan > Am 08.05.2019 um 19:55 schrieb jean-frederic clere : > > On 04/05/2019 11:53, Stefan Eissing wrote: >> >>> Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : >>> Personally, I'd like to see a presentation on using mod_md, and perhaps something on the benefits of, and use of, http2 in httpd? >> >> If anyone wants to present about that and has questions, I'm happy to help. >> >> -Stefan >> > > What about HTTP/3 there is https://github.com/ngtcp2/nghttp3, do you > plan to work on it? > > I have a mod_proxy for tomcat, http/2 or 3 for tomcat, I can do a > mod_md/ let's encrypt one for httpd (someone else will do the tomcat one) > > -- > Cheers > > Jean-Frederic
Re: ApacheCon call for presentations, httpd content
I would like to give a presentation on hardening / security if possible. I realize this is broad and a little simple for a conference, but the last extensive Apache Security Book was in 2009. It is in no way ready yet and I am extremely self-conscious, but some possible topics that I have written about here and there and could combine: - set many many HTTP security headers (there are 9 you can do in Chrome now) - an updated SSLCipherSuite list - the importance of using ECDHE keys when possible - how to properly structure your /var/www folder regarding static content, executables, uploads, and downloads. - Using both a reverse proxy firewall along with outbound exfilitration scanning with ModSecurity - GeoIP Blocking with the new MaxMind API within Apache2 - followsymlinks danger and how to remediate - other things - any suggestions ppl have or areas they suggest I research :) > On May 8, 2019, at 12:55 PM, jean-frederic clere wrote: > >> On 04/05/2019 11:53, Stefan Eissing wrote: >> Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : Personally, I'd like to see a presentation on using mod_md, and perhaps something on the benefits of, and use of, http2 in httpd? >> >> If anyone wants to present about that and has questions, I'm happy to help. >> >> -Stefan >> > > What about HTTP/3 there is https://github.com/ngtcp2/nghttp3, do you > plan to work on it? > > I have a mod_proxy for tomcat, http/2 or 3 for tomcat, I can do a > mod_md/ let's encrypt one for httpd (someone else will do the tomcat one) > > -- > Cheers > > Jean-Frederic
Re: ApacheCon call for presentations, httpd content
On 04/05/2019 11:53, Stefan Eissing wrote: > >> Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : >> >>> Personally, I'd like to see a presentation on using mod_md, and perhaps >>> something on the benefits of, and use of, http2 in httpd? > > If anyone wants to present about that and has questions, I'm happy to help. > > -Stefan > What about HTTP/3 there is https://github.com/ngtcp2/nghttp3, do you plan to work on it? I have a mod_proxy for tomcat, http/2 or 3 for tomcat, I can do a mod_md/ let's encrypt one for httpd (someone else will do the tomcat one) -- Cheers Jean-Frederic
Re: ApacheCon call for presentations, httpd content
> Am 02.05.2019 um 16:39 schrieb Daniel Ruggeri : > >> Personally, I'd like to see a presentation on using mod_md, and perhaps >> something on the benefits of, and use of, http2 in httpd? If anyone wants to present about that and has questions, I'm happy to help. -Stefan
Re: ApacheCon call for presentations, httpd content
The categories are for projects/communities who have committed to put together a track. Everything else should go in general. I'll try to clarify that on https://www.apachecon.com/acna19/cfp.html if that was unclear. On Thu, May 2, 2019, 10:39 Daniel Ruggeri wrote: > Hi, Rich; >I was looking at the CFP and didn't quite see something that aligns > with httpd. These are the categories allowed: > General > Community > Tomcat > Big Data > Machine Learning > IoT > Geospatial > Cassandra > Traffic Control Summit > Cloudstack Collaboration Conference > Integration > Graph Processing > Karaf > Drill > Observability > Beam > > *maybe* that has has an effect on folks' submissions? Dunno... I just > submitted in "general" > -- > Daniel Ruggeri > > On 2019/05/01 20:35:49, Rich Bowen wrote: > > Hi, folks. > > > > The call for presentations for ApacheCon North America closes in a > > little less than two weeks. As of right now, as far as I can tell, there > > is exactly zero httpd content. > > > > If we want to have our project represented at ApacheCon this year, what > > would you want to see? Is there any chance we can fill a half-day of > > content (ie, 3-4 talks) with what new things have happened in the past > > year, and what's important now? > > > > Personally, I'd like to see a presentation on using mod_md, and perhaps > > something on the benefits of, and use of, http2 in httpd? > > > > The CFP is here - https://www.apachecon.com/acna19/cfp.html - and closes > > May 13th. > > > > Thanks! > > > > --Rich > > >
Re: ApacheCon call for presentations, httpd content
Hi, Rich; I was looking at the CFP and didn't quite see something that aligns with httpd. These are the categories allowed: General Community Tomcat Big Data Machine Learning IoT Geospatial Cassandra Traffic Control Summit Cloudstack Collaboration Conference Integration Graph Processing Karaf Drill Observability Beam *maybe* that has has an effect on folks' submissions? Dunno... I just submitted in "general" -- Daniel Ruggeri On 2019/05/01 20:35:49, Rich Bowen wrote: > Hi, folks. > > The call for presentations for ApacheCon North America closes in a > little less than two weeks. As of right now, as far as I can tell, there > is exactly zero httpd content. > > If we want to have our project represented at ApacheCon this year, what > would you want to see? Is there any chance we can fill a half-day of > content (ie, 3-4 talks) with what new things have happened in the past > year, and what's important now? > > Personally, I'd like to see a presentation on using mod_md, and perhaps > something on the benefits of, and use of, http2 in httpd? > > The CFP is here - https://www.apachecon.com/acna19/cfp.html - and closes > May 13th. > > Thanks! > > --Rich >
Re: ApacheCon call for presentations, httpd content
I'm always willing to give the cookbook talk for the proxy. Sometimes we have great questions and conversation... sometimes not. I'll submit that tomorrow and we'll see where it goes. If there is a specific area I have expertise in, I'm happy to develop a presentation... (I just don't think I have enough time to develop expertise in mod_md or H2) so keep the suggestions coming. What about a "stupid httpd tricks" kind of talk which is an amalgamation of neat stuff? I'm sure we could come up with at least two dozen examples EASILY. -- Daniel Ruggeri On May 1, 2019 3:35:49 PM CDT, Rich Bowen wrote: >Hi, folks. > >The call for presentations for ApacheCon North America closes in a >little less than two weeks. As of right now, as far as I can tell, >there >is exactly zero httpd content. > >If we want to have our project represented at ApacheCon this year, what >would you want to see? Is there any chance we can fill a half-day of >content (ie, 3-4 talks) with what new things have happened in the past >year, and what's important now? > >Personally, I'd like to see a presentation on using mod_md, and perhaps >something on the benefits of, and use of, http2 in httpd? > >The CFP is here - https://www.apachecon.com/acna19/cfp.html - and >closes >May 13th. > >Thanks! > >--Rich
