Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Announcements Software Apache

Apache HTTP Server 1.3.29 Released 36

Posted by timothy from the dot-dot-dot-dot dept.
Dan writes "The Apache Software Foundation and The Apache HTTP Server Project are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache"). This Announcement notes the significant changes in 1.3.29 as compared to 1.3.28. Release 1.3.29 addresses and fixes a potential security issue CAN-2003-0542 (cve.mitre.org): Fix buffer overflows in mod_alias and mod_rewrite which occurred if one configured a regular expression with more than 9 captures. You can download this release from one of your preferred mirror sites."
This discussion has been archived. No new comments can be posted.

Apache HTTP Server 1.3.29 Released More

Apache HTTP Server 1.3.29 Released

Comments Filter:

  • Big Changes ? (Score:4, Insightful)

    by noselasd ( 594905 ) on Wednesday October 29, 2003 @04:46AM (#7336212)
    Where are the big changes ? I see 8 more or less minor bugfixes.

    • The Apache Section's Motto: (Score:5, Funny)

      by Farley Mullet ( 604326 ) on Wednesday October 29, 2003 @04:55AM (#7336225)

      Slashdot's Apache Section: For The Apache Admin Who Just Refuses To Get On The Mailing List.


      • OK, I'll admit not being on the apache mailing list.

        But I'm thinking of installing Apache (and gentoo ) on an unused Athlon box.

        Is there any reason not to install the latest Apache 2.0 instead of the 1.3 series?

        [I ask because, IIRC, early releases of 2.0 didn't support the latest PHP.]

        • I'm not a PHP guy, so I can't be definitive about that, but the two big areas where Apache 2.0 seems to have been un-finished are PHP and mod_perl support. Random poking around on Google suggests anecdotally that this was true at least as recently as July, according to a random blog hit [afongen.com].

          You're certainly welcome to try it -- bug testers are always welcome for any open source project -- but last I heard the conventional wisdom was still to avoid Apache2 for any site that needs stable mod_perl or PHP support

          • As far as I know the problem isn't so much with Apache2 but with the changing API and modules because they haven't been rewritten /debugged to the specs of A2 to take advantage of it's architecture. Apache 2: Improvements Are Obvious, But Upgrade Choices Aren't [earthweb.com]
          • FWIW I have a server feeding over 1 million hits per day with Apache 2.0 and PHP.

            No stability problems here, yet ... (knock on wood)

          • PHP has been solidified for a few months with Apache 2.0.x. As far as mod_perl goes, they've been slow (6 months between releases) to even put out pre-releases. I can't say I blame them. There's been so much hype around the development of Perl 6 (more specifically, the Perl 6 runtime), that the mod_perl guys have to be wondering about their product's expected lifetime.

            FWIW, I've used the mod_perl 1.99 dev code without any issue on a server that handles a significant load of authentication. While doin

          • mod_throttle and other non-core modules are normally only available to the 1.3.x series (for now).

            Another reason is laziness: If the average admin can't find a package/port/... for an apache 2.x module in their favorite Linux distro or BSD ports collection, they'll normally go for 1.3.x, instead of porting the module to 2.x.

  • ...I better make the obligatory comment....

    "Cor, at least it's not IIS... we'd be having thousands of bugfixes. Damn M$."

  • Thanks (Score:3, Interesting)

    by barcodez ( 580516 ) on Wednesday October 29, 2003 @06:04AM (#7336352)
    Well I for one appreciate the Apache httpd development team's efforts.

  • Why list a commercial web site? (Score:4, Insightful)

    by Futurepower(R) ( 558542 ) on Wednesday October 29, 2003 @07:44AM (#7336502) Homepage

    The Slashdot story said, "... are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache") [bsdforums.org]."

    However, that link references only a copy of the release info on a commercial bulletin board, BSDForums.org, that has plenty of advertisements.

    The Slashdot story could have said, "... are pleased to announce the release of version 1.3.29 of the Apache HTTP Server ("Apache") [apache.org]", which is the official announcement on the apache.org site.
    • copy of the release info on a commercial bulletin board, BSDForums.org

      Notice that the article was submitted by dan@bsdforums.org and you will achieve enlightenment.

      At least he was honest about his affiliation.
    • commercial bulletin board, BSDForums.org, that has plenty of advertisements.

      All I see are 3 text links near the top

      NetBSD 1.6 CDs,T-Mobile's Online Store and The Design & Implementation of 4.3 BSD Unix OS.

      Not exactly what I would call plenty of advertisements.

      • 9 ads on the page.

        It is a breach of trust. The original page was available; why not link to that? If that is okay, what is next; will mirrors insert ads?

        The money apparently does NOT go to help BSD, but goes to a private company; is that true?

        Ads are good, in the right circumstances. Sneakiness is never good.

  • Apache HTTP Server 2.0.48 is also out (Score:3, Informative)

    by jimjag ( 68949 ) on Wednesday October 29, 2003 @10:16AM (#7337126) Homepage
    Released at the same time was 2.0.48.

  • what about 2.0.48? (Score:3, Informative)

    by bluethundr ( 562578 ) * on Wednesday October 29, 2003 @10:44AM (#7337378) Homepage Journal

    In related news, the 2.48 [apache.org] version of apache was also released. Was this a slashdot moment, as well? Did I miss a memo? I'm assuming I have. I recently read the O'Reilly book [oreilly.com]on this topic and two things seemed clear. 1) That the authors of the book really preferred the 1.3.x series of httpd to the 2.x series and that 2) BSD is the way to be for Apache (though Linux is an "okay" substitute.) Which really surprised me because threading in Linux is better than BSD.

    So my questions are: If they are updating the 2.x series why are they *also* updating the 1.3.x series? Isn't the idea that 2.x will supplant/replace the earlier series? What do you get out of using the older version that you don't with the newer? Other than the ability to work with a tool that's more familiar to you becasue you've been using it for so long...Wouldn't the technological advantages of using the newer version outwiegh the inconvenience of yet another learning curve?
    • I don't think it is the learning curve, per se... I made the change-over to 2.x with few problems, other than some security issues that are outside of apache's control (Mandrake 9.x won't allow apache to run CGI without as-yet-unfound configuration changes).

      The main problem is that some things written for apache 1.x do not work under 2.x, or have significant problems. PHP was one of them; other modules have been problematic, too. Once PHP ran acceptably, we switched...

    • 1.3.x isn't being updated. It's in bug fix mode, which means only bugs and security problems are fixed no active development is being done. I think one of the main reason for sticking with 1.3.x for now is that mod_perl for 2.0 isn't considered stable yet. We find it breaks a lot of our mod_perl server management stuff too. 2.0 hasn't been out that long really. How many people out there still run Windows NT4?

    • Re:what about 2.0.48? (Score:5, Insightful)

      by mysticalreaper ( 93971 ) on Wednesday October 29, 2003 @07:48PM (#7342596)
      If they are updating the 2.x series why are they *also* updating the 1.3.x series? Isn't the idea that 2.x will supplant/replace the earlier series? What do you get out of using the older version that you don't with the newer?

      Here, my friend is the beauty of open source. If you want to keep using apache 1.3 (as many are), you can. There's no such thing as a forced upgrade. What version of the software you use is entirely up to you. 2.0 is supposed to be an improvement over 1.3 (and it is), but it's not supposed to 'supplant' 1.3. Just like the Linux kernel 2.4 didn't 'supplant' 2.2, though it WAS an improvement.

      As long as there are interested people in the 1.3 series, bugfixes will come in, and holes will be patched. And that's why it's still being updated. Heck, even the 2.0 kernel is actively maintained. The canges are very slow, but if there's an obvious fix, it will be put in.

      So basically, it's up to you to decide which version to run. And that's exactly the idea, that you have choice and freedom with your software.
    • The main reason I can see is mod_perl.

      As another person said, it's not supported (yet).

      Understatement... try compiling it in ... it just doesn't work. v2.x is a rewrite. Still a baby and has to pay its dues in the field for a while :)

    • Re:what about 2.0.48? (Score:2, Informative)

      by 8282now ( 583198 )
      I'm sure you've seen for yourself but the reason for the dual development track is that not all 1.3x modules have been migrated to the new 2.x platform.
      There are still a number of very popular modules that still require the use of the 1.3x code. So instead of "orphaning" those poor souls dependent (?) on the 1.3x modules, (as mentioned by another poster) the open source world allows for and supports multiple versions to exist.

      Just my two cents...

  • webserver written in Postscript! (Score:4, Funny)

    by satanami69 ( 209636 ) on Wednesday October 29, 2003 @04:30PM (#7340869) Homepage
    Why bother with Apache when you can get the power of PS-HTTPD [pugo.org]

    PS-HTTPD is a HTTP-server written in Postscript. It can handle the main task of a webserver, serving data.
  • If you have a web server... You don't want to get hacked... and you have to know about the patches to fix em.

    That is what slashdot is doing. It is highly important.

    Granted, they could just put it on the side... but hey! slash code is configurable!

    You can choose what types of news you want to read!
    Just log in and visit your preferences page... and make it so you don't see the apache news!

Slashdot Top Deals

One man's constant is another man's variable. -- A.J. Perlis

Close