Forgot your password?
typodupeerror
Software The Internet Apache

Apache May Stop 1.3, 2.0 Series Releases 77

Posted by Soulskill
from the out-with-the-old dept.
Dan Jones writes "The Apache Software Foundation may stop releasing new versions of the older 1.3 and 2.0 series of its flagship Web server product with most development now focused on the 2.2 series. Nothing is final yet, but messages to the Apache httpd developer mailing list recommend the formal deprecation of the 1.3.x branch, with most citing a lack of development activity. The Apache HTTP server project is one of the most successful and popular open source projects and has become an integral part of the technology stack for thousands of Web and SaaS applications. The first generation of Apache was released in 1995, and the 2.0 series began in 2002. Apache httpd 2.2 began in 2005, with the latest release (October 2009) being 2.2.14. However, the most recent releases of the 1.3 and 2.0 series servers were back in January 2008. With the combined total of active 1.3 and 2.0 series Apache Web servers well into the millions, any decision to end-of-life either product will be watched closely."
This discussion has been archived. No new comments can be posted.

Apache May Stop 1.3, 2.0 Series Releases

Comments Filter:
  • by Chrisq (894406) on Tuesday January 12, 2010 @11:29AM (#30737594)
    Surly this is just a formality. If there have not been updates for two years they are pretty-much dead projects anyway. Conversely if you have been running on an old system for two years without problems then its likely to be pretty stable, so you can just stick with it on the understanding that there will be no fixes or enhancements.
    • But this is slashdot...

      The Open source product we will say the product is allowed to die. But if it was Microsoft we will fight tooth and nail to keep Windows 3.1 from going EOL. Stating how so many people still need it.

      • by TheRaven64 (641858) on Tuesday January 12, 2010 @12:04PM (#30738152) Journal

        With open source, the product doesn't need to die. If ASF isn't going to put any more resources into it, but other people are still using it, then the code is out there and they can hire someone to work on it. There are lots of developers familiar with the Apache codebase who, I'm sure, would be happy for someone to pay them to back-port fixes to the 1.3 and 2.0 series.

        It's also worth noting that this has, in fact, already happened. The OpenBSD base systems includes a fork of Apache 1.3.29 and will probably continue to do so for a long time, because Apache 2.x has a new license.

        • Apache should keep hosting basic pages for the old series with at least LINKS to where the projects have moved to be maintained. Sourceforge for example or OpenBSD.

          The realistic measure should be USAGE not how much development activity there is on the last branch. Bug fixes may be few and years between when the software becomes rock solid. "Perfect" software (unobtainable) would never need patching outside of changes in the abstraction layer with the OS (ignoring compiler issues) but under this line of thin

      • by mwvdlee (775178)

        Open Source products never die, they just hibernate until somebody starts using it again.

        What Apache is effectively saying is; we don't plan on doing any active development on those products anymore. Rest assured that if a severe enough bug is found in Apache 1.3 or 2.0, it WILL be fixed. There's always somebody willing to put in the effort to fix it, and that's all that is needed.

    • Who you calling surly?

      And what does this mean exactly? Obviously, no new features for 1.3 and 2.0 - what about bugfixes? They say: "we'll be distributing security updates by other means" - what are these other means?

    • Well you have to define the term stable. There's a big difference between "doesn't need new features" and "is bug free" and "has no security issues"... There's also different methods to deal with the deprecation. I'd HATE to see them stop support entirely on those branches simply because there's little activity. So many sites rely on them that upgrading would be a non-trivial act. What I would rather see is a "staged" deprecation. Basically reduce 2.0 and 1.3 to "security and mission critical bug fixe
    • by Kjella (173770)

      Mostly. But if you found a really, really nasty security bug, does Apache go "OMG we must fix this" and release a vulnerability alert and a new point release even though it's been two years, or do they say that "that one's out of any kind of support, even extended security-only support, go upgrade because we won't even look at it". That is an important cutoff, even though nothing much happens with any product 3+ years after its release.

    • by ndogg (158021)

      Umm, I don't think that word means what you think it means [google.com].

  • by adnonsense (826530) on Tuesday January 12, 2010 @11:29AM (#30737596) Homepage Journal
    ...Apache 1.3.x is dying
  • go for it (Score:3, Insightful)

    by resfilter (960880) on Tuesday January 12, 2010 @11:31AM (#30737620)
    of course, tons of servers still run the 1.3 and 2.0 branches

    these people don't care if they're in active development - and almost all of them are running them because upgrading isn't worth it for their application.

    all these people care about are security patches. as long as that keeps happening, depreciate them all you want

    it's just like people running 2.2.x kernels on high uptime servers. they don't want new features - if they were willing to install a new version of something every time a new feature came out, they'd be running 2.6.x now anyway. but they'll keep using it as long as reliability and security fixes keep rolling out.
    • Re:go for it (Score:5, Interesting)

      by garcia (6573) on Tuesday January 12, 2010 @12:08PM (#30738214) Homepage

      almost all of them are running them because upgrading isn't worth it for their application.

      Or because the new configuration scheme is not backwards compatible and the time required to get up to speed on the new config is too much of a hassle. There should have been some sort of 1.3->2.0->2.2 configuration updater. If there is and I'm just blind please point in the general direction :)

    • by dingman (126949)

      2.0 is still supported in several Linux distros, including Red Hat Enterprise Linux 4, which is still in support. If you truly need 2.0.x, Red Hat (and I assume other distro maintainers) can be expected to continue providing basic security fix updates to the 2.0 series as long as RHEL4 is still in support. I don't see much reason to expect an upstream project like Apache.org to do that.

      [Yes, I work for Red Hat. But I only represent myself, not my employer nor my colleagues.]

    • by Eil (82413)

      of course, tons of servers still run the 1.3 and 2.0 branches

      these people don't care if they're in active development - and almost all of them are running them because upgrading isn't worth it for their application.

      I'm going to go out on a limb here and say the real reason they don't upgrade is because they don't know which version of Apache they're using, and/or don't care.

      I work for a web hosting company and lots of our customers are still running 1.3 and 2.0 because that's what they were originally set u

  • Security Patches (Score:3, Interesting)

    by TheNinjaroach (878876) on Tuesday January 12, 2010 @11:31AM (#30737626)
    What kind of impact will this have on security patches for remaining security flaws (if any) for 1.3 and 2.0? TFA states that security updates would be provided by "some other means" but I'm not sure what those are.
    • It is opensource project, anyone and everyone, especially businesses that use that software, is candidate for those "other means". That is kind of OS gimmick.

      • by MBGMorden (803437)

        It's not really a "gimmick". It usually does work out that way.

        Apache can drop official support for them, but the reality is if some major security vulnerability comes out SOMEBODY will probably find it worth their time to go fix it. Given the way the OSS community works, those somebodies usually don't mind distributing their patch.

        So while the Apache Foundation won't necessarily have a team working on it, you can bet that you'll probably still get security patches for it as long as there's interest (and

    • Found this answer posted higher up on this story:

      As per http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/README [apache.org] the proposal (Full disclosure: I'm colm@apache.org - the proposer), was that we would start distributing security patches via; http://www.apache.org/dist/httpd/patches/ [apache.org]

      Thanks, colmmacc.

    • OpenBSD still won't include 2.0 or 2.2 in the distribution because the licence is not acceptable to them. I imagine they will continue take an interest in the 1.3 branch.

  • by LWATCDR (28044) on Tuesday January 12, 2010 @11:35AM (#30737672) Homepage Journal

    All kidding aside anybody with the skills and resources can now take over 1.3 and keep updating it. You can not really EOL a FOSS program if anybody wants to keep it alive. That being said there are other light weight web servers that can do what people are using 1.3 for. Now Apache 2.0 may be a bit harder to replace since the migration isn't automatic from what I hear.

    • by fm6 (162816)

      anybody with the skills and resources can now take over 1.3 and keep updating it.

      And who, exactly, has these resources? This is not something a few hackers can take over and keep maintaining in their spare time. A project this size needs project management, QA resources, bandwidth, and a lot of developer hours.

      Apache has done well because it has a robust well-funded organization behind it. That organization exists because a lot of people need Apache to prosper in order to prosper themselves. Yeah, if some of these supporters want to keep 1.3 alive, they can start a new organiz

      • by LWATCDR (28044)

        "And who, exactly, has these resources?"
        IBM, Google, Intel, a large ISP, or a major university.
        That is why I said talent and resources, you are completely correct that it can die but not if enough users or powerful enough users want to keep it alive. You could also just keep it as is and just keep adding security patches which would take a lot few resources than active development.
        And I really should have clarified that resources part. I was thinking of somebody like say RedHat, Novell, or IBM when I made t

        • by fm6 (162816)

          You forgot to mention Donald Trump.

          In addition to the resources, you have to have a sane business case for expanding them. I believe I mentioned that.

    • by zekele2 (1556449)

      All kidding aside anybody with the skills and resources can now take over 1.3 and keep updating it. You can not really EOL a FOSS program if anybody wants to keep it alive.

      OpenBSD's forked version of Apache 1.3.29 already fulfills this role.

  • by MaraDNS (1629201) on Tuesday January 12, 2010 @11:53AM (#30737960) Homepage Journal

    Putting closure on a software product is important.

    Professional software usually has an EOL schedule. For example, RedHat Enterprise Linux and Windows XP both have EOLs for early 2014. This allows people using the software to plan upgrades and know when they need to be making a transition.

    This is equally as important for open-source software. It looks really bad when this is not done. For example, Dan Bernstein's DjbDNS software package has three unpatched security holes [maradns.org]. People using this software have to know about these holes and apply third-party patches.

    In addition, when the maker of an open-source program says "OK, I'm done with this program.", it allows maintainers to step forward and take over the project. For example, when I announced I would no longer work on a Doom random map generator [blogspot.com] I had been hacking on for a while, someone expressed interest in maintaining the software, and subsequent updates have since been done [blogspot.com].

    I think the Apache foundation should either say "OK, we'll still fix security bugs on this program" or "We're no longer maintaining this release". This way, the users of these programs know whether to upgrade, form their own group applying security patches, or just know they're OK from a security prospective if they're current.

    I have blogged about putting closure on open-source projects [blogspot.com] and have well defined EOL dates for older releases of my own MaraDNS [maradns.org].

    A lot of open-source projects just languish when the developers lose interest; I feel this is irresponsible and feel EOL dates and putting closure is important.

    • by rubycodez (864176)

      wrong, it is irresponsible of *YOU* to use software which is not activity patched and maintained. Pretty easy to not commit that sin if you stay with high-level distro's maintained packages. But otherwise it's on your head. No one has to maintain software you like just because you wish they would.

      • by tyrione (134248)
        High-level distros EOL software all the time, based upon the project's design goals. They maintain builds, they do not develop the solution. Clearly, Debian has 5 levels of distribution structure and anyone running a 2.2 kernel Debian knew long ago that it was not going to be actively maintained whereas the 2.6.current branch is obviously being patched and changes moved upstream to the Kernel trunk.
  • About time (Score:3, Insightful)

    by ironicsky (569792) on Tuesday January 12, 2010 @11:57AM (#30738018) Journal

    Supporting Apache 1.3 is like Microsoft supporting Windows 98. Apache 1.x is almost 15 years and Apache 2.x has been out for 10 years. People have had plenty of time to upgrade. It's time to move on.

  • I make thorough use of it on many platforms, for the reasons that it has a notably smaller memory footprint, runs swifter, and is a bit more manageable than both of the 2.x branches. I recognize the extended, native feature set of the 2.x branches; but I simply don't need any of them; they are not apt replacements for what 1.3 offers. I also recognize the problem with the 1.3 branch not quite receiving the attention it could do with regarding updates (although 1.3.41 has no known security issues at the mome
    • Re: (Score:3, Insightful)

      by lofoforabr (751004)

      Although 1.3 certainly has a smaller memory footprint without some features I don't need, I usually try to get the best from both worlds. For my applications, I normally use the latest apache, and leverage its memory usage by using any of the following:

      • Offloading static content to a lighter web server, like lighttpd;
      • Using a cache layer in the application itself, to avoid high memory consumption (in PHP or whatever language);
      • Getting a reverse proxy in front of all of it (squid does a remarkable job).

      Not all

  • The last install I did of Solaris 10 included Apache 2.0 (.58, IIRC), so there are still new installations going in with 2.0. Since Sun started shipping Apache with the OS, we tend to use it rather than create our own packages or use the Sun freeware versions - theoretically, Sun will support the OS supplied version (never needed support on it, so couldn't say).

    I believe the cooltools versions use 2.2, but not sure if the latest 10 releases include it as standard.

    Our production estate includes every

  • sorry.

    im in web hosting and web development business, and i can easily say that majority of the web still runs on 1.3. innumerable scripts, modules, software were coded for 1.3, and there are innumerable websites that still need those stuff. even the clients which start with newer versions are sometimes having to go back to 1.3 because they need some module or software that is uncommon but vital in their line of business.

    'obsolete','old','development ceased','not supported' etc do not count. this is about b

    • Re: (Score:1, Funny)

      by Anonymous Coward

      So, do all people in "web development business" lack the SHIFT key or just you?

      • by T-Ranger (10520)
        I was going to say. Yeah, you do have bigger issues then upgrading your webserver software... Like replacing your broken keyboard.
    • by shutdown -p now (807394) on Tuesday January 12, 2010 @02:27PM (#30740596) Journal

      There's no way I can subscribe to the notion that Apache developers (or anyone, really) has an ethical obligation to keep maintaining a 10 year old codebase with any kind of implied guarantee. If there was a contract in place requiring that, then sure; but there isn't such a thing here.

      Any people using Apache 1.3 should have really see this coming, and there's absolutely no excuse not to. It's the standard way of doing things in this industry, and if anything, the term was already waaay longer than is common.

      Furthermore, the options are also fairly obvious:

      1. Upgrade your environment to 2.2 (or pay someone to do so for you and accept responsibility).

      2. Keep maintaining 1.3 on your own (or pay someone to do so for you and accept responsibility).

      3. Migrate to a different server (or pay... you get the idea).

      Now you also say that:

      they dont have the funds or possibility to upgrade by themselves

      to which I can only reply, "too bad, they should have engaged their brains at some point in the past - they had 10 years to do so". If they're screwed, they have absolutely no-one to blame by themselves.

      Of course, in reality, when they realize that the FOSS white knight in shining armor won't save their ass by keeping to provide them quality software for free this time, you can bet the funds will suddenly be found. Furthermore, I suspect that vast majority of those people would actually go with option #1, and just upgrade to 2.2 (and also learn their lesson to keep up with the update curve to a reasonable extent to minimize "late upgrade" expenses).

      Or maybe, if there are really that many 1.3 users who absolutely won't move to 2.2, and each one has so little money they can't pay anyone to get them to move to anything else, either (where are they hosting? in the basement?), then, well, the beauty of FOSS is that they can also come together, form some sort of non-profit funded by all of them - with minimal amount of contribution from each - that would hire people to fork and maintain 1.3 for the benefit of all.

      Or maybe they can just donate to OpenBSD.

      In any case, if people "don't have the means or resources" (which ultimately means "money") to do their business, then they shouldn't stay in that business - it really is as simple as that.

      • the obligation is not ethical. its practical.

        logical words, rationalizations, and even being right wont change the matter.

        the success of a project, and ultimately open source depends on people using it. if the people and businesses using it are left out in the cold like piles of crap, by a major project, even only once, the opinion against open source will change. and the masses which were using that software will switch to other providers. very probably closed source proprietory software, because at least

    • by Improv (2467)

      How many years do you expect 1.x to be supported? 2.x is a bit over 8 years old right now, and as OP notes, it might not run on modern OSs. At some point, people will have to make the change (staying still is for the Amish - not everyone needs to be an early adopter, but doing anything on 1.x is getting very curmudgeonly at this point. You're not going to see a lot of support for ancient software in open *or* closed source environments.

      Also, you're not the people if you're thinking this way, you're a busine

      • by unity100 (970058)

        small businesses do not have the funds or time to make any kind of migration. this is a matter of life and death for many. 'necessities' of business, or 'technology' do not make any difference in such a situation. especially during a global crisis.

        • by Improv (2467)

          Then they will die. The world is not going to stand still for them. Customers arn't going to keep wanting Apache 1.x. OS's will stop supporting it. They won't be able to keep it secure if they stay behind on old OS's, and eventually won't be able to replace hardware when it wears out because such an old OS won't run on it. Changing tax codes might cause their frozen-in-time accountant's head to burst. Changing legal requirements might cause these in-a-rut businesses to fall apart.

          Businesses that are so easi

  • by fm6 (162816)

    The Apache HTTP server project is one of the most successful and popular open source projects

    One of them? Is there any other OS project that even comes close to Apache's impact?

    • by tyrione (134248)
      From a few comments you'd think nginx and lighttpd are eating it's lunch. Let's face it, Apache wants to move onto the 3.0 future.
      • by fm6 (162816)

        Apples and oranges, really. Lightweight http servers just don't serve the same users as Apache.

NOWPRINT. NOWPRINT. Clemclone, back to the shadows again. - The Firesign Theater

Working...