Maxim Dounin announces the freenginx project.
As such, starting from today, I will no longer participate in nginx development as run by F5. Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities:
The name of this project is a death sentence. F5 owns the NGINX trademark. A successful fork of this will need to have a new name.
When Oracle ruined Hudson, the community forked it and renamed it to Jenkins, and Oracle lost their investment. The same should be possible with NGINX (BSD vs. MIT, IANAL).
That might be true inside Russia, but not in the rest of the world. F5 could sue in the US and force the registrar responsible for the .org TLD to hand the domain to them.
In his place, I would chosen something related but different enough to avoid trademark infringement, like “Freeginx”. IANAL, but I believe sometimes all it takes is one letter to keep lawyers away.
TLDR; F5 owns Nginx. Making corporate over security decisions. New community fork from one of the core devs at http://freenginx.org/. Too new to know if it will be adopted by other mainstream projects that currently leverage/embed nginx.
Note: If you use nginx and are concerned about security, consider a look at projects such as owasp/modsecurity-crs which include security layers on top of nginx.
That doesn’t seem to be the case. From what I read on HN, the dev quit because he thought it didn’t make sense to submit CVEs for temporary/wip solutions, and F5 thought otherwise.
So as I see it, the developer quit because he didn’t agree that a CVE should be opened for a work-in-progress solution that was live on Nginx.
Making corporate over security decisions.
I read the opposite essentially, that F5 is publishing CVEs and the dev did not want them to.
Yeh, seems like the CVEs were against an alpha branch.
So, perhaps its a good reminder not to use alpha in production… But I feel it warranted a bug report instead of a “Common Vulnerabilities and Exploits” notice, normally something used to notify potentially production deployed systems of an issue.
That would be like Pepsi issuing a product recall to all retail outlers for a product that has only been tested internally (kinda)
I think it’s more like pepsi issuing a product recall for something that has been accidentally left on the side of the road. You know you should not be drinking it anyway, but you also know someone would try it.
I’ll justbuse this excuse to repost my thoughts from the other threas https://lemmy.ml/comment/8358568
Sad to see such an established project split up
Kudos!
Does it actually make sense to call it free nginx? It seems like that’d just cause confusion, especially if the projects diverge. Most of the time when this happens they choose a new name (like MariaDB vs MySQL)
That being said, I wish the project all the best. I use nginx both professionally and personally so I’ll be keeping an eye on this.
probably wont be the name for long anyway.
aparently F5 Networks. owns a trademark for nginx.
