One question - does anyone else feel that having NGINX as the only link in the summary kind of suggests that it's an nginx problem? I could imagine my previous boss reading the article, and 3 months later saying, "Wait what, we're using nginx??? Isn't that that shit that made cloudbleed happen?"
Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.
Empty request benchmarks are indicative of nothing in the real world.
For any reasonable workload, even serving static sites of a few kilobytes they will be effectively the same.
Caddy's sane default settings (enforcing SSL, and with correct settings to get an A+ on SSL labs) make it the right choice for a lot of deployments
https://github.com/mholt/caddy/issues/1204#issuecomment-2781...
Greenfield writing a new safe reverse proxy that works within a magnitude of performance of something like nginx is a monumental effort. Not to mention the chicken-and-egg problem of how nobody will trust it until it has significant usage which it won't get until some people trust it.
This caught my eye as well. Not sure what to do about it other than link/read the cloudflare blog post/incident report. FUD, etc.
BUT... The moment you passed your argument through a severe vulnerability related to NGINX (doesn't even have to be directly related, mind you!) will be disclosed and you're boss will jump-in screaming "I KNEW IT, NGINX IS BEHIND ALL THIS!" (he'll be spelling it correctly by then :-P )