Introduction
nginx is one of the most popular web-server software, used by hundreds of millions of websites worldwide. It was written by Igor Sysoev in early 2000s, was released and is maintained as an open source software.
At the time of initial release Igor was working for Rambler (a Russian internet company). In 2011 Igor and his partners founded a BVI company Nginx Inc. to provide commercial products and support for the software. The nginx software remained (and still remains) open source. They raised some VC financing and in 2019 were finally acquired by a public company F5 Networks, Inc. for an impressive $670 million.
What has happened?
Today Igor and his partner Maxim Konovalov were arrested in Moscow and are being interrogated. A search is performed in Moscow office of the company. It became public that Rambler filed a lawsuit for breaking its IP rights on nginx.
It might look like a typical IP ownership conflict, but there are details: a) Worldwide internet infrastructure relies heavily on nginx. b) People are under arrest, which illustrates a serious intention and may lead to unpleasant consequences. c) It all happened some months after a successful acquisition, while Rambler was aware of nginx for more than 15 years since the date of the initial nginx release.
What's next?
It is extremely unlikely that Internet will meet any short-term consequences. No, there's no way to turn down nginx remotely, there's no backdoors, etc – so Internet is safe.
No, there is no chance that Russian secret service or someone else will use this situation to introduce some backdoors to nginx server. As any popular open-source software, nginx is developed by hundreds of independent individuals from various countries. The source code is always publicly available, and each developer is highly aware about security.
Long-term consequences are possible, including decline in nginx popularity and development of alternative software. If nginx will be forced to change its licence or shut down, it's very likely that community will instantly make a fork and/or a complete rewrite of this webserver under a new name (which has happened before to MySQL, for instance).
We all hope that this conflict will be resolved, and Igor and Maxim will be safe and sound. All we can do now is spread this information in as straight and clear way.