Freenginx 1.26.0
freenginx.org
freenginx.org
https://freshports.org/www/freenginxhttps://www.nginx.com/resources/wiki/start/topics/depth/ifis...
Here's an unbiased primary source, and a copy:
> Hello!
> As you probably know, F5 closed Moscow office in 2022, and I no longer work for F5 since then. Still, we’ve reached an agreement that I will maintain my role in nginx development as a volunteer. And for almost two years I was working on improving nginx and making it better for everyone, for free.
> Unfortunately, some new non-technical management at F5 recently decided that they know better how to run open source projects. In particular, they decided to interfere with security policy nginx uses for years, ignoring both the policy and developers’ position.
> That’s quite understandable: they own the project, and can do anything with it, including doing marketing-motivated actions, ignoring developers position and community. Still, this contradicts our agreement. And, more importantly, I no longer able to control which changes are made in nginx within F5, and no longer see nginx as a free and open source project developed and maintained for the public good.
> As such, starting from today, I will no longer participate in nginx development as run by F5. Instead, I’m starting an alternative project, which is going to be run by developers, and not corporate entities:
> The goal is to keep nginx development free from arbitrary corporate actions. Help and contributions are welcome. Hope it will be beneficial for everyone.
> -- > Maxim Dounin > http://freenginx.org/
They took unfinished disabled testing code and called it a security vulnerability.
Do you really need it unpacked and explained exactly how and why that is a monumentally stupid thing to do?
Everything, from code to a chair to a sandwich, is unfit for purpose until it is finished.
It serves no purpose to raise an alarm about that when it is a baseline that applies equally to everything in the world.
If one person does it it's just stupid and annoying and not meaningful or useful.
But if you didn't understand that and thought it was a logical thing to do, then everyone else should do the same. If everyone else did the same, this would mean that every single new commit to every single open source codebase would qualify exactly the same. That is not a useful thing to try to do. Eleventy seven gobqillion CVEs every hour for every project in existence. Great. Useful.
OF COURSE the bathroom is not safe to use yet when the plumber has not yet told you it's done.
This isn't a defective or unsafe bathroom, it's not yet declared to BE a bathroom at all in the first place yet. A pile of materials isn't an unsafe and defective bathroom, nor is a half-built bathroom, nor is a bathroom that is practically done and even the plumber thinks it might be done but is still just doing the final checks before signing off on it.
No matter what state it's in, if the contractor has not yet signed off on it, then it's still the same as the pile of raw materials from the start of the job, and it's not useful to anyone to go on some world wide reporting site and warn everyone that this bathroom has leaks and electrical hazards.
It's not just being safer than neccessary, it's not even merely illogical and stupid but harmless, it's actively counter-productive and harmful by diluting the meaning of all other actual CVEs.