How come this wasn't covered by one or more automated tests that failed?
Apache httpd existed many years before junit was invented in 1997. Long before TDD became a thing and our rigorous modern understanding set in. For a second, I even thought the Apache Foundation (founded because of httpd) later hosted junit, but I was wrong, is the Eclipse Foundation.
Some people were writing their own ad-hoc scaffolds before that but it wasn't a widespread practice. Testing meant manual testers clicking on things in the UI, and sophisticated testing was if you had checklists of things to test manually.
Though I agree, that although not a technical justification, an explanation as to why there are no tests is because Apache HTTP is from the 90's. Not writing unit tests was par for course back then. Most FLOSS code bases in the 90s didn't have unit tests, let a alone a CI to run the test suite for each change. Adding tests later is hard. Though there are some tests under the test folder.
The attacks on OpenSSL maintainers ten years ago were disgusting, and I think we've learned nothing since then.
I didn't register the attacks, but I'm sure there were some when you say it.
I summarized the blame on that incident xkcd's wording:
"some random person has been thanklessly maintaining since 2003"
And ASF does receive funding, by the way, even if not much (slightly less than two and a half million USD in 2024).
A quick eyeball of the projects list looks like about 100 projects: https://projects.apache.org/projects.html
So each project gets funded enough for 10% of a developer. That's not enough to provide infrastructure to commercial users satisfaction.
Apache HTTPD still seems to run about 17% of all sites, plenty of those probably make money using the software. https://www.netcraft.com/blog/january-2025-web-server-survey
Open source is open, so naturally people can use it but the ecosystem has also been at a breaking point for years and bad actors has caught the scent of that.
> If you want to participate in actively developing Apache please subscribe to the dev@httpd.apache.org mailing list as described at https://httpd.apache.org/lists.html#http-dev