Freenginx: Core Nginx developer announces fork

Original Article ↗ Hacker News Discussion ↗

A core Nginx developer has created a fork called Freenginx after clashing with corporate owner F5 over security policy, specifically the decision to assign CVEs to a vulnerability in Nginx’s experimental HTTP/3 code. Commenters see the split as emblematic of deeper tensions between volunteer maintainers and corporate control of critical open-source infrastructure, raising questions about disclosure practices, trademarks, and project governance. Many are now weighing whether to stay with Nginx, move to the new fork, or switch to alternatives such as Caddy, HAProxy, or Angie.

Reason for the fork & governance dispute

  • The fork (“Freenginx”) is framed as a response to non‑technical corporate management (F5) overriding nginx’s long‑standing security policy and developer preferences.
  • The immediate trigger appears to be F5 publishing security advisories and CVEs for a bug in the experimental HTTP/3/QUIC code, against the wishes of the main maintainer, who felt it should be treated as a normal bug per existing policy.
  • Some commenters see this as a “rage‑fork”; others view it as a legitimate reaction to loss of control over an open-source project and a long‑building conflict, not just a single CVE.

CVE and security-policy debate

  • F5 security staff argue they followed CVE rules, that experimental-but-shipped features are in scope, that HTTP/3 is already used in production, and that users must be informed.
  • The opposing view: assigning CVEs for experimental, non‑default features (or for DoS‑only bugs) adds noise, encourages CVE “gamification,” and burdens downstreams with low‑value “security” work.
  • There’s broader criticism that CVE counts are used as KPIs and that security processes can become heavy-handed and politicized.

Existing forks, licensing, and naming

  • Another nginx fork, Angie, already exists, run by a for‑profit company, with a CLA and “pro” version; some distrust this model as a potential future license switch.
  • Freenginx keeps the original 2‑clause BSD license and uses Mercurial, hosted outside GitHub.
  • Several people note F5 owns the nginx trademark and expect domain/name conflicts; suggestions to rebrand abound. Others argue enforcement is unlikely across borders but might affect the .org domain.

Alternatives and migration talk

  • Many discuss moving or having already moved to HAProxy, Caddy, Traefik, lighttpd, or even Apache httpd, depending on needs like static file serving, simplicity, or advanced load balancing.
  • Caddy gets repeated praise for automatic TLS and simpler config, but its ecosystem suffers from “doc‑lock” on nginx examples.

Technical and ecosystem concerns

  • Various technical complaints about nginx: HTTP/1.1 persistent connections dropping on reload, historical request-smuggling issues (reported as fixed and hardened), lack of HTTP/2 upstream support, and some “legacy” defaults.
  • Others defend nginx’s stability, performance, and “good enough” feature set; for many use cases, even years‑old nginx would be fine.
  • Multiple commenters worry about critical infrastructure depending on 1–2 core devs but note that open source and forks provide a path forward, albeit with funding and sustainability challenges.