>Greetings.
>
>---------- Forwarded message ----------
>From: Hugo Leisink
>Date: Dec 7, 2007 10:02 AM
>Subject: Re: Hiawatha
>To: Andris
>
>
>
>Andris wrote:
>> Could you please send your first e-mail to me again? I forgot to save
>> it to forward it later :P
>>
>> Greetings.
>>
>Sure, here it is:
>
>
>Hi Andres,
>
>I saw your post about Hiawatha in OpenBSD. I'd like to respond to the
>remarks about "Hiawatha's source code is free of security-bugs" on the
>Hiawatha website.
>
>First of all, you have to take a look at the webserver market. You use
>Apache, IIS, Lighttpd or you don't use anything at all. If you want
>people to use your software, you have to 'beat Goliath'. People use
>Apache, because everybody else does, even when Apache is the worse fit
>for their purposes. I think Hiawatha has become a really good webserver.
>It's faster then Apache, is more secure then Apache and definitly more
>easy to configure then Apache. But people don't use it because 'it ain't
>Apache'. So, to draw people's attention and to make them at least try
>Hiawatha once, I have to make 'dangerous' statements like 'free of
>security bugs'.
>
>Second, the reponses to your message are typical for the OpenBSD
>community. It's like they own the word 'security'. Only OpenBSD is
>secure, the rest is not. But I guess I don't have to remind you about
>http://pwnie-awards.org/winners.html#lamestvendor Yes, Hiawatha has had
>bugs too. And guess what, Hiawatha will have bugs in the future. But
>none of the found bugs could have been used to take over the webserver
>or deface websites. And unless someone proves me wrong, my claim that
>"Hiawatha is the most secure webserver" stands.
>
>greetings,
>Hugo
>
>---------- Forwarded message ----------
>From: Hugo Leisink
>Date: Dec 7, 2007 4:33 AM
>Subject: Re: Hiawatha
>To: Andris
>
>
>Hi Andres
>> Hi, thanks for the comments. I have two questions for you:
>>
>> 1. Would you let me forward this to
misc@openbsd.org?
>>
>I have no problems with that, but I think there will be enough OpenBSD
>people not able to have a fair discussion about it (especially after my
>second remark).
>
>> 2. Would you relicense Hiawatha?
>>
>I will never abandon the GPL license. So if it's possible for a piece of
>software to have two licenses, I'm not negative towards using the BSD
>license for Hiawatha. But of course, I first have to think about the
>consequenses before actually doing so.
>
>> Even if OpenBSD does not prefer Hiawatha, a project goal still stands:
>> "We strive to make our software robust and secure, and encourage
>> companies to use whichever pieces they want to."
>>
>> And, IMHO, it applies to any project which seeks security.
>>
>I agree. And I think the OpenBSD project has done some really good jobs.
>But it's the we-are-untouchable attitude of too many OpenBSD people that
>keeps me away from it. I've had some discussions with OpenBSD people
>before and too many of them weren't very pleasant. If someone finds a
>bad thing in Hiawatha or has some good points about how things can be
>done better, I'm the first one to say he's right. But if someone starts
>saying that "Hiawatha is insecure and sucks because my coding style
>doesn't match his" then the discussion is over for me. And let's be
>honest, critizing a piece of software by only looking at it's project
>website and not having the guts to even look at the source code, THAT is
>'sheer stupidity'.
>
>
>So, yes, I'm willing to talk again with the OpenBSD community. And if
>they choose Hiawatha, I will be very proud. And if they don't, I will
>try to improve Hiawatha until they do like it. BUT.... not if words like
>'sucks', 'crap' and 'sheer stupidity' are being used. So, it's up to the
>OpenBSD community.
>
>greetings,
>Hugo
