Slashdot Mirror

And finally, reader loonix_gangsta wrote in and pointed to SCO's humorous 5 reasons to choose UNIX over Linux webpage.

Yeah, this is exactly why their web server runs Linux.

My conclusion was that if Microsoft was able to dominate the web on the desktop, it would be a short matter of time before they could extend and dominate the web on the server. I knew that Mozilla was our last and only hope for winning this.

www.eeye.com is running Microsoft-IIS/5.0 on Windows 2000. maybe that's why they're so concerned.
info source here

As seen here one of the benefits is "These security features guard against business interruption, denial of service attacks and protect against identity or corporate information theft." (emphasis mine) It makes one wonder why they don't run their web server on it instead of linux?

www.sco.com is a weapon of mass destruction.
Do read the last Solution (#5)

Microsoft is dying.

Not even Microsoft can make .NET scalable enough to sustain a good ol /.'ing.

It's only scalable if you plan it that way. The site seems to be working fine now (did you click on the correct link?) and if you had visited it you'd see:

It's an experimental research project run by the Interactive Visual Media Group at Microsoft Research

You expect a research project to be primed for loads of traffic? Of course, we all know that no Apache server has ever been slashdotted...oh wait, this just in from fedoranews.org

NOTICE 2004-02-05 11:00 AM
Sorry, we've been slashdotted. The KDE 3.2 articles will ben turn off for next few days.

From netcraft:

The site fedoranews.org is running Apache/1.3.27 (Unix) (Red-Hat/Linux) mod_ssl/2.8.12 OpenSSL/0.9.6b DAV/1.0.3 PHP/4.1.2 mod_perl/1.26 on Linux.

Hopefully fedoranews.org "will ben" turn on the articles soon. In the meantime, wwmx.org remains available for browsing.

What makes you think that sponsoring == hosting?

This? Specifically, the part where it indicates the Netblock Owner is Microsoft.

And the other site seems to be running JSP.

Which site is that? The only other links I saw went to sites that were either static HTML or ASP.

..look at the top 50 uptimes though. It's almost all BSD based OSs with a smattering of Linux.

A month? You're not even getting close to full bragging rights. I have one friend who lamented haveing to reboot his Sun after 3 years of uptime (had to flick a dip switch), and another spitting fire because someone at his colo provider f*cked up with the UPS system just about the time his box was set to bread one year of uptime.

Netcraft notes that Linux (among others) has this minor bug in that the uptime counter wraps every 497.1 days. (units 2^32seconds/100 days) You can see it happening regulary in some of their uptime charts. Their "top 50" website uptimes range from 1000 to 1500 days.

http://uptime.netcraft.com/up/graph/?host=news.bbc .co.uk

He goes on about the linux users "wrath of geeks". Does this guy even know that thanks to this "wrath of geeks" his article is online? What some people do for a few seconds of fame and cheap cash.

Like so many others, I too replied to the BBC article that has riled us "internet zealots" up. I wont post that letter here... too many others have so far, and mine would simply be a rehash of things that we have all thought or written at this point...

What I DO want to point out tho, is that that one point I made in my letter was the irony of Evans' story calling the OSS community a bunch of "run-of-the-mill geeks" and "internet zealouts" out for vengeance while that same story is hosted on servers running almost exclusively Linux and Apache.

Heres the netcraft report on news.bbc.co.uk:
http://uptime.netcraft.com/up/graph/?host=news.bbc .co.uk

http://uptime.netcraft.com/up/graph?site=news.bbc. co.uk

I hope the bbc netadmins read BOFH.

Fact: You're a really weird guy

The MyDoom virus launched a denial-of-service attack early Sunday that crippled SCO Group's Web site with hundreds of thousands of requests, an SCO spokesman said.

Strange then that sco.com is working fine, as are their DNS servers. All they've done is pulled A records for their various www hosts and according to netcraft www.sco.com seemed ok too until they pulled the DNS record.

Surely SCO arent hyping this up? Would be very atypical of them..

Dr.Kalam's website at http://presidentofindia.nic.in/ , runs on Linux and Apache . Undoubtedly one of the most qualified persons for the job, he headed India's defence research body, the DRDO and was one of the key members of the team planning and implementing India's second round of nuclear tests in 1998 (India tested its first nuclear device in 1974).
Also a bachelor like India's executive head,the Prime Minister.

Actually the question you should be asking yourself, that if OpenBSD is so secure, why isn't it trusted to run www.openbsd.org?

(Perhaps that's because despite the vaunted "auditing", OBSD is still largely ancient 1980s C code that was never designed with security in mind, and it's realworld exploitability is not significantly less than Linux or any other Unix.)

SCO has now set the A record for its domain to 127.0.0.1, possibly taking advice from the Netcraft article posted here earlier ;^)

The virus was going to hit at 16:something hour. I checked the SCO website this night at 1:30 (CET) and then it was already offline. No reply no more

My guess is they took it offline themselves. Or they applied one of the tricks from yesterdays netcraft post.

It might well be a publicity stunt; but it's not like they're completely unprepared, at least according to netcraft:

We had expected that SCO might take www.sco.com out of the DNS in the run up to the MyDoom DDoS payload in order to keep the denial of service http traffic off the Internet. So far, though, www.sco.com still resolves and receives http requests, though closing the connection without sending a response.

That said, the sco.com hostmaster is reserving his options, with the TTL set to just 60 seconds at time of writing.

Some news about the SCO dns:
http://news.netcraft.com/archives/2004/02/01/sunda y_morning_and_wwwscocom_is_still_in_the_dns.html

And graphs showing the results:
http://uptime.netcraft.com/perf/graph?site=www.sco .com

Some news about the SCO dns:
http://news.netcraft.com/archives/2004/02/01/sunda y_morning_and_wwwscocom_is_still_in_the_dns.html

And graphs showing the results:
http://uptime.netcraft.com/perf/graph?site=www.sco .com

On Febuary 1st, at midnight, mydoom started DDoSing sco.com

At that very time, my ISP (one of the largest in the Midwest US) also increased the upload cap from 128kbit to 256kbit - an upgrade plan that was in the works for a couple weeks (at least) prior to the mydoom worm.

Furthermore, my ISP happens to be a huge fan of a certain freedom-supporting OS.

I'm pretty impressed as it's only a 'local alternative newspaper' that it's not buckling under the Slashdot effect, in fact it hasn't even slowed down!
Even stranger is the Netcraft 'what's that site running?' results, showing that the server was recently running MacOS!

According to Netcraft SCO has converted their webserver from Linux to NetBSD/OpenBSD. I suspect it was Caldera Linux they were running on and they probably felt their software sucked to bad to weather the impending DDos attack.

The document you're looking for is here. But they're people too, and so they have an opinion of their own. Now they felt like letting the rest of the net know what their opinion on this matter is.

The whole front page of SCO's website is dedictated to the virus. If you were running SCO you wouldn't have this problem, so why is it freatured on their website? Probably just fodder for the next lawsuit is my guess.

J.

Looking at their uptime stats, a DDoS wouldn't really make much difference.

I liked option #5 in the article you linked to:

Solution 5: SCO Execs point www.sco.com at the loopback address 127.0.0.1, end lawsuits, dismiss lawyers, and invest remaining corporate cash reserves in call options in Dell & Microsoft stock.

Consequences: No denial of service traffic whatsoever seen on the Internet. Millions of Windows users notice that their computer is running extremely slowly. Many buy new machines, which fixes the problem. Dell & Microsoft stock rises. Everyone lives happily ever after.

:-)

Seriously, I find it interesting that more news hasn't been made of the apology buried in the MyDoom.B virus: The creator of what anti-virus experts say is the fastest spreading virus ever on the Internet signed Mydoom and Mydoom.B with "andy," and left the following message in the latter version: "I'm just doing my job, nothing personal, sorry."

I really, really wonder if a programmer out there will develop a burning conscience, quit his job and leak his story to the press. Man, I'd really like to know what company was responsible for this.

This is only vaguely on-topic, but SCO seems to have changed their webserver to openbsd or netbsd. At least, Netcraft says so. Although, that could mean more than one thing (such as they stuck another box in front to take the blunt of the impending attack).

Or wait, does that mean they really plan on going after the *BSDs now?

This is OT but Netcraft has an amusing article about what options SCO, the litigious bastards, are not using to avoid being DOSed by Mydoom tomarrow.

It hasnt made it on slashdot yet, but netcraft is reporting that future versions of IE will no longer be supporting user information in HTTP or HTTPS URLs.

For more information, please see microsoft's advisory. Thats right, type in the URL yourself, it really is at microsoft.com. From now on, any HTTP or HTTPS URL that has an @ sign in it will report "Invalid syntax error".

After months and still no patch for this bug.. they just now announced THIS as their fix, but still no patches. You'd think they'd just prevent parts of their URL bar from disappearing instead of removing features..

Workarounds for this new behavior are listed as:
* Do not include user information in HTTP or HTTPS URLs.
* Instruct users not to include their user information when they type HTTP or HTTPS URLs.

How ingenious. I also find it interesting that they link to the standards they are now breaking under "references".

If you look at Netcraft's graph of SCO's outage, they are using Apache on Linux and have not used SCO Unix to run thier site since August 13, 2002.

Given that a lot of people believe that the worm doesn't actually cause a DDoS on SCO, it's interesting that Netcraft show their servers are increasing in failures.

Netcraft's got an interesting idea - Journalists reporting on SCO and people interested in the www.sco.com site can now subscribe to receive alerts when the site is unavailable.

That is only part of the problem. The biggest problem is that netcraft counts sites and not servers in these surveys. All it takes is one big host to switch from RedHat to Debian to swing the whole thing. Every so often they post it by OS but that latest one I can find is from 2001. I think it is because they sell that info now.

Specific to this survey - you have to really look at the total numbers, too. If one distro had gone from 10 to 20 it would have been a 100% increase but I don't think anybody would be reporting it is threatening redhat.

That is only part of the problem. The biggest problem is that netcraft counts sites and not servers in these surveys. All it takes is one big host to switch from RedHat to Debian to swing the whole thing. Every so often they post it by OS but that latest one I can find is from 2001. I think it is because they sell that info now.

Specific to this survey - you have to really look at the total numbers, too. If one distro had gone from 10 to 20 it would have been a 100% increase but I don't think anybody would be reporting it is threatening redhat.

Not only this, but according this article in Netcracft, Microsoft is deprecating the use of "@" in URLS. In the next upgrade, any URL with "@" in it will return an "invalid syntax error". Let's hope they also fix many other bugs many times reported...

I had a quick look at their server today (28th, when the report is due out) and response time was good - checking them with Netcraft it looks like they are running Apache (probably on Linux underneath - though Netcraft is not always reliable on this point in my experience), and recently changed over to Akamai presumably for edge caching - which would explain the good response time.

Any Slashdotters involved with the technical side of the inquiry? I was really impressed by the evidence management system where everything submitted got scanned in and was available on screen to the witnesses and (mostly) on the website as well.

But as Perens said... it's not a good thing that the worm still has a good chance of knocking SCO.com down for a while.

Does the History at the bottom of Netcraft SCO History mean that they're using Linux?
Or used it in the Past?
hehe, damn bastards!

Anyone notice the bottom of the Netcraft report (under OS, Web Server and Hosting History for www.sco.com)?

unknown Apache 27-Jan-2004 216.250.128.12 NFT

Linux Apache 12-Dec-2003 216.250.128.12 NFT

Now we know why they were too busy to respond to the judge's discovery order - they were getting their website converted over to another OS (or hiding that the OS was Linux).

Curiously, the netcraft site shows they tried this for a day earlier in December and presumably had problems with the cutover. The full Netcraft report shows an interesting evolution in webservers:

unknown Apache 27-Jan-2004 216.250.128.12 NFT
Linux Apache 12-Dec-2003 216.250.128.12 NFT
unknown Apache 11-Dec-2003 216.250.128.12 NFT
Linux Apache 3-Sep-2003 216.250.128.12 NFT
Linux Apache 21-Aug-2003 216.250.140.112 NFT
Linux Apache/1.3.14 (Unix) mod_ssl/2.7.1 OpenSSL/0.9.6 PHP/4.3.2-RC 17-Jun-2003 216.250.140.112 NFT
Linux Apache/1.3.14 (Unix) mod_ssl/2.7.1 OpenSSL/0.9.6 PHP/4.0.3pl1 20-Nov-2002 216.250.140.112 NFT
Linux Apache/1.3.14 (Unix) mod_ssl/2.7.1 OpenSSL/0.9.6 PHP/4.0.3pl1 14-Aug-2002 216.250.140.125 NFT
SCO UNIX Netscape-FastTrack/2.01 13-Aug-2002 132.147.210.109 Caldera, Inc.
SCO UNIX Netscape-FastTrack/2.01 12-Aug-2002 132.147.210.109 Caldera, Inc.

From SCO to Linux? Linux running as recently as December 2003? Of course, since they own Linux, I guess this is ok...

If you'd engaged brain before fingers, you'd realise that SCO have been and are running Linux/Apache. Did you expect them to be on IIS?

Lets all take a look at what Netcraft has to say about SCO's hosting setup today...

Hmmm... looks like they switched operating systems on January 27, 2004. Notice the table at the bottom of the page. They used to be running Apache on a Linux kernel up until today. Now it is Apache on 'unknown'. Perhaps that explains the downtime.

/me places tounge in cheek

They might be switching from GNU/Linux systems to something a little bit more suited to enterprise environments.

[1] Or at least they have in the past, its "unknown" at the moment.

Yes, and if you look at

http://news.netcraft.com/archives/2004/01/27/vir us sco.png

You'll see that it went off line two days ago.

Also, on that same page (http://news.netcraft.com/)

"Computers infected by the fast-spreading MyDoom e-mail virus will attempt to launch a distributed denial of service attack (DDoS) on the sco.com web site on Feb. 1, according to updated analyses by Symantec and F-Secure. Several hours after the virus began spreading at about 9 p.m. GMT, the SCO web site was offline briefly. " (emphasis mine)

Yes, and if you look at

http://news.netcraft.com/archives/2004/01/27/vir us sco.png

You'll see that it went off line two days ago.

Also, on that same page (http://news.netcraft.com/)

"Computers infected by the fast-spreading MyDoom e-mail virus will attempt to launch a distributed denial of service attack (DDoS) on the sco.com web site on Feb. 1, according to updated analyses by Symantec and F-Secure. Several hours after the virus began spreading at about 9 p.m. GMT, the SCO web site was offline briefly. " (emphasis mine)

is actually, nice to have SCO.com messsed around. just because they will be forced to use LINUX/APACHE to survive the attack

According to NetCraft, they already do use Linux/Apache on their web server :-)