Slashdot Mirror

A lifetime ago, myself and a few other people had the pleasure of working with Howard Chu for a short time working to port Android to our HTC Touch Pro 2s.

Being the smartest guy in the room by far, Howard was actually doing 99.9% of the actual work, but us script kiddies also wanted Android on our phones, so we tried our best to help him debug.

I remember either myself, or someone else writing an init script that would do some kind of debugging on startup for an issue we were having. Given what it needed to do, the script was ridiculously complex, complete with functions and error checking.

When Mr. Chu saw the script, he literally lol'd (we conversed via IRC), remarking that he would have made it one line.

People use the engine behind LDAP servers as a database.

LMDB

Also if you want a key/value store, there is also http://symas.com/mdb/ from a company of some of the OpenLDAP developers.

Which really seems to be have the fastest read performance of them all.

I never knew about Berkeley DB though, lol. It has been seized by Oracle in 2006.

If you work on a FLOSS project that uses BDB, seriously consider if LMDB can work for you as well (or often better).

You could skip Samba4 and call Symas if you want consistent SID/POSIX mapping without learning everything about the protocols and paradigms of both systems. Or if you already understand the Deep Magic just use Kerb5 (MIT or Heimdal) and GSSAPI and SASL and OpenLDAP from sources.

I'd say one of the first questions you need to ask yourself (and your management and legal people) is what level of security you require for your data. After that read up on NFSv3 security; a good article is at http://www.usenix.org/publications/login/2005-02/p dfs/musings.pdf , which touches on most of the major problems. And yes, the situation really is that bad, and tools to exploit the numerous weaknesses are easily obtainable. NFSv3 "security" is a joke. Unless you use it purely as a back end system on a secured, private network between physically secure machines that only people who have access rights to all files on the server have access to, you will lose to any minimally skilled cracker or disgruntled employee (or if someone decides to write self-replicating malware that exploits NFSv3 weaknessess, which frankly I wish someone would do so management types could fully grok how exposed they are).

Once your company understands how unacceptable NFSv3 security is for any kind of situation involving company-confidential or legally-sensitive data, solutions like Network Appliance will start to look like they suck, because they do not support any decently secure protocol that the majority of Unix clients can use, nor will they unless the vendor feels like adding them (appliance model = big, useless / overpriced bricks if you change storage strategies). Only the very latest Unix versions support NFSv4 at all, and that support is universally not well documented, and in my experiance, esp. on GNU/Linux, somewhat buggy. Managing the differing permissions models between CIFS, NFSv3 and NFSv4 is also insanely complex, with lot of subtle problems that can leave you wide open.

There is exactly one non-kludgey widely used solution to this problem, and that is OpenAFS (http://www.openafs.org). Designed for security, proven over more than a decade in demanding environments (Morgan Stanley, MIT, CMU), same permissions model across platforms etc. If you'd like to talk to a vendor, Sine Nomine Associates (http://sinenomine.net/support/afs) is one of several that sell support contracts (the software itself is Open Source). The best vendor backup solution for OpenAFS is TiBS (http://www.teradactyl.com/Products/Afs.html), although roll-your-own is pretty easy as well. Note that if you don't want to touch the Windows desktops with OpenAFS client installs, Samba has excellent support for using OpenAFS as a back end (i.e. Windows clients accessing AFS-space via their native CIFS clients via Samba). There is also a NFSv3 translator service for if you happen to have any extremely odd or old Unix operating systems that aren't supported by OpenAFS or ARLA
(http://www.stacken.kth.se/project/arla/) clients. Another option in some cases would be to buy Sharity (http://www.obdev.at/products/sharity/index.html) licenses and access AFS-space via CIFS/Samba. To use OpenAFS you also need a Kerberos 5 KDC; for this you can use Active Directory, or MIT or Heimdal Kerberos 5, which are both free. For a cross-platform single signon solution, you can combine Samba, OpenLDAP and Heimdal; this requires experianced unix-y sys admins, but companies like Symas Corp., http://www.symas.com/ , will do it for you.

You mentioned DCE/DFS (which I've noticed several people have misinterpreted as Microsoft dfs, which has almost nothing in common with DCE/DFS). DCE/DFS is dead. It had little vendor uptake; IBM supplied clients for most platforms, and IBM stopped development and ended support quite a while ago. Management was a complete nightmare. There is no open source implementation. It's dead, Jim! :-)

IBM has 2 major migration paths away from DCE/DFS (and IBM AFS, which is also end-of-lifed, although most of those customers just moved to OpenAFS). One is SANFS (http://www.redbooks.ibm.com/abstracts/SG247057.ht ml?Open), which is cool but appropriate to only a limited r

Amusing. It's just part of the Sales Pitch to "the street" and those who have no clue. They're trying to make it sound like this old idea is new so they can generate excitement and multiples of real value for the IPO. And the market's collective amnesia will help them.

Yet another mindless raving rated as "Insightful" - where do you guys get this stuff?

The above post is a stream of empty claims and not even a hint of factual support. How can you rate someone saying "I haven't looked at the code yet .. it is high quality from its core to its exterior" as *Insightful* ?? There is ZERO insight here.

Nobody here knows what kind of server the Netscape guys were talking about, what those 200,000 clients were doing, or what the directory data looked like. We have No Insight into what that claim means.

But you can look here http://www.symas.com/benchmark.shtml and see charts derived from documented benchmark procedures that You Yourself can repeat and verify, showing that Netscape's performance drops off FASTER than OpenLDAP's as the number of clients increases. You want INSIGHT - doing systematic tests and publishing the tests so that others can verify the results is how you get it. Not by factless gushing from a fanboy who has never seen the code in question.

In what way is the above post "Informative" ??

All it consists of are subjective claims ("very very fast") with no facts or any points of reference. That is not "information" that is "groundless opinion."

Show us the "Netscape Directoy" server that can handle 200,000 clients, and show us the operation mix, database size, representative data, network topology, and server configurations. *That* would be "Informative."

*THIS* is informative: http://www.symas.com/benchmark.shtml

Those are real facts that anybody can replicate using their own hardware.

What you're spewing is just noise, not information.