Slashdot Mirror

This very same hack, of the NXP Mifare Classic, was widely published in the Dutch media about a month ago. Only it was first done by students of the Radbout University of Nijmegen, who set out to prove that the encryption of the new start card system to be used on all of Holland's public transport system, using the Mifare Classic, was insecure. They wildly succeeded: the issue led to lots of debate in parliament and possible postponing of the whole (horrible) idea.

Link in Dutch: http://tweakers.net/nieuws/52381/mifare-chips-eenvoudig-volledig-te-kraken.html

This is not the first USB-stick sold for a high price (typically 10 times the price of a normal USB stick of the same size) that doesn't actually add any security whatsoever.

Here is an article by a dutch website (the article is in english though) that does a thorough job (technical details included) of debunking a similar product.

Meanwhile, the scary thing is that government and military organizations are reported to have been actually using such products...

People like myself who design software requiring a database usually prefer speed over features.

Then the choice is easy. PostgreSQL is faster than MySQL, especially for highly concurrent workloads. PostgreSQL 8.3 increases the performance gap considerably.

PostgreSQL SPEC benchmark
PostgreSQL 8.2 vs MySQL 4.1 and 5.0
PostgreSQL vs MySQL 5.0 pages per second
PostgreSQL 8.2 vs 8.3

I suggest you bone up on PostgreSQL tuning (here's a handy configuration guide) and perform your own comparison.

Anyone else wondering when this "MySQL is faster" myth is finally going to die?

Yeah, if only for those darn inconvenient facts demonstrating that PostgreSQL is faster than MySQL, particularly under load. Note that the benchmark was PostgreSQL 8.2. Now note that 8.3 is up to twice as fast as 8.2. I think the polarity on your order of magnitude performance difference should be reversed.

Of course, if you actually care about data integrity and database features, there's not contest at all. But the performance gap is now non-existent, if not completely reversed.

How can Sun sell enough hardware to justify this purchase? What if they have a platform that (should a major database vendor optimize their implementation for that platform) has a significant advantage over any other platform?

Databases are one of the most common applications that need lots and lots of concurrent threads.

And Sun has a unique platform that provides that support: Niagara Optimizations for MySQL and a list of other cases in Sun's performance contest

...and I think that Solaris users are right.

You cand find several test about the scalability of MySQL vs PostgreSQL in tweakers.net:

http://tweakers.net/reviews/649/9
MySQL vs PostgreSQL / Solaris vs Linux
"In contrast to all MySQL versions that we tried, PostgreSQL scales almost perfectly. With a load of ten simultaneous users, the step from one to two cores yields on average an performance increase of 114%, going to four cores improves things by 96%, and the increase to eight cores adds another 77%. This means that eight cores deliver 7.4 times as much as a single core. Another relief in comparison to MySQL comes in the form of stable performance after the maximum is reached: collapses as we saw in MySQL when the loads exceed the servers capacities do not occur. When we only take the heavy loads at the end of the graph into consideration, the lines appear to flatten out, which means that the scaling behaviour is even better: the gains of the core doublings to 2, 4, and 8 are respectively 122%, 104% and 98%, in other words, the performance between one and eight cores differs on average by a factor of nine."

http://tweakers.net/reviews/657/6
MySQL 4.1 vs MySQL 5.0 vs PostgreSQL 8.2dev / Linux Kernel 2.6.15 vs. 2.6.18
Scaling from 1xcore to 2xdual_core:
* My SQL 4.1: +56%
* My SQL 5.0: +40% (this is NOT an errata, 5.0 scales worse than 4.1)
* PostgreSQL 8.2dev: +224%

...and I think that Solaris users are right.

You cand find several test about the scalability of MySQL vs PostgreSQL in tweakers.net:

http://tweakers.net/reviews/649/9
MySQL vs PostgreSQL / Solaris vs Linux
"In contrast to all MySQL versions that we tried, PostgreSQL scales almost perfectly. With a load of ten simultaneous users, the step from one to two cores yields on average an performance increase of 114%, going to four cores improves things by 96%, and the increase to eight cores adds another 77%. This means that eight cores deliver 7.4 times as much as a single core. Another relief in comparison to MySQL comes in the form of stable performance after the maximum is reached: collapses as we saw in MySQL when the loads exceed the servers capacities do not occur. When we only take the heavy loads at the end of the graph into consideration, the lines appear to flatten out, which means that the scaling behaviour is even better: the gains of the core doublings to 2, 4, and 8 are respectively 122%, 104% and 98%, in other words, the performance between one and eight cores differs on average by a factor of nine."

http://tweakers.net/reviews/657/6
MySQL 4.1 vs MySQL 5.0 vs PostgreSQL 8.2dev / Linux Kernel 2.6.15 vs. 2.6.18
Scaling from 1xcore to 2xdual_core:
* My SQL 4.1: +56%
* My SQL 5.0: +40% (this is NOT an errata, 5.0 scales worse than 4.1)
* PostgreSQL 8.2dev: +224%

Yes, this was discussed in an earlier Slashdot story, " RIAA Argues That MP3s From CDs Are Unauthorized", and in a bunch of other places:

* Boing Boing p2pnet reddit Heise Online (German) Truemors BlogRunner/Digital Rights Hugh Casey IDG (Polish) Geek News Central CE Pro Gizmodo TechDirt Read/Write Web Thomas Hawk's Digital Connection TDPRI WhatReallyHappened.com Slyck Root.cz (Czech) Craigslist Forums Hard OCP Wired.com Uneasy Silence Overclock.net Wake World SpaceBattles.com Hydrogen Audio BrickFilms.com Hockey Zombie iLounge Zune Scene AllmanBrothersBand.com Golem (German) PC Magazin (German) Tweakers (Dutch) Mackauf (German) Wake Space Kino-eye.com Digital Copyright Canada Northwest Progressive Institute Louisville Music News Frant

The Netherlands that I know happily eats from Microsoft's hand, and is positively terrified to leave its safe, well-known, familiar, warm embrace. Choosing the Microsoft solution is always the correct one; choosing something else has to be justified, and the justification can always be buried with the magic phrase "but it is not the standard."

And even if it passes, there will surely be some cop-out clause like "proprietary alternatives are allowed if better suited". And everything will remain as it was. Go read http://www.tweakers.net/ if you don't believe me, those are the people who will largely be in charge of implementing such a directive. And they will fight it tooth and nail.

Image from the second page, second diagram:
http://tweakers.net/ext/i/1190631924.png

Come on people, those are penises. I guess Tweakers.net wanted to give us the full, long, hard scoop on these really big new processors.

My fonts
I only work with Dingbats

Do you happen to work at SCO?

-

...never trust benchmarks given to me by one of the two sides...

That's assuming that the security wasn't developed by a finite number of monkeys, all sharing one typewriter.

The Dutch bank was attacked by the 'man in the browser' type of trojan, which cached the output from the challenge-response between user- and bank. This bank by default performs two challenge-response sequences;
1) when loggin in
2) when confirming a transaction
A third, is performed when transferring large amaounts of money.

Appearently, the trojan told the customer the first attempt had failed, (while in the background preparing a transaction, which could be verified by the bank, because the client was so kind to re-autenticate (this time to the transaction challenge, while they were still thinking it was the login challenge)

Here's the story (in Dutch, hurrah)
http://tweakers.net/nieuws/48895/Virus-ontfutselt- geld-van-klanten-ABN-Amro-update.html

/steven

``or perhaps even a "schuinestreeppunt"?''

Exists, but is actually tweakers.net.

And, IMO, nowhere near as good as Slashdot.

4GB is less than 40 Euro.

My understanding is that running mysql on anything with more than 4 cores shows a performance drop, so i can't see why you'd want to use more...

Yup; it's fairly well known that MySQL doesn't get as much benefit from additional cores (see, for example, MySQL 5 only showing 6%-14% improvement when going from two cores to four, compared to PostgreSQL jumping 77% in the same situation) and has performance drop-offs beyond certain levels though Josh Berkus of PostgreSQL pointed out in response to that test that Postgres will also top out, just at a higher number of cores), so using a machine with fewer cores can actually favor MySQL.

The common wisdom among folks who know what they're talking about seems to be that lower-end hardware and certain use patterns (lots of single-table stuff or simple joins) favor MySQL, while beefier boxes and different use patterns (complex queries where the Postgres cost-based planner can shine) favor PostgreSQL.

Faster?
http://tweakers.net/reviews/657/6

OK maybe it's 2 x faster for TPC style stuff, but it had timeout errors in this benchmark:
http://wskills.blogspot.com/2007/01/postgresql-vs- mysql-benchmark.html

He doesn't mean 'foreign keys actually work', or 'inserting nonsense dates gives an error' or anything of that kind. He means things like:
    - The database doesn't corrupt tables. Ever.
    - If the power fails or the kernel goes away at an arbitrary instant, then when the database starts up again all of the data will be there, with committed transactions entirely present and uncommitted ones entirely gone.

Secondly, it's not justified to just assume that MySQL will be faster even with it's limits on data integrity. It depends on your workload. Consider differences in locking strategy and query plans, for example. There's a benchmark showing scaling behaviour in one particular set of circumstances here: http://tweakers.net/reviews/674/6 ; this shows a fairly striking difference in scaling with load on a specific machine.

http://tweakers.net/search?DB=Reviews&item_catId=1 2&productCatId=&Query=postgresql&x=0&y=0

This link will give you a results page with links to many similar benchmarks of MySQL vs PostgreSQL on their site.
They are very thorough in their tests, are themselves MySQL users, and give insight in which optimizations they used to perform these tests.
A very convincing read.

Apologies for replying to my own posts.

http://tweakers.net/reviews/674/7
This is a more recent test where the scalability of MySQL and PostgreSQL to an 8-way opteron is reviewed.
Again PostgreSQL 8.2 outperformes MySQL 5 by far.
Interesting is that they discovered a small issue in the stable release of postgresql 8.2 which was subsequently patched by the postgresql developers.
It was still much faster and robust then MySQL which degrades terribly under heavy loads.
The version pg 8.2.1 did ship with these patches.
Another interesting subject is that they revealed issues with Solaris, which were investigated by Sun developers, who helped in configuring the Solaris installation.

http://tweakers.net/reviews/649/7 Tweakers is a dutch community of online tweakers that was deciding on new hardware. The above link leads you to some stunning performance graphs that show that not only postgresql 8.2 is faster then MySQL 5.0, it also scales MUCH better on heavy loads! This benchmark was discussed earlier on slashdot to some degree, but I think quite a few of the commenters above have not seen this. The tweakers community are longterm MySQL users and were new to PostgreSQL. However they even brought in a MySQL expert to configure it optimally. Still PostgreSQL turned out to be the better dbms

Instead of low level commands such as SendToStick(), we could see routines such as GetWriteProtectState(), RefreshFileBrowser(), and the most significant one, VerifyPassWord().

Screenshot of debugging windows

Obviously, this routine caught most of our attention. We used the debugger to study it, and found that its result was passed to the main program using an EAX register. The debugger allowed us to place a breakpoint immediately after the call to VerifyPassWord(), upon which we entered a fictional password and changed the return value 0 in the register to 1.

Tell me again why we as Software Engineers are supposed to use descriptive method and variable names? Sure, it may be useful during testing/building/debugging/etc; nobody will argue that. However, if your "secure" product can be easily hacked due to the fact that you use descriptive class/variable/method names, maybe the practice should be reviewed.

Now in this particular case, there were other flaws with the design (all verification happening on the pc?!?) What happened here though is that the hackers were looking for a place to start by looking through a debugger. During that exploration they discovered a gaping security hole. I'm not saying that they wouldn't have found the design flaw to begin with -- I have no doubt that they would have. But maybe we should look to the security through obscurity methodology as an additional layer of protection.

Actually, it's a useful idea. MySQL is only faster than PostgreSQL for "toy" databases (low concurrency, few transactions needed per second), or if you throw away ACID capabilities.

However, a lot of open source projects use non-portable MySQL "SQL", and hence don't work if you try to use PostgreSQL as your back end. A hack like this that actually worked would let you run crappy open source code on a more scalable database back end.

Over here people are buying blancs from Germany as well and of course there have been complaints about it. As far as I know they tried to go after the bigger buyers but that didn't work.
One thing's for sure, the organisation that took possession of blancs sold them to other parties when they should have auctioned them off by law. (seems a court case will follow)

http://tweakers.net/nieuws/45491/?highlight=belast ing (in dutch though)
And then one organisation singlehandedly put a 0 euro levvy on mp3 players. Which didn't last long as the minister of Justice recalled it after other organisations complained that there had been no agreement made on a levvy.

I'm not sure why people clamor to MySQL, and all its problems; when postgres is faster, cheaper, (yes it's cheaper, look at all the database engine within database you have to muck with for mysql, TCO is not measured only in money) and Postgres won't have these "engine" problems that Mysql has.

Yes yes, I know you Mysql toilet paper crowd will stick to Mysql no matter how much it shits on you..

http://tweakers.net/reviews/657/6 -- proof's in the pudding..

I'm a european, and about every european country has their tech blog, for example heise in germany, and tweakers or webwereld in holland. 'Limiting' point is, they're all in the language of the respective country. For the rest they're pretty good, news can be in there faster than it would on slashdot, and they're all moderated, therefore no junk as with digg. So the quality is ok, I just don't have the time to read them all and find the comment moderation system on slashdot the most pleasant and efficient to read.

A more recent review of the quad core xeon: http://tweakers.net/reviews/661
Linux 2.6.18 vs 2.6.15: http://tweakers.net/reviews/657/2

A more recent review of the quad core xeon: http://tweakers.net/reviews/661
Linux 2.6.18 vs 2.6.15: http://tweakers.net/reviews/657/2

According to TFA, 'MySQL does very good job even on the busiest sites,' while for PostgreSQL 'Random disconnects, core dumps and memory leaks are usual.' This flies in the face of my own experience and testing results I have seen.

Agreed; that statement is a big fat lie.

Under heavy load, PostgreSQL has a habit of slowing to a crawl, while MySQL just dies. How many web pages have you seen where the entire text was a PHP error saying it was unable to connect to the MySQL server

As much as I hate MySQL, I can't blame it for this one. I'd say that under heavy load, PostgreSQL keeps on going fine and MySQL slows to a crawl, but both still operate.

PostgreSQL will have the same problem when misconfigured in the same way. It's pretty simple to avoid: add up the maximum sizes of all pools that connect to the database. Make the databases's maximum allowed connections at least that number + however many administrative connections you might open. If it's a huge number, you'll probably want to reduce the pool sizes for performance. (And reduce it a lot further for MySQL than for PostgreSQL, because MySQL does not scale. It does not perform under high concurrency, and additional processors don't help.)

If it's possible you'll be accepting many connections quickly under heavy load, up the listen queue size to that number as well. (Not sure if this is tunable in the config file - I've only heard of this problem in practice on a MS SQL server with something like 20 nodes that synchronized with NTP and started doing database stuff in a crontab. I think they just did listen(fd, 5) so that didn't work out.)

Yep.

Some shortcuts to graphs:

Performance vs. concurrency
Performance vs. CPU count

Apparently MySQL clustering doesn't help so much either.

I can't help thinking that MySQL is popular for much the same reasons that Windows or Visual Basic are popular: simplicity. However, solid scaleable applications require that you to take off the training wheels.

Yep.

Some shortcuts to graphs:

Performance vs. concurrency
Performance vs. CPU count

Apparently MySQL clustering doesn't help so much either.

I can't help thinking that MySQL is popular for much the same reasons that Windows or Visual Basic are popular: simplicity. However, solid scaleable applications require that you to take off the training wheels.

Apparently PostGreSQL enjoys an extra processor!

Of course, the article is mainly a review of a couple of dual Intel Xeon 5160 systems, so I'm unsure what the pretty graphs mean. :-)

Here's a comprehensive performance review between PostgreSQL and MySQL. It compares both DB's under load as well as comparing Intel/AMD chips. http://tweakers.net/reviews/657/6

http://tweakers.net/reviews/657

They compare PostgreSQL 8.2 vs MySQL 4.1.20 and MySQL 5.1.20a.

Or it could just be that this benchmark isn't coded well - it might use a global lock frequently so as you add more threads there's more contention. In any case someone with more time than me should dig into this benchmark which might show a weakness in the core 2 architecture.

Take a look at http://tweakers.net/reviews/661/7 if you want to see how the performance of the Clovertown Core 2 chips scales with a scalable database and many clients.

It's because MySQL runs like dogmeat on FreeBSD, no matter which threading libraries you use.

Well, PostgreSQL launches a process per connection, so I don't see how that could explain the difference. Or are you saying that threading is slower than using processes?

Why are you so sure it's the threading, when he gave no details? If he had consultants coming in, most likely he would have a connection pool if that would have helped. You appear to have latched onto this explanation because MySQL must always be faster, and if it's not, it must be the OS's fault, right?

Maybe he just had a lot of concurrent connections, which is one of many areas where PostgreSQL can show a major improvement over MySQL.

http://tweakers.net/reviews/657/6

There are a bunch more with similar results at tweakers.net. It could also be the PostgreSQL planner, which has had major improvements recently. Or, it could be one of the myriad other amazing things about PostgreSQL (which are often written off as "unecessary features").

Let's have a look at a pole at Tweakers.net, a Dutch news IT website. The question is: "Is your primairy OS legal?"
The answers:
ja, mijn Windows is betaald (yes, I paid for Windows) 45,7% (8896)
Nee, ik gebruik een 'geleende' Windows (No, I have a 'borrowed' copy of Windows) 39,5% (7676)
Ja, ik gebruik een opensource-besturingssysteem (Yes, I'm using an opensource OS) 8,2% (1589)
Ja, mijn Mac is onbespoten (Yes, legal version of Mac OS 4,6% (899)
Nee, ik draai tegenwoordig stiekum OS 'X86' (No, I'm running OS 'X86') 2,0% (386)
Almost 50% of the Dutch geeks run an illegal copy of Windows.

In Belgium, someone has been brought to "justice" for using his neighbour's wlan. The neighbour was a doctor who did not really know anything and had everything wide open. So was his neighbour, using the other, stronger connection automagically, as windows does. This was posted by a user on this dutch website http://tweakers.net/nieuws/44510/Meeliften-op-open -WiFi-verbinding-is-illegaal.html

Note: all computers have been taken by the police and conviction came.

No, Redbus, which is the location tweakers.net is located had a power failure, which made foobar of some part of the database. The servers didn't have any problem with slashdot, as you can see at the statspage :)

check this out,
This site can actually cope with a slashdoting pretty easily,

Nevertheless its pretty cool to look at their stats and see the slashdotting take place:
http://tweakers.net/stats

Scroll down to "reviews" to see the major increase in traffic since a few minutes.

In my tests PostgreSQL is consistently faster than MySQL and scales much better for multiple CPUs (which matters a lot!!!). Also see this indipendant article: http://tweakers.net/reviews/646/10 - you will notice that not only PostgreSQL is faster than MySQL to begin with, but it gets even faster with HypterThreading and so on.

In my professional opinion there are absolutely no reasons to ever choose MySQL over PostgreSQL. The latter is completely free (as opposed to dual licensed), much more powerful, more standard compliant, faster, and better documented.

This article is pretty good, though a few months old now. I bought an Areca ARC-1120 based on this review, and have been very happy with it. 100% GPLed driver. Wish they were a little easier to find in online stores though.

But a 15,000 rpm SCSI drive is probably a bit of a screamer as well. What does it sound like with something like that in your computer? Is it tolerable?

My Fujitsu 15k rpm 36GB U360 drive is actually very quiet and runs pretty cool. When I first bought it, I wondered how noisy it was going to be. When I first switched it on, I thought that I had to wait a little while for it to get the start command or something, because I actually did not hear it wind up. I thought it was going to sound like a little muffled jet turbine, but in fact, I have to have the case open and put my head near the drive to hear it wind up. Same deal for random accessing when I do a "find /. > /dev/null" shortly after booting. Pretty quiet.

Although Fujitsu provide a 5 year warrantee on my drive, they show life expectancy amongst other things in a readme piece of paper which came with the drive. Ranging from 5 to 1 years with increasing temperature. A pretty clear warning to keep your drives cool.

10k and 15k rpm drives usually have much smaller disks and thus smaller head arm assemblies. So I guess in addition to this easing faster rotation and allowing smaller and faster head movement, it also allows for quieter operation. Have you seen how large the arm servo is, compared with the arms themselves in these drives? They are huge. I guess they're moving those small light arms, shorter distances with a much greater force.

Take a look at Seagate 15k, Maxtor 15k and Fujitsu 15k.