Slashback: Snapshots, Amends, Bazaarity

Slashback brings you some follow-ups tonight about Gartner's recommendation to dump IIS, Charles Connell vs. Eric S. Raymond on Open Source project management, xStore and the GPL, and (yes) the results of Deep Space 1's latest Final Mission.

Microsoft is just as secure as the competition, says Microsoft. Jon_E writes: "According to this article Microsoft is responding to the Gartner Report which recommends that enterprises drop IIS by claiming unfair targeting due to their popularity."

Whether because of better-trained or more vigilant administrators, or some other factors, the Apache servers running many web sites certainly haven't seen the devastating outages in the past month (Code Red, Nimda) as certain large IIS installations have.

If animated, this might make a really good Saturday cartoon. cconnell writes "Last September, slashdot published my critique of Eric Raymond's essay The Cathedral and the Bazaar. There was a lively (and sometimes scorching) discussion that followed. Here is Eric's reply to my critique, which Slashdot readers might enjoy. And here is my reply to Eric."

This was not faked in the same studio as the "lunar landings." mrsmalkav writes "Deep Space 1 has passed by Comet Borrelly within 1400 miles and took some very pretty pictures of the comet's core, all while collecting lots of data about said comet. NASA's press release discusses some of the details and findings of the flyby.

This is actually really impressive given that there was very little hope for this mission. From the Mission Logs on DS1's site, '[T]o be honest, DS1's visit with the comet simply is unlikely to work as well as we hope. Many mission logs have described the difficulty of keeping this aged and wounded bird aloft, and the encounter with Borrelly will present Deep Space 1 with the greatest challenge yet in its historic trek through the solar system.'"

Saint Aardvark writes "Space.com has an article about the images taken by DS-1, and they're stunning." And eldurbarn points to the NASA Images of comet Borrelly online at JPL.

How to satisfy customers with license objections, Part II brtb writes: "Soon after Slashdot posted my DiscZerver-GPL writeup last week, xStore added a link in their Download section for information about the use of GPL software in their products. Below is the e-mail I received in response (address changed to protect the spamless). Congratulations to xStore for supporting Free Software and bringing the DiscZervers into compliance with the GPL.

From: "Support" [support@xstoreonline.com]
To: "brtb" [slashdot@brtb.org]
Subject: "RE: GPL SOURCE CODE"

xStore is committed to complying to the full letter and spirit of the GPL. We are currently investigating the allegations of non-GPL compliance and communicating with the GNU.ORG and Free Software Foundation on this issue. We will produce a response to your request that is mutually acceptable to the copyright holders of the programs we have used that fall under the GPL and xStore itself. Due to the recent acquisition of this product, we are still in the process of preparing the required source code for distribution. xStore is commited to bring the DiscZerver product into GPL compliance, if it is indeed found to be not in compliance.

In the meantime, please provide xStore with information so that we can send you, the user of this product, the package that you are entitled to. Please provide the serial number of your DiscZerver product and the 'system page' with your response. The 'system page' is located at [http://your_Zerver_name_or_IP_address/admin-cgi/s ystem]. In addition, please send us a self addressed stamped envelope suitable for mailing a CD-ROM along with $14.95 to:

xStore, Inc.
Federal Highway Center
1200 North Federal Highway
Suite 200
Boca Raton, FL 33432

After we receive your written request along with the above items, we will process it and promptly send you the disc when it becomes available.

This thanks to the mostly behind-the-scenes work of people at the FSF. Congratulations to xStore for respecting the intent of the programmers whose work they're consolidating and packaging.

Comments

Security through Obscurity

[Ghoser777]

Not the best solution, but as the article says, there aren't a lot of virsuses for the mac for this reason. So one thing that can make your servers more secure is to use a more obscure OS and know it really well.

One other note: I thought a majority of web servers run a varient of linux. So because they have the market share, wouldn't hackers attack them more? I just think it's harder to attack something that is open source because so many bugs can can be found by the community and fixed by the community, while bugs for IIS can rarely be fixed by the community.

Plus a lot of people just hate microsoft in general.

F-bacher

Re:Security through Obscurity

[jiheison]

Plus a lot of people just hate microsoft in general.

I think that you have hit the nail on the head here. Microsoft is simply a high profile target, but it is also despised for it's arrogant, "our software is superior and everyone else sucks" attitide. Basically, their arrogance inspires people to try to take them down.

Unfortunately, I see more and more people in this forum with a similar attitude about the superiority of Linux and Open Source in general. I see a day very soon when people will get tired of kicking the M$ security dead horse. The real challenge will be in targeting Open Source alternatives. What hacker wouldn't want to be the first to bring Apache?

Then again, maybe Apache really is invulnerable to significant exploits.

Re:Security through Obscurity

[Anonymous Coward]

Plus a lot of people just hate microsoft in general.

I think that you have hit the nail on the head here. Microsoft is simply a high profile target, but it is also despised for it's arrogant, "our software is superior and everyone else sucks" attitide. Basically, their arrogance inspires people to try to take them down.

s/microsoft/America/
s/software/way of life/

This reminds me of a recent tragic event.

Re:Security through Obscurity

[weinerdog]

I think that you have hit the nail on the head here. Microsoft is simply a high profile target, but it is also despised for it's arrogant, "our software is superior and everyone else sucks" attitide. Basically, their arrogance inspires people to try to take them down.

According to all security reports I have seen, you are far more vulnerable to being cracked or exploited if you run IIS than if you run another random Web server. I believe that the Netcraft numbers imply that your chances of being hit are about double. Whatever the case, the clear implication is this: run IIS and you are significantly more at risk than if you run Apache or any other HTTPD server.

Spin doctors will try to explain why this is the case, but the bottom line is that it doesn't really matter; under typical conditions, you are more at risk running IIS than any other HTTPD server. Microsoft can offer all the explanations they want as to why it's not their fault that running their software puts you at greater risk, but it doesn't change the fact that running their software does just that.

If your case is not typical, IIS may not be the riskiest choice. Maybe IIS really is less secure because, on average, IIS admins are less well-trained than Apache admins or because IIS is harder to configure than is commonly supposed. If this is the case, Microsoft should be upfront about the fact that running IIS on NT is just as hard and requires just as much skill as running Apache on Unix; they can't eat their cake and have it by claiming their software is better because it is easy to administer and then blaming every problem on the lack of properly trained admins.

At any rate, the implication for the average business operation is clear: for whatever reason, non-IIS systems tend to be more secure than IIS systems. That is a significant factor to consider in choosing your kit, regardless of why.

IIS Popularity? Exsqueeze me?

[phliar]

It's not like IIS has the same usage numbers among web servers as MS-Windows has on the desktop...

They're targeted because they're the most vulnerable target. That's all.

Cluley clueless

[sllort]

Sorry, couldn't resist. But seriously:

The attempt to rank vendors according to their security success rate is a risky business. The aim of most virus writers is usually for their worm to achieve its biggest impact, and so will target platforms that are widely used. "Microsoft is targetted as it is so popular, rather than the system being the least secure," said Cluley.

You have to love how they pull the "everyone is jealous so they pick on us" stuff everytime they screw up. Suprise, shitstreak, Microsoft does not make the world's most popular Web server. That's Apache. "Hackers", as you call these jerks, do not target Microsoft because they're the most popular. They target Microsoft because Microsoft has made itself an easy target by making it really easy to hack their products. If popularity made you a target, we'd see scores of Apache worms.

Re:Cluley clueless

[decaying]

I believe Apache runs on the same platform as IIS.

This issue has nothing to do with the platform, it is about the service, ie. web server. IIS and Apache both run on Windows boxes, how many malicious worms have we seen that attack Apache on Windows?

Re:Cluley clueless

[DrSkwid]

from the plan 9 mailing list :

I think you misrepresent the purpose of security. Its role is to
prevent us getting work done. If someone constructs a security
solution that is usable, experts will focus on it like a cat watching
a mouse hole until a fatal flaw is found. This results in three
things: 1) The technology is disabled, making it impossible to work
again. 2) A solution is worked on, distracting people from getting
regular work done. 3) Finally, a new solution is deployed, requiring
people to spend time updating their systems and networks rather than
getting work done. At this point, security has failed because people
are working, so the cat goes back to the hole and in a few days the
mouse emerges and is caught and life returns to normal.

So the rule of security is the following: if you are able to work on
something other than security, your system is insecure.

-rob [Pike]

NASA Funding

[jensend]

Here are NASA engineers, squeezing every last drop of science and knowledge out of projects which had justified themselves and their cost before the end of the Cold War- the possibilities presented by a modern project would now be so exponentially greater, due to increased technology, that it's ludicrous Congress doesn't invest in such more heavily. Perhaps one could add this to the list of things /. could become a million-strong lobby for.

Re:Microsoft's Response

[Anonymous Coward]

Apache is most popular server, by numbers - but many tiny sites are hosted with Apache. Sites that get half a hit per year, and even then it's accidental. Not just tiny sites, of course, just enough to substantially skew the numbers when you consider that not all sites are worth bothering to try and hack.
IIS is most popular, by far, with commercial sites. According to NetCraft anyway.

So kiddies, whatcha gonna hack? Commercial site or photos of mangy dogs.

It's a reasonable argument, but not an acceptable excuse by itself.

Some thoughts on IIS exploits

[os2fan]

Some thing that passes through my mind is that companies that make trucks are not really good at making cars, and vice versa.

MS had its roots in BASIC on small hobby computers. Much of what they have done since is summed up by their home-grown product: GeeWhizz Basic.

The network that they have now is based on IBM OS/2 Lan Server, which they got in code sharing arangements with IBM. I mean, the OS/2 1.3 help file still serves me well under NT4.

Their main contribution has to lay all sorts of flash in fanciful languages, purpose designed to ensure upgrades. Excel, for example, has had three entirely different languages in five years. Most people could not be bothered to learn the new language. A lot less macro writing happens now then in the days of Lotus 123 for DOS. Mind you, it does not stop the script kiddies, who are learning the latest exploits.

Most MS products ship badly configured. Like, who would put a spell checker on a function key (F7), if spell checking is done live anyway. I mean, you either do it live because you have the juice, or you do it from the tools menu because you don't have the resources to run it all the time. Putting it on a function key is silly. Except to bring it up on sales promotions. "Yes, we have spell checker [press F7]".

So their network stuff is full of flashing chrome designed to sell the thing to executives, and the scripts that run this chrome is by this set up, already in a form ready for remote exploits. Yes, you can configure it, if you want to stuff around in the registry and hidden settings. But most people dont have the knowledge or time to do something that should be a default or available choice.

MS is a small system maker that is attempting to do big time: all they do is big time damage.

Relative abundance of server variants...

[throx]

I thought a majority of web servers run a varient of linux

Here's the key to it. The majority of servers run some variant of Linux. Most buffer overflow bugs require a specific offset and known layouts in memory. If you look at the specific versions out there IIS is probably the most common single version of any product out there (can you get this info from Netcraft?)

On the other hand, it could just be stupid admins - check out http://www.netcraft.com/Survey/vuln.gif. I'm sorry, but those numbers make me puke when I think any of those people seriously call themselves admins...

Re:Relative abundance of server variants...

[almeida]

I'm sorry, but those numbers make me puke when I think any of those people seriously call themselves admins...

You miss the point that most of these people don't consider themselves admins due to the simple fact that they don't know IIS is running. The majority of people who hit me with Code Red and Nimda attacks had the default "Under Construction" page. Yes, some people are ridiculously stupid, but some others just trusted that Microsoft would set their computer up for the standard user, not for the standard admin.

Sad analogy, but...

[sheldon]

In quite a number of the responses I've seen there has been discussion about whether IIS is simply more targetted, or really insecure.

Some have discounted the more targetted point of view because Apache is reportedly far more popular. Ok, granted. But now for my sad analogy... Single family homes are far more popular in the United States than skyscrapers, but when terrorists want to make a point, what types of buildings do they attack?

People who write viruses may not be "terrorists" as they aren't trying to kill people. Sometimes they don't even have a point to make, but they most certainly want to cause financial damage, so who better to target?

Re:$14.95

[Wanker]

I'm sure one person who gets the CD will immediately make it available on a website someplace. Then everyone else can get it for free.

After all, that's what "freely redistributable" is all about. Only one poor chum has to eat the media costs. ;-)

Re:$14.95

[muffel]

Actually, the they switched everything over to .99 and .95 with the invention of the cash register, the idea being to force the cashier to open up the cash box to retrieve change, which makes it much harder for them to pocket the cash for themselves without anyone noticing.

Just in case you were being serious -- that is utter bullshit. (The reason is of course psychology: No matter how smart you are and if you know about it or not -- if you casually see 14.95 you think 14, not 15. That's an extra buck for every item sold)

Read the Gartner article again...

[un4given]

Thus, using Internet-exposed IIS Web servers securely has a high cost of ownership. Enterprises using Microsoft's IIS Web server software have to update every IIS server with every Microsoft security patch that comes out ? almost weekly.

This is the biggest problem with maintaining Microsoft networks. Exploits in IIS or Windows are far too frequent, and almost all patches require reboots. You can imagine the response I get when I call management every other week and say "I need emergency downtime to patch 65 of our servers...".

Microsoft loves to talk about how their software has a lower TCO than other operating systems. Perhaps they don't count the cost of man-hours spent applying patches, or the downtime involved?

Re:IIS on NT Workstation

[Anonymous Coward]

You know what, everyone talks about IIS installing by default on Win2k Pro... I've installed many boxes with various versions of Pro, and never have I installed IIS on them, never seen the option for IIS, and I know for a fact that Pro does not come with a web server, indeed, it does not come with _any_ servers. It's just a /. myth, there is no IIS in Windows 2000 Professional. It's a _workstation_ you numbnuts, only Linux workstations come with servers.

Well, I do it with one box.

[Colin Smith]

One mail server - Unix scales.
One web server - Unix scales.
One print server - Unix scales.
One file server - Unix scales.
One Oracle database server - Unix scales.
One middleware hub - Unix scales.

Three DNS servers - On different networks.

And one system to manage them all.

I have no second level admins. For a similar number of users - about 800.

It's just me and "It all just works". You feel free to go on running yourself ragged with crap systems. Eventually you'll get fired or burnt out and someone who knows what they're doing will fix it.

Crossing Platforms

[_Sprocket_]

IIS is attacked because it runs on a platform that is more popular in general.

I think you're taking an easy route by trying to link the two. Lets split the server from the platform.

The windows platform is very popular. Most common desktop by far; sheer numbers makes it a target. Add in that the average user has little IT experience and (either because of design or end user maintenance... or both) that a lot of these machines will be full of holes... great target.

Lets say its not IIS that's under scrutiny but Apache. Very popular. Lots of holes. And a large percentage of the user base tends not to patch holes as they're announced. Great target.

Just because Apache tends to be ran on non-Windows hosts does not mean we can't put them togeather. sadmind did just that. It spread on Solaris systems to attack and deface IIS servers. No reason we can't launch a new Nimda-a-like that propogates amoung windows machines and attackes Apache (on whaterver OS its sitting on) hosts.

But, of course, that's not what is going on. IIS is being attacked because of the virtues of IIS, not because its usually sitting on Windows hosts.

Microsoft IIS

[GreyPoopon]

I can't believe some of the hogwash in Microsoft's response to the Gartner report. Here's my favorite:

The attempt to rank vendors according to their security success rate is a risky business. The aim of most virus writers is usually for their worm to achieve its biggest impact, and so will target platforms that are widely used. "Microsoft is targetted as it is so popular, rather than the system being the least secure," said Cluley.

So, I guess use of Apache must not be too widespread, eh? Now I'm not going to try to make the uneducated claim that Apache is really more secure than IIS, but for some reason there are far fewer security breaches on Apache. Maybe it's because virus writers are more supportive of Apache. Who knows? Unless something has changed in the last year, Apache still has the largest install base out there, and based on Microsoft's reasoning it should have the largest number of exploits.

I read the entire Gartner release, and I thought it was very insightful. They didn't say, "Take down your IIS servers." Instead, they carefully qualified it, suggesting that "...enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS, including moving Web applications to Web server software from other vendors, such as iPlanet and Apache." Note the key word investigate. Also note that they only suggest this for people hit by both viruses.

Microsoft's rebuttal also fails to properly address a serious issue: "cost of ownership." They make the wonderous claim about how fast they release patches to fix these security holes. What they missed entirely was the fact that a company can't be paying for the resources and downtime to apply a patch WEEKLY, not to mention the need for somebody to constantly watch for a security update so that it can be installed before somebody exploits it.

What Microsoft *should* have done (IMHO) is kept their mouths shut and swing some resources into either rewriting IIS or truly removing security holes, and then have a surprise release to counter Gartner's arguments.