Slashdot Mirror
March Netcraft survey
awptic writes "The March Netcraft survey is out.
Among the changes is a 4% increase in the number of websites
running IIS, primarily due, however, to register.com's domain
name parking service switching to mostly IIS servers, which account for over 2 million
of the 38 million sites surveyed.
Ironically, a large number of the websites were defaced shortly
thereafter."
The best line from one of the worst movies ever. Um, Verisign - ever heard of S-E-C-U-R-I-T-Y ?
RonB
It is human nature to take shortcuts in thinking.
Interesting.
If the parked domains can be hacked and defaced so easily, one has to wonder just how secure the rest of their system is, which is responsible not just for domain name serving, but must handle massive credit card traffic.
lysergically yours
Not just register.com -- NetSol also moved much of its operations from UNIX systems to Windows systems, if you didn't have enough reason to question the sanity of NetSol already...
this is after April F00ls day so it must be serious...w0w, does this mean that monkeys now rule the Universe? or at least Verisign?
internet like monkeys'
It's interesting to see the trend occurring in the articles charts. It looks to me as if the trend has Apache leveling out and then dropping recently, and IIS use jumping hugely this year. Even accounting for register.com I see MS catching up strongly.
Does anybody know when Apache 2.0 will come out? It supposedly has great design improvements on Windows as compared to Apache 1.X. A lot of Windows users might give Apache more consideration once it comes out.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Several hundred thousand sites seem to have moved to this [Window based]system this month, and the drop in Netscape-Enterprise is largely a result of this. Ironically, many of the sites were hacked a few days later, Newsbytes reports.
All of the sudden a pictures of lemmings jumping off a cliff materialized in front of me.
We should praise Microsoft because if they didn't have these great operating systems and servers a lot of security professionals and techs would be without work!, nor hundreds of kids busy learning their skills hacking and fixing their parents and relatives computers. it would be dull without them its due to Redmonds foresight in creating numerous security "mistakes" that keeps us with cash in our pockets Praise be to Bill (gates/dollar)
Here's what is next:
A website listing the 10 largest companies with Administrator password == NULL
Bleh... I've used Netcraft. It's pretty nice... you can find out what version of different software a webserver is running. Web pages like this though should emphasize how important it is to stay on top of the latest bugfixes... As often as exploits get posted for now outdated versions of software, not keeping things up-to-date is like hanging a "HackMePlease" sign on your back.
I guess that strategy isn't working out so swell.Or maybe it's all just an incredible coincidence. Given the promotional push (read:throwing money at) that Microsoft has given to the idea of their product on the big iron lately this isn't too surprising.
The whole Unix is Bad and Hard for Your Teeny Little Brain to Process strategy is apparently failing too since they're running the website on BSD.
your = it belongs to you. you're = a contraction of you and are. Got it now?
"You never want a serious crisis to go to waste." - Rahm Emanuel
According to the Security Focus article the affected parking servers had been outsourced to Interland. Not really surprising, since Interland has left their servers vulnerable to various vulnerabilities for months at times.
Stupid people!
Every day we hear about how companies choose to implement MS solutions (adds more to the problem, however) rather than better BSD/Linux solutions. "But it's cheaper to employ an MCSE!"... That may be so, but this route should only be taken if you dont care about the company's data.
Fucking braindead corporations; spend the extra 15 thousand / year and protect your freaking data instead of throwing away your secrets. It's going to be cheaper down the road when you have to hire lawyers to start sueing people or lose business because people won't trust your braindead corporation with their credit cards.
Buying a Dell computer is equivalent to dropping the soap in a prison shower.
With the popularity of IIS servers on the rise maybe it is time that Apache gets a GUI and setup wizard option.
Saying your OS is the best because more people use it is like saying MacDonalds make the best food
You know MS/UniSys's new anti-UNIX site www.wehavethewayout.com? Well take a look at what NetCraft reports</a>
- and compare to the results of a<br>
lynx -head http://www.wehavethewayout.com<br>
command. Interesting. Has MS fiddled the server, and NetCraft is pulling some tricks to get the truth, or is NetCraft pulling a "funny" one?
register.com's domain name parking service switching to mostly IIS servers, which account for over 2 million of the 38 million sites surveyed. Ironically, a large number of the websites were defaced shortly thereafter.
Hmm...the SecurityFocus article only mentions Verisign/NetSol and their IIS servers.
> Ironically, a large number of the websites were defaced shortly thereafter.
Umm... Shouldn't that read, "Expectedly, a large number of websites were defaced shortly thereafter." ?
I seriously don't understand this. Why would ANYONE (and I mean ANYONE) even consider migrating his webservices to IIS? IMHO you must either be blind, deaf and mute or REALLY very incredibly unbelievably stupid!
I'm aware of the flame I am posting here, but be honest: do YOU understand this? I would have thought enough proof had been delivered the past few months (read: years) about the insecurity (and blunt evilness, really) of IIS. For heavens sake, if insecurity is proven over and over and over why make the step TO IIS instead of FROM IIS (to something else, ANYTHING else).
Apache runs under windows if you really must use that OS, Apache isn't THAT hard to set up and most important of all: Apache isn't THAT insecure. Gimme a -zillion for this flame, come on, I know what I know, I know a webserver running IIS belonging to a friend of mine got hacked last week. I know mine got hacked once (before I put on Apache) and I know many, many, MANY more IIS servers will get hacked until admin's turn into roots (or at least surf by www.apache.org).
Do yourself a favor: think twice about IIS...
Ironically, a large number of the websites were defaced shortly thereafter
;)
Been listening to Alanis much lately?
Dictionary.com says this about ironically: "contrary to plan or expectation"
Anybody that works in this industry for two days or more would know that things must have happened exactly as planned, or at least as to be expected.
Microsoft Mod strikes again. What most ./'s don't know is that microsoft has secretly infiltrated ./ with mods that have a microsoft bias. Moderations like this are an easy way to spot them though.
...when they said "We Have the Way Out!"
-1 Redundant, but isn't it interesting that the new anti-Unix site isn't among that 4% IIS increase (and not hacked).
I wonder, even though it's supposed to be a random survey, should there be allowances given for said parked/cybersquatted domains to not factor as much into the percentages? Or another page listing the compared results.
I mean, most of them would have some sort of template along the lines of "This domain at www.suchandsuch.com is currently Under Construction! / Available for Sale!". Wouldn't be hard to figure out some sort of % similar to another page rating (i.e. diff them and see how many lines are different).
Granted, it does mean you have to download the page (frames and popups would be annoying though) and waste some CPU cycles comparing the differences, but it would be interesting seeing how many websites of said survey are, say, 95% or higher similar to each other.
Funny how Microsoft IIS doesn't show up in this part of the article. "While Verisign has the ultimate responsibility to its domain customers, the blame for the security breach falls squarely on Interland, he said." (Article in full) http://online.securityfocus.com/news/357
"The system, which was running Microsoft's Internet Information Server (IIS) on Windows 2000..."
That about sums it up.
However, in conclusion: MWAH HaHaHaHaHaaaaaaaa
You are a moron, you're pre-digested comment rated as interesting denotes the weaknesses of crapdot !
Smile, don't click...
This data for *active* web servers (about 6 million total) seems to give a different picture---while apache lost 0.16% and IIS gained 0.40%, long-term (over the last year) apache grew, while IIS fell. Also, extrapolated future failure and growth rates seems to indicate that one is better off betting on apache than on IIS.
if there are 4% more IIS, it is not because the increasing popularity of kro$oft but because BSD is dying!
Smile, don't click...
If the parked sites are so easy to hack why pay for that domain? Just put your stuff up there. :-)
Do I have to post this again to remind you zealots that *nix is not the ultimate in security?
NetSol insane? Maybe just concerned with security. But don't let hard numbers fool you, just go ahead and believe what Linux zealots tell you.
The story points out that Register.com switched to IIS. And then the idiot who submitted the story points to an article "Hackers Deface Thousands Of Domains Parked At Verisign" (http://online.securityfocus.com/news/357) about domains getting hacked from Verisign, trying to make some connection there. NetSol is now known as Verisign. Register.com is not Verisign. They are two separate companies. Now, lets review:
Register.com switches to IIS
Verisign domains get hacked
Connection? None. So don't post anything that tries to make that connection.
They say "We have the way out!";
just reply: "We have the way in!"!
The word you're looking for is `inevitably', as in `Inevitably, a large number of recently-IISed websites were defaced soon after the transition'.
Or possibly a better (at least more accurate) headline would be `Massive webserver defacements entailed by massive webserver HTTP header defacements' (specifically, the `Server' header).
Wouldn't the extra hardware for serving and managing that many IIS sites be a significant and inhibitory cost factor?
Got time? Spend some of it coding or testing
[anssi@verkko cgi-bin]# nmap -O -p 80-81 www.wehavethewayout.com
Starting nmap V. 2.54BETA22 ( www.insecure.org/nmap/ )
Interesting ports on www.wehavethewayout.com (130.94.214.143):
(The 1 port scanned but not shown below is in state: closed)
Port State Service
80/tcp open http
Remote OS guesses: Windows Me or Windows 2000 RC1 through final release, MS Windows2000 Professional RC1/W2K Advance Server Beta3, Windows Millenium Edition v4.90.3000
Nmap run completed -- 1 IP address (1 host up) scanned in 3 seconds
Follow your Euro bills at EBT
Bei uns in Deutschland heisst das immer noch Scheissdreck!
SANS seems to be off-air as at now. Perhaps there is a lesson in that, or perhaps they just moved to IIS?
Easier than reposting it would be understanding it yourself.
Got time? Spend some of it coding or testing
Blah... Don't you get it, the site used FreeBSD on purpose, "We have a way out" means that they have a way out of Windows. They are still working on the site so that they could put more information on FreeBSD and Apache. It's out fault that we went to the site too early while Microsoft's FrontPage experts are working hard to produce a state of the art website.
kawai
Or were, until somebody noticed that many somebodies noticed.
IMHO, it would be cool to replace their homepage with:
<head><title>I dare you to type deltree
<body bgcolor="#000000">
<form action=./ method=post>
<h1 color="#00ff00">C:\> <input type=text></h1>
</form>
</body></head>
Got time? Spend some of it coding or testing
Ironically, a large number of the websites were defaced shortly thereafter."
Of course, because IIS stands for "It Isn't Secure."
I pledge allegiance to the flag...
of the Corporate States of America...
Lemmings don't actually do that. Perhaps a flock of moths orbiting a bonfire... orbiting... orbiting... spiralling in... `we see the light, and that light is Microsoft'
FWIW, piranha don't get vicious until they're thoroughly starved, and there are several species of vegetarian Piranha.
Got time? Spend some of it coding or testing
what country is the cheatexams.com site in...must not be the US, cuz they use the time unit of "20 minutes hours" 1/2 way down main page. I usually avoid sites with such poor gramer, I suspect they are 1)an illeterate scamer 2)a forign scammer 3)forign busness that has little idea what they are actually selling. any one of those 3 spells trouble.
LinuxWorx
Spelling errors are intentional as are gramatical error
I guess I found the reason for the strange server version information. Have a look at the HTML source for www.wehavethewayout.com and you'll notice that the form contents will be emailed to info@pmgdirect.com. Now, if you look at what www.pmgdirect.com is running you'll notice some similarities to www.wehavethewayout.com's information (note the OS differences, though).
[anssi@karhu anssi]$ lynx -head -dump http://www.pmgdirect.com/
HTTP/1.1 200 OK
Date: Tue, 02 Apr 2002 08:11:54 GMT
Server: Rapidsite/Apa/1.3.20 (Unix) FrontPage/4.0.4.3 mod_ssl/2.8.4 OpenSSL/0.9.6
Last-Modified: Thu, 08 Nov 2001 19:46:57 GMT
ETag: "f003735-144b-3beae131"
Accept-Ranges: bytes
Content-Length: 5195
Connection: close
Content-Type: text/html
Follow your Euro bills at EBT
Surely that should instantly count to heaps of servers.
Mandrake Linux 8.2 Download Edition has at least 3, plus at least 3 GUI or browser based management tools for Apache. A site that big - and made entirely of lookalike pages - wouldn't use them.
Two or three new CodeReds down the track, more people will understand that doing things without knowing what you're doing is bad. Some already have.
Got time? Spend some of it coding or testing
"Ironically, a large number of the websites were defaced..."
Where is the irony in that? They move to Windows, they get hacked. Depending on your point of view that's either bad luck or just plain stupid.
"And the meaning of words; when they cease to function; when will it start worrying you?"
These april fool stories are so funny!! People running web servers on IIS.. *snort* that's hilarious!
Well that's not a CNN story, but rather a trabia.net story. Next time register newscnn.com, cnnweb.com or something for your prank, and wget the graphics!
Guess it went the same way as Mosaic. Another pioneer bites the dust as seems to be the way
in the technology world.
since when does register.com == verisign?
autopr0n is like, down and stuff.
Since the server name is sent as plain text with every page served...
autopr0n is like, down and stuff.
Plumbers of the digital world are still plumbers.
autopr0n is like, down and stuff.
Not Register.com, Verisign/NetSol. The domains were parked at InterLand.
Granted, I knew all that before I read this article, but hey, the securityfocus article that was linked had all this information, would have been 4 seconds of Journalistic Research.
I'm too ornery in the morning. In any case, really big mass-defacement, really easily accomplished.
I like music
i'm a yank who lives overseas and i get all sorts of abuse regarding irony. irony is an unexpected outcome. defaced iis servers are not unexpected, therefore the word you meant to use was "Coincidentally."
thank you.
US Citizen living abroad? Register to vote!
Someone's concept of the meaning of the word "ironic" is even worse than Alanis Morissette's.
-- If no truths are spoken then no lies can hide --
I know that this is a well known fact among most /. readers, but no one else commented on the lack of M$ II$ servers on the 'Sites with longest running systems by average uptime' page. I think that should have been the lead 'comment' appearing on the front of /. instead of just announcing the survey results. something like 'M$ cant keep it UP!'
Comment removed based on user account deletion
Sounds similar to our 2000 mail server running SLMail, but it doesn't get hacked, it just bends over and crashes when it pleases. 1/3 OS problems, and 2/3 SLMail problems. Although it is vonerable, nobody cares to even mess with it. They would have nothing to gain by hacking it. Even if they did, we have a tape backup that can be restored in 15 minutes.
/dev/console that said they were sorry. LOL. Seriously. It had been up over a year. We just turned the services off, and updated Apache.
One guy managed to get into our old 486 running RedHat 6.0. (Before I got there. The boss knows nothing about Linux boxen) They left it immediatly since it din't have any CPU power for what they wanted. They must have had respect for it, because they patched it, and left a note on
--------------------------
Is this a sig?
--------------------------
They do have a section about active sites (explanation). You have to scroll halfway down the main page to see the graph. Apache's share grows to 64.37% while Microsoft's share drops to 26.81%.
t'nera semordnilap
:)
>FWIW, piranha don't get vicious until they're
>thoroughly starved, and there are several species
>of vegetarian Piranha.
See, I *told* you being a vegetarian was a bad idea. Even Piranhas know it makes you taste better . .
hawk
Plumbers of the digital world are still plumbers.
I'd be willing to bet that the average plumber makes more money than the average Slashdot reader.
No need to laugh at people for working with shit all day, be they a plumber or an MCSE.
--po' white saint
How is this ironical? Irony something that is contrary to what was expected.
My beliefs do not require that you agree with them.
www.netcraft.com is not responding to me.
Google gave a cache as recent as March.30, last time I checked. In the past minutes, I:
- checked with my cable ISP -- and they can't reach netcraft, too;
- tried a free alternative ISP, it can't get to netcraft, too.
What's the deal? Does anyone knows what would the explanation for this?
I'm in Brazil. Conectiva Linux 7.0. Tried Opera, Netscape, Dillo, Links... to no avail.
Any ideas?
If they are restrained from giving access outside the US, ok, I'd even find it logical. But I would like to know, at least...
Hmm... maybe they are even prohibited from telling anyone about this. Pretty lame if this is the case.
Thanks. Just curious... not a life or death question.
So if they're off the air, what does that say about all the data they collected? Maybe they did move to IIS, due to security concerns. I know Linux zealots tell you how insecure it is, but it's doing better than all *nixes.
I understand it, *nix is a bigger security threat than MS. Need further explaination?
i hope that they do filter the sites that come from the different registrars. at the same time, when their system detects the default webpage (like apache), it should not be included in the stats.
.ph. the registrar in our country resolves any domains ending in .ph. if it is not registered, it says a message where you can buy it. this can seriously distory stats as i can keep on adding sites using any domain name.
one thing than can disrupt the results is to add any sites that end in
:)
Live your life each day as if it was your last.
Just because some 5 mn lamers have some server to run their homepages (1-2 hits / month) does not make that server superior.
It's the real traffic load distribution between various servers not number of installations is that matters.
What are the those real numbers?
IIS 5.0 and now IIS 6.0 have a lot of extra support for maintaining and monitoring information from different sites on the same server. While Apache is great for really running different sites, IIS's reporting is apprently more interesting to the search engine spam sites that I've talked to.
Many of them run 5000-10000 domains on 1-2 IIS machines because IIS means they can monitor things with less technical staff. The acknowledge that Apache is better for the serving, but they like IIS's reporting better.
I wouldn't put too much stock in this stuff. I mean, who cares about an Apache/IIS popularity contest, use the server that matters.
Apache also isn't helpped that the 2.0 project went on forever AND most of us are still on 1.3. My understanding is that 2.0 introduces a lot of new features to be competitive with the IIS stuff, but none of us appear interested in learning to use it. I mean, I don't need my web server to do THAT much, PHP processing is more useful for me than Apache directives, so I don't care about more functionality.
Alex
"Damnit" should be spelled dammit.
And, instead of "coincidentally", I think "consequently" would have been more appropriate.
Whatever happened to NCSA?
were the sites defaced after the netcraft survey or after the switch to parking them on IIS servers? :)
eudas
Blessed is he who expects the worst, for he shall not be disappointed.
perhaps, but it's actually spelled damnit.
and yes, consequently would also work.
i see no one has noticed the humor in the comment...
US Citizen living abroad? Register to vote!
Hi there, Thanks a lot for informing us about the error. Such things to happen with the greatest of web sites and we are a small company of 30-40 professionals. Best Wishes Melina Marsh http://cheatexams.com
Actually I just don't give a crap about spelling, at least at /. As someone elso pointed out, in reference to my other posts, I care little about my spelling or grammer. Of course most of my posting is done between 11pm and 1am, so that doesn't help. However my website, all written in vi, has zero spelling or grammer errors, and also passes W3cert, unlike redhat.com! Perhaps if my spelling/grammer bothers you that much you should mark me as a Foe. Not sure how that works but I think my posts get hidden from you or something. Although dispite my lack of english perfection I like to think once and a while I come up with a point worth sharing...so take it or leave it.
LinuxWorx
Spelling errors are intentional as are gramatical error
I'd be interested to see how many of them serve up the default page too - remember how IIS was being installed by default on 2K machines without their users knowing? How many of those hits aren't actually real websites?
Not.
The problem arises because you trust the word of someone who can't add subtotals. All of the unique problems of Unix servers (includes all distributions of Linux and Solaris) taken together are easily outweighed by just one company, a company proven in court to be software pirates, theives, liars, monopolists and other things. It's not their paid word on this topic that you happen to be taking, is it, Coward?
Got time? Spend some of it coding or testing