Slashdot Mirror
March Netcraft survey
awptic writes "The March Netcraft survey is out.
Among the changes is a 4% increase in the number of websites
running IIS, primarily due, however, to register.com's domain
name parking service switching to mostly IIS servers, which account for over 2 million
of the 38 million sites surveyed.
Ironically, a large number of the websites were defaced shortly
thereafter."
Interesting.
If the parked domains can be hacked and defaced so easily, one has to wonder just how secure the rest of their system is, which is responsible not just for domain name serving, but must handle massive credit card traffic.
lysergically yours
Not just register.com -- NetSol also moved much of its operations from UNIX systems to Windows systems, if you didn't have enough reason to question the sanity of NetSol already...
It's interesting to see the trend occurring in the articles charts. It looks to me as if the trend has Apache leveling out and then dropping recently, and IIS use jumping hugely this year. Even accounting for register.com I see MS catching up strongly.
Does anybody know when Apache 2.0 will come out? It supposedly has great design improvements on Windows as compared to Apache 1.X. A lot of Windows users might give Apache more consideration once it comes out.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Several hundred thousand sites seem to have moved to this [Window based]system this month, and the drop in Netscape-Enterprise is largely a result of this. Ironically, many of the sites were hacked a few days later, Newsbytes reports.
All of the sudden a pictures of lemmings jumping off a cliff materialized in front of me.
Here's what is next:
A website listing the 10 largest companies with Administrator password == NULL
Bleh... I've used Netcraft. It's pretty nice... you can find out what version of different software a webserver is running. Web pages like this though should emphasize how important it is to stay on top of the latest bugfixes... As often as exploits get posted for now outdated versions of software, not keeping things up-to-date is like hanging a "HackMePlease" sign on your back.
I guess that strategy isn't working out so swell.Or maybe it's all just an incredible coincidence. Given the promotional push (read:throwing money at) that Microsoft has given to the idea of their product on the big iron lately this isn't too surprising.
The whole Unix is Bad and Hard for Your Teeny Little Brain to Process strategy is apparently failing too since they're running the website on BSD.
your = it belongs to you. you're = a contraction of you and are. Got it now?
According to the Security Focus article the affected parking servers had been outsourced to Interland. Not really surprising, since Interland has left their servers vulnerable to various vulnerabilities for months at times.
Stupid people!
Every day we hear about how companies choose to implement MS solutions (adds more to the problem, however) rather than better BSD/Linux solutions. "But it's cheaper to employ an MCSE!"... That may be so, but this route should only be taken if you dont care about the company's data.
Fucking braindead corporations; spend the extra 15 thousand / year and protect your freaking data instead of throwing away your secrets. It's going to be cheaper down the road when you have to hire lawyers to start sueing people or lose business because people won't trust your braindead corporation with their credit cards.
Buying a Dell computer is equivalent to dropping the soap in a prison shower.
You know MS/UniSys's new anti-UNIX site www.wehavethewayout.com? Well take a look at what NetCraft reports</a>
- and compare to the results of a<br>
lynx -head http://www.wehavethewayout.com<br>
command. Interesting. Has MS fiddled the server, and NetCraft is pulling some tricks to get the truth, or is NetCraft pulling a "funny" one?
register.com's domain name parking service switching to mostly IIS servers, which account for over 2 million of the 38 million sites surveyed. Ironically, a large number of the websites were defaced shortly thereafter.
Hmm...the SecurityFocus article only mentions Verisign/NetSol and their IIS servers.
What do you expect from a spam-friendly provider? That fact alone means that they are run either by the clueless or the criminal.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
> Ironically, a large number of the websites were defaced shortly thereafter.
Umm... Shouldn't that read, "Expectedly, a large number of websites were defaced shortly thereafter." ?
I am shocked. Shocked!
-- @rjamestaylor on Ello
...when they said "We Have the Way Out!"
-1 Redundant, but isn't it interesting that the new anti-Unix site isn't among that 4% IIS increase (and not hacked).
I wonder, even though it's supposed to be a random survey, should there be allowances given for said parked/cybersquatted domains to not factor as much into the percentages? Or another page listing the compared results.
I mean, most of them would have some sort of template along the lines of "This domain at www.suchandsuch.com is currently Under Construction! / Available for Sale!". Wouldn't be hard to figure out some sort of % similar to another page rating (i.e. diff them and see how many lines are different).
Granted, it does mean you have to download the page (frames and popups would be annoying though) and waste some CPU cycles comparing the differences, but it would be interesting seeing how many websites of said survey are, say, 95% or higher similar to each other.
This data for *active* web servers (about 6 million total) seems to give a different picture---while apache lost 0.16% and IIS gained 0.40%, long-term (over the last year) apache grew, while IIS fell. Also, extrapolated future failure and growth rates seems to indicate that one is better off betting on apache than on IIS.
The story points out that Register.com switched to IIS. And then the idiot who submitted the story points to an article "Hackers Deface Thousands Of Domains Parked At Verisign" (http://online.securityfocus.com/news/357) about domains getting hacked from Verisign, trying to make some connection there. NetSol is now known as Verisign. Register.com is not Verisign. They are two separate companies. Now, lets review:
Register.com switches to IIS
Verisign domains get hacked
Connection? None. So don't post anything that tries to make that connection.
The word you're looking for is `inevitably', as in `Inevitably, a large number of recently-IISed websites were defaced soon after the transition'.
Or possibly a better (at least more accurate) headline would be `Massive webserver defacements entailed by massive webserver HTTP header defacements' (specifically, the `Server' header).
Wouldn't the extra hardware for serving and managing that many IIS sites be a significant and inhibitory cost factor?
Got time? Spend some of it coding or testing
> I seriously don't understand this. Why would ANYONE (and I mean ANYONE) even consider migrating his webservices to IIS? IMHO you must either be blind, deaf and mute or REALLY very incredibly unbelievably stupid!
Lessee... Who makes the decision, a PHB or the sukka who has to keep things running? And who wines and dines the most PHBs, Micorsoft or the Apache developers?
The only surprise is that Apache is being used at all.
Sheesh, evil *and* a jerk. -- Jade
SANS seems to be off-air as at now. Perhaps there is a lesson in that, or perhaps they just moved to IIS?
Easier than reposting it would be understanding it yourself.
Got time? Spend some of it coding or testing
Or were, until somebody noticed that many somebodies noticed.
IMHO, it would be cool to replace their homepage with:
<head><title>I dare you to type deltree
<body bgcolor="#000000">
<form action=./ method=post>
<h1 color="#00ff00">C:\> <input type=text></h1>
</form>
</body></head>
Got time? Spend some of it coding or testing
Ironically, a large number of the websites were defaced shortly thereafter."
Of course, because IIS stands for "It Isn't Secure."
I pledge allegiance to the flag...
of the Corporate States of America...
Lemmings don't actually do that. Perhaps a flock of moths orbiting a bonfire... orbiting... orbiting... spiralling in... `we see the light, and that light is Microsoft'
FWIW, piranha don't get vicious until they're thoroughly starved, and there are several species of vegetarian Piranha.
Got time? Spend some of it coding or testing
Mandrake Linux 8.2 Download Edition has at least 3, plus at least 3 GUI or browser based management tools for Apache. A site that big - and made entirely of lookalike pages - wouldn't use them.
Two or three new CodeReds down the track, more people will understand that doing things without knowing what you're doing is bad. Some already have.
Got time? Spend some of it coding or testing
These april fool stories are so funny!! People running web servers on IIS.. *snort* that's hilarious!
What I really meant was this: pmgdirect.com (the marketing group that is running the campaign) had hosted the wehavethewayout.com site on THEIR OWN HARDWARE and the marketing company's OS of choice wasn't a Microsoft product. Of course, the web site has since then been moved to a box running Microsoft OS (the damage control part) and Netcraft hasn't yet caught up with the change. Netcraft does cache the results, see their FAQ.
Moral of the story: if you're promoting an operating system with the help of a marketing agency, make sure the marketing agency runs the web site in question on the "correct" operating system.
Follow your Euro bills at EBT
They probably wanted to take advantage of .NET or something like that.
"Trouble" is about the only thing you spelt right in that post. "Illeterate?" Yikes...
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
I have heard of several cases (all off the record, obviously) where MS has done just that. Wouldn't you consider switching if you were offered free (or almost free) licenses for all software in the MS catalog?
IMHO we are seeing the first signs of MS fighting back in the back office segment in ernest. This is not going to be pretty...
I nmaped them with the exact same command yesterday, and got a result of FreeBSD. I guess they changed the OS in a real hurry...
Come on, big marketing bucks coming from Redmond is more important than security.
look for yourself
Nice is Japan and Germany
People who actually have to pay for IIS *are* switching to Apache, and only very few new companies start with IIS.
since when does register.com == verisign?
autopr0n is like, down and stuff.
Since the server name is sent as plain text with every page served...
autopr0n is like, down and stuff.
Plumbers of the digital world are still plumbers.
autopr0n is like, down and stuff.
Whoops, you linked to the Japanese stats both times. Here's Germany.
The most interesting, though, is this breakdown that ranks sites in a Google-like manner. Apache and IIS both lose a little to Netscape and "other" (also Apache perhaps?), but I think that's the fairest way to compare market share.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
Not Register.com, Verisign/NetSol. The domains were parked at InterLand.
Granted, I knew all that before I read this article, but hey, the securityfocus article that was linked had all this information, would have been 4 seconds of Journalistic Research.
I'm too ornery in the morning. In any case, really big mass-defacement, really easily accomplished.
I like music
i'm a yank who lives overseas and i get all sorts of abuse regarding irony. irony is an unexpected outcome. defaced iis servers are not unexpected, therefore the word you meant to use was "Coincidentally."
thank you.
US Citizen living abroad? Register to vote!
Someone's concept of the meaning of the word "ironic" is even worse than Alanis Morissette's.
-- If no truths are spoken then no lies can hide --
I know that this is a well known fact among most /. readers, but no one else commented on the lack of M$ II$ servers on the 'Sites with longest running systems by average uptime' page. I think that should have been the lead 'comment' appearing on the front of /. instead of just announcing the survey results. something like 'M$ cant keep it UP!'
Comment removed based on user account deletion
Apache is in all 3 categories at or near the all-time high!
BTW, all sites on securityspace are referred sites, so there are no parked domains in the other statistics either.
Plumbers of the digital world are still plumbers.
I'd be willing to bet that the average plumber makes more money than the average Slashdot reader.
No need to laugh at people for working with shit all day, be they a plumber or an MCSE.
--po' white saint
How is this ironical? Irony something that is contrary to what was expected.
My beliefs do not require that you agree with them.
I meant that Nescape & others do better in the weighted results than in the unweighted results. Certainly Apache dominates the market no matter which way you cut it. Even the SSL market, aparently, which wasn't the case a year or two ago.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
Compared to IIS it dominates even more - in the unweigthed results, Apache runs about twice as many sites, in the weighted results about 3 to 4 times as many sites as IIS.
IIS 5.0 and now IIS 6.0 have a lot of extra support for maintaining and monitoring information from different sites on the same server. While Apache is great for really running different sites, IIS's reporting is apprently more interesting to the search engine spam sites that I've talked to.
Many of them run 5000-10000 domains on 1-2 IIS machines because IIS means they can monitor things with less technical staff. The acknowledge that Apache is better for the serving, but they like IIS's reporting better.
I wouldn't put too much stock in this stuff. I mean, who cares about an Apache/IIS popularity contest, use the server that matters.
Apache also isn't helpped that the 2.0 project went on forever AND most of us are still on 1.3. My understanding is that 2.0 introduces a lot of new features to be competitive with the IIS stuff, but none of us appear interested in learning to use it. I mean, I don't need my web server to do THAT much, PHP processing is more useful for me than Apache directives, so I don't care about more functionality.
Alex
perhaps, but it's actually spelled damnit.
and yes, consequently would also work.
i see no one has noticed the humor in the comment...
US Citizen living abroad? Register to vote!
Uh, no, I mean "spelt," the past tense and past participle of "spell."
Might I that legend find, By fairies spelt in mystic rhymes.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
I'd be interested to see how many of them serve up the default page too - remember how IIS was being installed by default on 2K machines without their users knowing? How many of those hits aren't actually real websites?
Not.
The problem arises because you trust the word of someone who can't add subtotals. All of the unique problems of Unix servers (includes all distributions of Linux and Solaris) taken together are easily outweighed by just one company, a company proven in court to be software pirates, theives, liars, monopolists and other things. It's not their paid word on this topic that you happen to be taking, is it, Coward?
Got time? Spend some of it coding or testing