Microsoft/Unisys Unix-bashing Site Runs FreeBSD

Several people sent in variations on this: "Kind of ironic to see that the the site, dubbed WeHaveTheWayOut from Microsoft and Unisys runs on an Apache Web server powered by FreeBSD. This could have made a great April Fools joke, unfortunately for Microsoft, you can verify it by using Netcraft." This is a follow-up to the original story a few days ago. Other readers noted that there's already a WeHaveTheWayIn site up. Wehavethewayout.com was returning Apache headers yesterday; today it's returning "Server: Microsoft-IIS/5.0", so it appears they've dumped FreeBSD in a hurry, or maybe just changed the headers.

Comments

OS switch

[Tom]

they didn't just change the HTTP headers. nmap reporst:

Remote OS guesses: Windows Me or Windows 2000 RC1 through final release, MS Wind
ows2000 Professional RC1/W2K Advance Server Beta3, Windows Millenium Edition v4.
90.3000

it also reports a number of interesting ports as open:

21/tcp open ftp
25/tcp open smtp
80/tcp open http
110/tcp open pop-3
443/tcp open https
1433/tcp open ms-sql-s
2105/tcp open eklogin
3306/tcp open mysql
5900/tcp open vnc

whoever set this up did it in a real hurry. :)

two servers

[azosx]

They are running two servers at two different IPs. Apparently 130.94.214.143 is running their Windows 2000 IIS server and 198.63.57.204 is still running the Apache server on FreeBSD.

Re:two servers

[Saint Nobody]

and the bsd box still hosts the site. (know http? telnet 198.63.57.204 80 and try it.) dns just doesn't point to it anymore. this was really switched in a hurry.

Web server type is not an issue

[totallygeek]

I think that most companies have a situation where a web server is just a front-end displayer to a machine where the real work is being done. We have that here, a Linux box before a IIS system, which has an Oracle system on UNIX behind that. Linux blocks everything not port 443 and filters a few other things, the IIS box displays the web content (forced by a vendor) and the Oracle box does all the work. We are about to purchase a web system that runs on OSX from Apple. Again, not by choice, but rather vendor forcing.

I guess what I am saying is "so what". Microsoft has disclosed the use of Linux for business critical function in their board report a few years ago. We also know that while eBay runs on IIS, the work really is on their database systems, which are on Sun equipment (AFAIK).

Re:It's still unix...

[gslobber]

FYI...

The old site (running BSD) is still up at: http://198.63.57.204/

The new site, running win2k/IIS is at: http://130.94.214.143

Re:Conspiracy.

[RatOmeter]

"... they probably just moved the domain..."

Yup. I said yesterday, their site was hosted by Verio, and their IP address was 198.63.57.204.

Today some people get the IP address as 130.94.214.143, which belongs to Microsoft. At my location, DNS still resolves it to 198.63.57.204.

Try this in your browser for fun:

http://130.94.214.143

and then

http://198.63.57.204

Ain't it neat? Both hosts are up and the name servers haven't all caught up with late yesterday's switchy-changy!

Re:Does Microsoft Care

[deacon]

Well, the Wall Street Journal cared enough to put a summary on page one, column 2, just below the fold.

The full article is on page B2.

A lot more people will see that, and they are your boss, not you.

Re:In other news...

[YetAnotherDave]

HTTP_USER_AGENT='"Mozilla/4.0 (compatible; MSIE 9.01; Windows NT Sucks)"'

I've been sending that header for a long time.
OSS browsers are getting a bit more respect lately, but there are still a lot of sites that only accept browsers with knows USER_AGENTs, so we continue to spoof.

You should know better than to believe stats based on unproven data.

:)

obligatory plug: headers spoofed by JunkBuster

Very, VERY, Unscientific performance test

[dachshund]

all times in ms, behind a firewall, etc. 95min and 95max represent 95th percentile responses.

URL 1: http://130.94.214.143/ (IIS)
connects_completed: 12373, responses_completed: 12373 (41.2433/sec), total_errors: 0
msecs/connect: 87.503 mean, 3082.84 max, 81.047 min, 81.308 95min, 84.234 95max
msecs/response: 87.5983 mean, 3098.43 max, 81.848 min, 82.295 95min, 91.204 95max
URL 2: http://198.63.57.204/ (BSD)
connects_completed: 12322, responses_completed: 12322 (41.0733/sec), total_errors: 0
msecs/connect: 17.4765 mean, 21009.6 max, 9.477 min, 9.75 95min, 12.135 95max
msecs/response: 47.6064 mean, 3013.33 max, 12.329 min, 12.651 95min, 162.082 95max

This is very unscientific, and it's only wrt to the index page on both sites. It'd be interesting to see a detailed side-by-side comparison of the two sites. How often will you get to compare a BSD machine against a Microsoft machine maintained by Microsoft themselves, hosting exactly the same content.

Re:Conspiracy.

[jelle]

And that is confirmed by netcraft (yes netcraft seems slashdotted). The changeover happened just today, the BSD site was known up since March 28. I guess when you want something quickly, FreeBSD with RapidSite/Apache is the way to go. Then later on, when your employer starts pushing, you can always migrate towards the much harder to setup IIS server. hihi. I'm wondering if it has Minda yet.

Re:...maybe not...

[sglane81]

Netcraft gathers their information not just by HTTP headers sent by the web server, but by SNMP as well. I imagine snmp_walk on a bsd box vs a windows box will have some tell-tale responses. So it very well could be header spoofing, but the HTTP headers don't mean anything.

Rapidsite:

[Evro]

http://serverwatch.internet.com/reviews/web-rapids ite.html

RapidSite is not a Web server per se; rather, it is a virtual hosting service that runs on a personalized version of Apache. Because it is an extremely popular alternative to purchasing a dedicated Web server, RapidSite is commonly included in Web server listings for comparison purposes. In fact, RapidSite is the fifth most popular server according to the latest Netcraft Survey. It is also the the largest virtual Web site hosting system in the world with more than 45,000 domain names hosted on nearly 40,000 distinct IP addresses. When deciding which Web server best meets your needs, RapidSite is an option that you'll want to give careful consideration to as well.

When I posted cNet story to the original thread

[Cy Guy]

here I noted that Unisys has many webservers running mostly WinNT, and run a variety of webserver sw on them mostly IIS but also Lotus Domino, and Netscape. And in at least one instance they run Apache on Red Hat Linux.

Also per this chart they also run Apache on two other 'unknown' Unix platforms.

Re:Conspiracy.

[1010011010]

Interesting ports on www.wehavethewayout.com (130.94.214.143):
21/tcp open ftp
25/tcp open smtp
80/tcp open http
110/tcp open pop-3
443/tcp open https
1433/tcp open ms-sql-s
2105/tcp open eklogin
3306/tcp open mysql
5900/tcp open vnc

Remote OS guesses: MS Windows2000 Professional RC1/W2K Advance Server Beta3, Windows Millenium Edition v4.90.3000

Interesting ports on www.wehavethewayout.com (198.63.57.204):

21/tcp open ftp
25/tcp open smtp
80/tcp open http
110/tcp open pop-3
443/tcp open https
554/tcp open rtsp
3306/tcp open mysql

No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=2.54BETA22%P=i386-redhat-lin ux-gnu%D=4/2%T ime=3CA9D035%O=21%C=20)
TSeq(Class=RI%gcd=1%SI=CE B2%IPID=I%TS=U)
TSeq(Class=RI%gcd=1%SI=99E7%IPID= I%TS=U)
TSeq(Class=RI%gcd=1%SI=85D6%TS=U)
T1(Res p=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N )
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y% DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W= 0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Fl ags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL= 148%RID=E%RIPC K=E%UCK=0%ULEN=134%DAT=E)