eWeek: Apache 2.0 Trumps IIS

AK47 writes "eWeek has a very positive review of Apache 2.0, entitled "Apache 2.0 Beats IIS at Its Own Game." They recommend the native Apache version on Windows over IIS for production use, citing superior security with no loss in performance."

Comments

How well can it run ASP?

[autopr0n]

And if it can run ASP, can it run it 'all the way' -- ie could you take any ASP page and run it from apache?

If it can handle ASP, there could be a lot of changeover. If not, then most 'hard core' M$ shops won't change.

Re:How well can it run ASP?

[mdemeny]

You can get a lot to run on Apache using Sun Chili!Soft ASP.

We were able to port all of our web-based reporting code with only 1 line change (including COM objects). However if your ASP is truly hard-core then it might be more difficult.

Re:How well can it run ASP?

[mikerackhabit]

Well, you could ask the folks at Apache::ASP.

From their website:

Apache::ASP provides an Active Server Pages port to the Apache Web Server with Perl scripting only, and enables developing of dynamic web applications with session management and embedded perl code. There are also many powerful extensions, including XML taglibs, XSLT rendering, and new events not originally part of the ASP API!

Sounds pretty good to me. Of course, I don't use much ASP so I don't really know what most 'hard core' m$ shops would need support for to be convinced to switch.

Re:How well can it run ASP?

[tshak]

However if your ASP is truly hard-core then it might be more difficult.

I'm not quite sure what this means, but essentially, if your app uses ASP that does more then the simple "Connect to ADO, grab data, and loop over it", then ChiliSoft is not a good solution for serious apps.

Re:How well can it run ASP?

[tshak]

A) Halcyon's iNET does not (as of yet) run ASP.NET (which is much more important then ASP).

B) They require a seperate runtime that sits ON TOP of your Java Application Server. Double licenses per box (unless you use an Open Source JAS, however, I have yet to find an "enterprise quality" one).

However, it is pretty cool what they've done with the .NET stuff. Talk about a huge undertaking.

Re:How well can it run ASP?

[FattMattP]

Apache::ASP provides an Active Server Pages port to the Apache Web Server with Perl scripting only

Then it's not very useful. Apache::ASP only implements the ASP framework. The majority of ASP scripts written are in VBScript. If Apache::ASP only supports Perl then you're going to have to port all of your legacy VBScript based ASP pages to Perl. You might as well rewrite them in PHP or C at that point.

When people ask if it supports ASP, they usually mean, does it execute ASP pages that contain code in VBScript or Microsoft's JScript.

Re:How well can it run ASP?

[revscat]

Put it this way, if they were using ColdFusion, your HTML guys could have written it themselves, rather than relying on an admin (you) to provide them with a custom tag!

And who provides them with the ColdFusion tags? An administrator! Look you big dork, if you think that runninng a freaking web site without a web administrator is a desirable thing then you have much bigger problems to worry about. Somebody is going to have to install the software. Jesus!

Look man, I'm being serious: ColdFusion is dying. If you are basing your career upon it I would seriously advise you to at least look into learning other technologies. It's proprietary, doesn't scale well, and is only supported by a single vendor. And Macromedia's energies seem to be increasing steadily over to JRun. I have been involved with over a dozen web applications from design to launch utilizing several different technologies, of which ColdFusion was a part. Very few people in the industry like ColdFusion or even take it seriously, and they have good reasons for that. Trust me.

Re:How well can it run ASP?

[crisco]

When people ask if it supports ASP, they usually mean, does it execute ASP pages that contain code in VBScript or Microsoft's JScript.

Don't you go to COM controls when you hit the bounds of ASP performance or when you need a feature and don't have the time to write it in VBScript and nobody has open-sourced something? I don't think it matters what languages the Apache ASP modules support, you're almost going to have to re-do a serious web application from scratch when you change platforms.

Yeah but..

[PopeAlien]

Yeah but, unless you hire an 'expensive expert' you can't write off the investment in apache. Thats the problem with free software.

heh. nevermind.

Re:Yeah but..

[irony nazi]

From the article...

Because of the magnitude of some of these changes, eWEEK Labs recommends that any site planning a move to Apache 2.0 first set up a system on which it can test all its Web applications and specific setups to make sure they work well on the new server.

Come on! It doesn't take an 'expensive expert' to know that *whenever* you upgrade a runtime server, you first set up a sandbox where you can test it... or does it? Did they even need to mention this in the article? Maybe they thought that some MSCE would instantly bring down a corporate website and attempt to install Apache, only to find that it doesn't run ASP.

Re:Yeah but..

[rodgerd]

So, when one of Microsoft's fine products is riddled with security holes, apologists blame the systems admins for not being competent.

When deriding superior, free alternatives, they claim any baboon can administer Microsoft products.

I'm failing to see the value proposition in a range of products which allow idiots to render a business vulnerable to serious damage.

Ok, but what about linux?

[awptic]

It's nice to see apache beating IIS on windows, but how does IIS compare to apache 2.0 running on linux? I can't find anything with a recent kernel, preferably post-2.4.10. Even an apache on windows vs apache on linux benchmark would be nice.

Every time

[SkulkCU]

"unfriendly administration interface"
looks to be the only negative thing they could say about it.

In fact, it seems to be the only bad thing I ever hear these days about most open source programs.
What the hell is going on? Do we need to hire some UI consultants from Microsoft or something?

Applefans: I'm kidding

Re:Every time

[shogun]

"unfriendly administration interface"
looks to be the only negative thing they could say about it.

In fact, it seems to be the only bad thing I ever hear these days about most open source programs.
What the hell is going on? Do we need to hire some UI consultants from Microsoft or something?

I would have to say quite the opposite about trying to admin an IIS machine, you want to change a simple setting? Expect to spend half an hour navigating menus till you find the setting hidden in some illogical unexpected location. Meanwhile to change the setting on almost any open source software package, just grep the config file(s) and you'll find where the option you want is within a couple of seconds.

Re:Every time

[flacco]

I don't have cute buttons and whirly-gigs on my administration interface

That's because you're an "expensive expert", donchaknow.

Christ, let's just give them GUI tools for config files and be done with it. It would ease the transition for a lot of IIS "admins" who would like to take a step up in life but have an inertia/familiarity problem. Settings that have a list of valid options to select from, a "help" button next to each item to help them grok the stuff that IIS has been hidig from them...

Point being, don't let your superiority complex get in the way of an effective conversion effort.

Re:Every time

[the eric conspiracy]

It's only unfriendly to a person that cannot grok the advantages of text file based configuration, such as being able to copy the file to a source repository, grep it for keywords, parse it using a regular expression, etc. etc.

In reality a text file configuration is worth a million GUI config tools.

Re:Every time

[ahde]

I always got lost in httpd.conf till I piped it through grep -v ^#

So Lets See

[Peridriga]

The Upside

• Free
• Runs On
• Windows
• BeOS
• OS/2
• *Nix

No Performance Difference Interchangeable Modules

Downside

• "All configuration and administration is done by editing .conf files

HOLY DAMN... Edit A FILE!!!!

Re:So Lets See

[JordanH]

Not only that, but you can trade:

• Free

For:

• "All configuration and administration is done by editing .conf files

If you buy the product your Apache from Covalent. They offer all kinds of Enterprise services to support Apache, too, so there goes the one about Apache not having a support organization behind it like IIS.

Re:So Lets See

[TaoJones]

Mmm, so editing a well documented text file is hard, while drilling down through a badly documented menu system (which reinstalls Visual Basic Scripting in the background without asking) is easy...

I'll take hard for $200 Alex...

Just awful

[rocjoe71]

...What a bad article. Starting off by claiming Apache 2 outperforms IIS in their very own tests, yet making not one iota of these alleged "tests" available. Really an artivle like this does a dis-service to Apache and Linux, smacking of evangelism.

Eh?

[MisterBlister]

What a crappy 'comparison'. I'm no IIS fan (an understatement), but IIS's 'game' is ease of installation and administration....The headline claims that Apache 'beats IIS at its own game' and then goes on to say how Apache is harder to configure (though better than older versions) but that's ok because many experts believe GUI-based configurations are bad for security?

Also, they don't even bother to publish any real results, all they say is "Apache kept pace with IIS during the entire test"..WTF does that mean in reality? Were they using dynamic pages or static? What were the software and hardware configs like? Numbers please?

If this article were the other way around harping IIS over Apache 2.0, most Slashdotters would (rightly in that case too) be ripping it to shreds for being a flimsy piece of shit..Hopefully we can all see it for the garbage it is, even if in the end it supports our (well the majority of us, anyway) favorite web server.

Re:Eh?

[jchawk]

apt-get install apache

Then some minor and I mean minor configuration and you have a webserver that is more robust and secure then IIS.

You need php support?

apt-get install php4

Follow installation script.

Man that's hard!

:-)

Maybe I'm just spoiled because I use debian.

Re:Eh?

[Sabalon]

C:\Program Files\Apache> apt-get install apache
'apt-get' is not recognized as an internal or external command,
operable program or batch file.

C:\Program Files\Apache> apt-get install php4
'apt-get' is not recognized as an internal or external command,
operable program or batch file.


So I now have apache with php support? :)

It really is a shame that tools like that don't just work on Winders. Then again

apt-get install secureMSwebserver

would probably crash the OS.

Apache is consistently underrated by the media

[graveyhead]

I've always found it frustrating that the superior products produced by the Apache foundation are so sorely underrated by the mainstream media. Buzzwords like "BroadVision" and "WebSphere" are pounded into the heads of middle management by way of large advertising budgets. The truth is, however, that I can do anything a BroadVision developer can do *with no software cost whatsoever*

Cocoon is a brilliant publishing system which combines many of the Apache projects: Xalan for XSLT transformations of all kinds, FOP for building dynamic PDFs (don't pay Adobe but use their format anyway :-) from XSL:FO, Batik for building dynamic SVGs, and a ton of library code that makes building dynamic websites very easy.

Not to mention, Apache has provided us with solid implementations of *many* w3c and Java specifications, including SOAP for XML based RPC, and JServ and Tomcat Java servlet engines.

My point is only this: appreciate The Apache Foundation because they totally rock!

IIS6

[banky]

I have read a number of things about IIS6: mostly that it is a from-scratch rewrite, with a particular eye on security. Also you can assume it'll perform pretty well.

So, as much as I would like to see the world dump IIS in general, a lot of shops out there will probably just wait and move to IIS6 when .NET Server (or whatever it's called this week) comes out.

They know how much is riding on this release. If IIS6 isn't tight, fast, and secure, then people will start jumping ship.

Re:IIS6

[the eric conspiracy]

mostly that it is a from-scratch rewrite, with a particular eye on security

It will be interesting to see how this "from scratch rewrite" holds up security-wise. History has taught us that it usually takes a long time for a new code base to get the security holes wrung out.

Re:IIS6

[banky]

IIS has always performed well, and Microsoft knows that benchmarks sell licenses.

In fact, I used to have arguments that went like this all the time:
IIS User: IIS is faster and easier to use!
Me: Apache is more stable, more secure by default, and easier to extend.
IU: But I can handle 20 bazillion hits a nanosecond, your site can't scale.
Me: Whatever.
IU: Ha, I bet you can barely saturate a T1! etc

Microsoft is obsessed with performance because performance benchmarks give "tangible" proof of goodness. They are not obsessed with security, because features are more important. Or were; who knows what it's like there now.

better title....

[bje2]

should've been Apache 2.0 scalps IIS...

Answering one's own questions is lame.

[SkulkCU]

Despite a general disdain for replying to my own post, here's a nifty little list of Why Free Software Usability Tends to Suck that I just noticed. In my experience, numbers 2 and 5, at least, are true.

Disclaimer: I've found the Apache interface on Windows to be far less irritating than IIS.

.conf files

[lothix]

Dealing with .conf files instead of a GUI interface is an _advantage_ not a disadvantage. If we really needed a GUI frontend for making changes to a conf file there would be a bunch of them floating around. It takes no time to slap one together. In fact, IBM HTTP Server which is a "cutified" apache comes with a web form interface for configuring .conf files. Of course I've never seen anyone use it because it is quicker and easier to edit a text file than dig around in interface panels.

PHP 4.X support.

[shri]

One of these days PHP will support Apache 2.0 and then we can revisit these benchmarks. Until then I'll write this off as a Zdnet troll for Slashdot attention.

This article is just reverse-FUD...

[coupland]

I'm a big fan of Apache too, but this article is a piece of crap. They assert Apache 2.0 is as fast as IIS 5.0 on Windows but offer no benchmarks. They acknowledge that IIS had 10 security alerts this past week but offer no equivalent stat for Apache. (A thousand? Zero?) They don't even acknowledge that moving from IIS to Apache is a potentially career-ending chore. I love good reviews of OSS as much as the rest but this was more of a videobit than an actual article...

Re:This article is just reverse-FUD...

[coupland]

For example, if this article had been about the superiority of IIS the /. crowd would have had a great hairy fit over the lack of objectivity. Similar critical thought should be given to articles praising OSS...

Managers not Admins

[BurritoWarrior]

Yeah, the article is weak and has no details whatsover, but the average management schmo has little to no knowledge about how a product works anyway. They read mags like eWeek and base their decisions on just these kinds of articles.

So drop a copy on his desk with a little note about "same performance, better security." See how nice that sounds. :-D

Hard to Configure

[cgreuter]

I think it says something about the state of IT when they consider it
a downside that Apache doesn't have a point-and-click web-based
configuration tool.

The only advantage of such interfaces is that they're friendly to
novices, which is all well and good when you're dealing with a word
processor or e-mail client, but this is a web server. Anyone
who uses one for anything other than a toy needs to be (or to hire) a
skilled professional just to keep the thing running and up to date.
Anyone who finds editing a text file intimidating has no business
administrating any kind of server.

Heck--I wouldn't hire a web administrator who couldn't write
their own point-and-click configuration tool.

Watch the slashdot effect in action!

[awptic]

http://www.apache.org/server-status

Re:Have we all forgotten

[1010011010]

Yeah, we forgot, because all their ads were about speed. All the benchmarks they paid for/trotted out were about speed. Apache was about "doing it right, no fast" ... now that IIS isn't as fast, IIS is about "services?"

You got it backwards...

[alexhmit01]

I figure this is a joke, but far too many slashdot posters seem to think they understand accounting.

When you purchase software licenses, you are making a capital purchase, that will take at least 3 (and often 5) to depreciate. So the cash all flows out at once, but you have to write it out over 3 years.

Money spent on consultants look great on the balancesheet because they are expenses (and therefore written off immediately), plus they are considered one-time costs for public companies, and don't count as operating expenses. By creating permenant one-time costs (each one one-time of course), they are able to make their financials look better than they are.

With free software, your costs may be the same, but they are billed as consulting fees or maintenance agreements. All of those costs are easily considered either one-time costs or as regular costs. There are no capital expenses that need to be depreciated.

Alex

The only problem

[billcopc]

Apache is eons ahead of IIS in terms of usability and reliability, but the big fat problem is that IIS natively runs VBScript/ASP, while Apache does not (and Chilisoft doesn't always cut the mustard). Lots of companies are somewhat locked-in to IIS because of their existing VBScript code which they're not willing to port to PHP or Perl, either because of ignorance or lack of resources (time, money, brains). If we could somehow create a 99.9% functional VBScript parser for Apache, then Apache could swallow up a very large bunch of IIS users in one quick bite.

Re:free ASP support would switch small shops

[StoneTear]

The IIS patches aren't on liveupdate, you have to go get them

.conf Files

[loconet]

One question that popped up in my mind while reading the article is: why doesn't the apache team use .xml files for the configuration files like almost every other server these days? ie: weblogic,tomcat,etc..

Not only do I find editing xml easier than .conf 's, but also to keep the mainstream masses happy... I'm sure it'll be easier for us oss developers to come up with nice gui interfaces to manage the server by reading xml files rather than parsing the .conf files.

Are you high??

[nobodyman]

Funny, I've also worked with both, and have come to the opposite conclusion.
PHP is cryptic and slow. Just check out the stats on the shootout pages. PHP routinely gets stomped in the tests by perl, Java, Ruby and Python. Seeing as how you can write an ASP in perl, vbScript, or ECMAScript, I dare say an ASP solution would win as well.

It integrates seemlessly with MySQL, compared to ASP-MSSQL/Access where I had to define a dsn connection with several lines of code

Several? Try two.

set myConnection = server.createobject("adodb.connection")
myConnect ion.open "dsn_name"

There are reports taht PHP runs faster than ASP, but I haven't ran my own tests.

Sorry. ASP is a framework, PHP is a language. I seriously doubt that PHP has that much of an edge over vbscript, but if I decide to write an ASP with C#, your PHP script is *doomed*.

The good folks at www.php.net give a full documentation of the language, as well as a tutorial. Try finding that on M$ website
Gee, okay. Try the microsoft scripting page. Wow, full docs and tutorials.

If you are going to migrate over to the non-microsoft side of web development, go with Ruby or Python. They are faster and more robust than PHP (and VBScript, for that matter), and are far easier on the eyes (call me crazy, I like my variables names to resemble actual words... whats wrong with you php/perl people?).

Re:PHP 4.X support. (OT: Support is there)

[yem]

I'm running Apache 2.0.35 and php 4.3.0-dev (CVS checkout from last night) right now. Flawless install. I've setup apache from source many many times and Apache 2.0.x leaves 1.3.x for dead. Very Cool.

http://home.y3m.net/ if you want to bang on it.

Re:free ASP support would switch small shops

[Pope Slackman]

We are small and busy and don't necessarily have 100% to give to keeping up with patches and MS Critical Updates

Hey, what's your IP?

C-X C-S

Re:free ASP support would switch small shops

[DavidJA]

The IIS patches aren't on liveupdate, you have to go get them

That is BULLSHIT you have no idea about what you are talking about, and it appears the moderators have no idea either.

The last 10 patches (from MS02-18 to MS02-006) have ALL appeared on Windows Update at the same time or before the Microsoft security update is e-mailed.

No benchmarks?

[cpeterso]

Did you read the entire article? There was a link near the end that said "Click here for the test results" and it pointed directly to some nice graphs.