Slashdot Mirror


Netcraft Web Server Stats Challenged

kolchak writes "An article in The Age has an interesting analysis of the Netcraft Web Server Usage Reports. According to Port80 Software, Netcraft's surveys are biased towards domain name parkers and very small web sites, not taking into account how popular a site may be - there's some interesting results in the competing Port80 survey." However, it should be pointed out that Port80 "develops software products to enhance the security, performance and user experience of Microsoft's Internet Information Services (IIS) Web server."

95 of 461 comments (clear)

  1. Hmm by Anonymous Coward · · Score: 2, Interesting
    Well, since they are so closely tied to microsoft, looks like they have a BIT of a bias...

    Do we even need to think about this? How is this news?

    1. Re:Hmm by Jeremiah+Cornelius · · Score: 2, Funny
      Don't matter what they say...
      The site is Slashdotted (tm).

      Good job Port80!

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    2. Re:Hmm by Znork · · Score: 2, Funny

      "Well, since they are so closely tied to microsoft, looks like they have a BIT of a bias..."

      Well, of course they're claiming that Netcraft is biased as they survey all webservers they can find. Port 80's idea of an 'unbiased' survey appears to be more in the line of '100% of all IIS sites run IIS which proves IIS is the most commonly used webserver'.

  2. A bit more than the average MS bias by SeanTobin · · Score: 5, Informative

    This is wrong on soooooo many levels. I could understand trying to twist the truth by redefining what a webserver is... but thier sampling method is straight out wrong.

    Want proof? Here it is. Go to the linked article, (or click here) and where they have the box to check your server header (about half way down the page) type in www.microsoft.com - you will see its running IIS/6. A nice happy IIS server.

    Now, type in my web server - http://www.isthatdamngood.com - its a nice Linux/Apache server. My server will CRASH thier app! Actually, a lot of linux servers will crash it...

    Kinda hard to claim your results are more indicitative of the market when your scanning technology is flat out broken.

    --
    Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
    1. Re:A bit more than the average MS bias by servoled · · Score: 2, Interesting

      What does this have to do with their sampling method? I seriously doubt that their scanning system is some guy randonly typing websites into that box and writing down the results. The back end code which actually performs the server detection could work just fine and still produce and error during display.

      --
      "I have a porkchop, you have a porkchop. I have a veal, you have a veal".
    2. Re:A bit more than the average MS bias by the_2nd_coming · · Score: 4, Insightful

      umm, how can you claim that they are sampling correctly when your only evidence of the way they sample is by way of an app that crashs on linux/apache servers?

      --



      I am the Alpha and the Omega-3
    3. Re:A bit more than the average MS bias by ejaw5 · · Score: 4, Informative

      Check out the ad below the detection test:

      Note:
      No matter what the above results show, this company may be running Microsoft IIS and protecting its Web server identity with ServerMask.

      Try ServerMask FREE for 30 days. Download Now!
      Buy ServerMask for only $49.95 today!

      --

      $cat /dev/random > Sig
    4. Re:A bit more than the average MS bias by SkArcher · · Score: 4, Funny

      So.... If you are running MS IIS your best security measure is to pretend to be running Apache?

      Errrrr.... Just run Apache?

      --

      An infinite number of monkeys will eventually come up with the complete works of /.
    5. Re:A bit more than the average MS bias by _xeno_ · · Score: 5, Informative
      Worked for me. I tried "slashdot.org" and "www.theregister.co.uk" - both of them worked just fine. However, "www.isthatdamngood.com" did indeed cause a scripting error - but I doubt it would effect their actual surveying, it's just an ASP error, not an actual "crash."

      Anyway, it's long been known that Netcraft's methods are flawed, since it counts individual web servers multiple times for each virtual domain. It should only count unique sites. (For example, Slashdot counts for something like 13 sites - the individual sections (like apple.slashdot.org - I'm not listing all of them), slashdot.org, www.slashdot.org, images.slashdot.org.)

      It's still debatable what the correct survey method is (and whether Port80's method is any better), but Netcraft is biased towards sites with lots of virtual domain names. (I'd imagine SourceForge gets counted many times, too...) Of course, it's also questionable if individual servers in a round-robin load-balancing solution should be counted, so counting by IP instead of domain name is questionable too.

      As is often said, "there are lies, damned lies, and statistics" - any counting method has issues.

      Blah, I can't preview because Mozilla is f***ing broken and won't display the preview page, so please pardon any typos.

      --
      You are in a maze of twisty little relative jumps, all alike.
    6. Re:A bit more than the average MS bias by damiam · · Score: 5, Insightful

      If it wasn't so sad that people can charge $50 for what in Apache is a one-line config change, it'd be pretty funny.

      --
      It's hard to be religious when certain people are never incinerated by bolts of lightning.
    7. Re:A bit more than the average MS bias by orthogonal · · Score: 5, Funny

      So.... If you are running MS IIS your best security measure is to pretend to be running Apache?

      No. It's to wave your hands and intone "These are not the servers you're looking for."

      It requires the Obi Wan Server Mask, however.

    8. Re:A bit more than the average MS bias by servoled · · Score: 2, Informative

      I never claimed that their sampling method was correct. I only claimed that there is insufficient evidence to say that it is incorrect, especially when the evidence presented tells absolutely nothing about the sampling method in question (ie, which sites they chose to sample, how many times they sample the sites, what weighting they give to each site, etc...).

      From the evidence at hand all you can say is that they aren't the best ASP/SQL programmers which is completely unrelated to the sampling of websites from a statistical point of view.

      Please take the time to carefully read a post before responding.

      --
      "I have a porkchop, you have a porkchop. I have a veal, you have a veal".
    9. Re:A bit more than the average MS bias by efti · · Score: 3, Insightful

      Yes, security through obscurity does work ;-)

      ...Unless of course if you're dealing with a completely clueless (or just plain sneaky) kiddie who throws every single exploit he has (regardless the server) at your box. That's when security through obscurity stops working

      --
      I signed up for a /. account and all I got was this crappy sig
    10. Re:A bit more than the average MS bias by the_2nd_coming · · Score: 2, Insightful

      can you take a company seriously if tehy cannot do some simple ASP/SQL code?

      please, I am all for schepticism, but you are using it to help prop up your world view, which is not what being a scheptic is about, being a scheptic is about being open minded until you get all the information, while this is not all the information, there is a thing called proffecionalism. if you can not present yourself in a proffecional mannor then you do not deserve the luxury of being thought of as credible. look at an interview as an example. if you act rude, you will not get he job even if you are a really nice person who is very well educated in the field you are trying to join. 1st impression is everything.

      --



      I am the Alpha and the Omega-3
    11. Re:A bit more than the average MS bias by KozmoStevnNaut · · Score: 3, Funny

      Of course, for intranets, you would probably want an Obi LAN Server Mask ;)

      --
      Eat the rich.
    12. Re:A bit more than the average MS bias by Sevn · · Score: 2, Insightful

      ok so like,

      You are attempting to defend an undefendable position based on the credibility of an obviously biased company attempting to manipulate reality to render their desired outcome yet you feel the need to rail against someone because of some spelling errors? I tend to give someone that does not speak english as their first language measure of respect especially when they destroy a pathetic point I'm trying to make with better english and a better thought out argument than mine even if there are a few misspellings. You need to drift slightly farther away from zealot to be taken seriously.

      --
      For every annoying gentoo user, are three even more annoying anti-gentoo crybabies. Take Yosh from #Gimp for example.
    13. Re:A bit more than the average MS bias by Frymaster · · Score: 4, Insightful
      on security through obsecurity:

      while it is not a substitute for a good security policy, it is an excellent augmentation. the old saying goes that the only secure computer is one that isn't connected to the network. well, that's not really possible if yr running a web server, but you definitely don't need to advertise that you're connected... or how you're connected.

      let's use a military analogy (ugh). you may put your soldiers in an armoured transport... but they still wear camoflauge.

      i mean, after all, we all turn off ping before we put our servers up... don't we?

    14. Re:A bit more than the average MS bias by SethJohnson · · Score: 2, Insightful


      Not to mention the plethora of *.asp pages on a site sort of gives the platform away...
    15. Re:A bit more than the average MS bias by boneshintai · · Score: 5, Interesting

      i mean, after all, we all turn off ping before we put our servers up... don't we?

      No, as a matter of fact I don't turn off ECHO responses on boxes I manage. I prefer to be able to tell if an operating system or tcp/ip stack has fallen over without having to go over and hook up a console. I'm actually rather annoyed at certain ISPs for continuing to block ping even after Welchia and Slammer have mostly abated.

      Which is not to say you can't turn off pings on your boxes, but neither your preference nor mine is everyone's preference.

    16. Re:A bit more than the average MS bias by Maestro4k · · Score: 2, Interesting
      • So.... If you are running MS IIS your best security measure is to pretend to be running Apache?
      Nah, that's just so you can have the false security of thinking hackers won't break in because they're fooled by the server mask. Like any and all of the worms that attack IIS will bother checking first. Of course if you're running IIS, you should be pretty used to new worms reaming your server a new one every month by now.
    17. Re:A bit more than the average MS bias by panaceaa · · Score: 5, Informative

      The parent poster's point is that their site grabber program can get IIS sites but crashes on some Apache sites. Port80 Software may use the same code to run their surveys since both the grabber and survey programs need the core feature of analyzing a site's HTTP headers.

      So if their survey script also returns invalid data for Apache sites, then the IIS numbers would be much higher than they actually are. I would at least like to see some actual numbers rather than pure percents before I believed their data. They surveyed 1000 sites -- how many sites are included in the survey's data?

      Another thing that seems odd to me is Netscape iPlanet usage is higher than Apache. Where's the primary data to support that?

    18. Re:A bit more than the average MS bias by tkittel · · Score: 2, Informative

      > Kinda hard to claim your results are more indicitative
      > of the market when your scanning technology is flat out broken.

      Worse than broken.

      I just checked www.fys.ku.dk and www.nbi.dk which are running on some old unix. But Port80 happily claims Microsoft-IIS/5.0. (Netcraft sees them correctly).

      Now that is just plain cheating!

    19. Re:A bit more than the average MS bias by timeOday · · Score: 5, Insightful

      A script kiddie might still attack you because he's just a brute forcer. Anybody with brains won't trust your server's self-identification... so who are we fooling here?

    20. Re:A bit more than the average MS bias by gnu-generation-one · · Score: 3, Insightful

      The parent poster's point is that their site grabber program can get IIS sites but crashes on some Apache sites

      More to the point, if they understand HTTP so badly that they can't even get server headers and parse them correctly, do you really want to trust such a company with HTTP-rewriting, compression, caching, and wildcard-DNS services that's their main product?

      Seems to me that those sort of programs require a good deal of knowledge to get working correctly. Maybe a few levels above what you need to implement a webserver or DNS server. It seems odd that someone with so much knowledge would make any errors in handling the internet protocols...

    21. Re:A bit more than the average MS bias by Chris-Port80 · · Score: 2, Informative

      Thanks for catching a bug in Port80's real-time header check tool. We will look into the tool's SQL error on the URL www.isthatdamngood.com.

      That's not too damn good...

      Our online tools are not perfect, but they do work for most Apache sites. For instance, here is another version of the tool and a report for apache.org:

      http://www.port80software.com/products/httpzip/com presscheck?url=www.apache.org

      The actual Web server survey (www.port80software.com/surveys/top1000webservers) is conducted by another offline tool developed in Python by Port80's folks. Our published results have been verified independently on this thread today for the Fortune 1000 sites -- in terms of the current and ongoing Web server market share among the main corporate sites of Fortune 1000 companies.

      Here's the methodology we followed (http://www.port80software.com/surveys/top1000webs ervers/methodology), and the results from our November survey can be accessed online in our archive reports:

      http://www.port80software.com/surveys/top1000webse rvers/#checkacompanyout

      Happy Turkey Day,

      Chris @ Port80

    22. Re:A bit more than the average MS bias by Frymaster · · Score: 2, Insightful
      The problem with obscurity is not that it doesn't do anything

      by this logic, you should post your email address all over the web and rely completely on your spam filter.

      the bottom line is this: hiding your server decreases the number of scans and attempted xploits on your box. since secruity can never be 100%, a reduction in attacks translates to a reduction in breaches. basic math.

    23. Re:A bit more than the average MS bias by Chas · · Score: 2, Interesting
      Yes, security through obscurity does work ;-)

      ...Unless of course if you're dealing with a completely clueless (or just plain sneaky) kiddie who throws every single exploit he has (regardless the server) at your box. That's when security through obscurity stops working

      So...all the time, in other words....
      --


      Chas - The one, the only.
      THANK GOD!!!
  3. So suprising by linux_warp · · Score: 4, Insightful

    From thier Partners page:

    "Port80 Software's Strategic Partners:
    Microsoft, Inc."

    Strategic in what way? FUD?

  4. I tried homepage.apple.com by fidget42 · · Score: 5, Interesting

    and this was their response:

    We detect that homepage.mac.com is running Apache/1.3.27 (Darwin).

    but with this caveat

    Note:
    No matter what the above results show, this company may be running Microsoft IIS and protecting its Web server identity with ServerMask.

    Nope, no bias there.

    --
    The dogcow says "Moof!"
    1. Re:I tried homepage.apple.com by Marillion · · Score: 2, Interesting

      Curious: ServerMask is a port80 product. A product whose big selling point is to confuse script kiddies into thinking you've got a platform that you don't.

      --
      This is a boring sig
    2. Re:I tried homepage.apple.com by Tuqui · · Score: 2, Insightful

      To Sell this type of software is just admiting that Apache is more Secure than IIS.
      You will never protect yourself faking a weaker server program because it will only increase your cracking trafic!!.

  5. And the winner is.... by nizo · · Score: 2, Interesting

    Thus spake the article:
    Port80 Software, a San Diego-based company that develops software to enhance the security, performance and user experience of Microsoft's Internet Information Services Web server, said it had conducted a survey of Fortune1000 companies recently and found that Microsoft IIS had ongoing dominance in the enterprise with a 53.8 percent market share.
    ...snip snip...
    "What do Netcraft's findings prove about Web server market share? It all depends on how you choose to define 'market share'," Lima said. "Netcraft attempts to review every detectable site on the Internet to generate their web server statistics, and this gives their survey a natural bias in favour of web servers that host relatively low-traffic or even parked domains.
    ...snip snip..
    Considering that port80 has a serious bias towards IIS, any conclusions they draw should be taken with a mountain-sized grain of salt. I guess it boils down to what you think "mark share" is: what is everyone running, or what servers are the fortune 1000 companies running? The answer seems pretty obvious to me.

  6. This makes sense.. by User+956 · · Score: 3, Insightful

    Ok, so the Microsoft connection makes it easy to write the whole thing off as astroturfing, but they have a point.

    Parked domain names usually aren't separate websites; they're usually hundreds, or thousands of domains pointing to the same server/service that's trying to sell them for profit. In addition, Netcraft counts www.yahooo.com and www.yahoo.com as separate sites-- Even though they both go to Yahoo.

    In this manner, Netcraft's method *is* unfair, because there's no weight as to the location to which the domains point.

    --
    The theory of relativity doesn't work right in Arkansas.
    1. Re:This makes sense.. by An+Anonymous+Hero · · Score: 2, Informative
      Netcraft's method *is* unfair, because there's no weight as to the location to which the domains point.

      What's the alternative, counting by IP? It could be interesting, but not necessarily more representative. I'm on a shared host with dozens of other domains: by choosing that host, we 'cast votes' for Apache, didn't we?

    2. Re:This makes sense.. by Eivind · · Score: 4, Informative
      Except if you'd bothered to check you would notice that Netcraft is fully aware of this, and thus produce different numbers for "web-servers" and "active web-servers" the latter excludes domains which are only parked somewhere.

      http://news.netcraft.com/archives/2003/11/03/novem ber_2003_web_server_survey.html Is the latest survey, apache has 67.41 of all domains (well, all that Netcraft knows about anyways) at 30298060 domains.

      If you look only at "active" domains, apache has 68.60%, so actually even a *higher* market-share. Of a total of 14370515 active domains. (so according to Netcraft, about half of all registered domains are "active" and the other half are "parked"

  7. Interesting results from header check tool by Alystair · · Score: 2, Funny

    If you do a header check on a site you get this notice at the bottom:
    "No matter what the above results show, this company may be running Microsoft IIS and protecting its Web server identity with ServerMask."

    ServerMask must be the paperbag for ugly IIS servers or corporations who don't want to admit they run IIS

  8. LOL by javiercero · · Score: 5, Interesting

    It is not only funny that according to their "survey" IIS has more market share than Apache, but *gasp* Netscape has a larger market share than Apache too!

    That is as big of a red flag as I have ever seen.

    Of course the fact that they indeed produce softs for IIS is in no way shape or form any sort of indication to a possible, slight, minimal... bias.

    LOL, a nice laugh... and they may even get slashdotted, which will bring joy to their sorry operation since they will now be able to claim that they are now one of the nets most popular companies/sites. I am sure this is some sort of ploy to get traffic, it will be funny to see if indeed their beloved IIS can stand the slashdot effect. LOL

    1. Re:LOL by mvpll · · Score: 3, Interesting

      Nope, that snippet is to do with nmap.

      Try this:
      telnet 66.45.42.237 21
      Trying 66.45.42.237...
      Connected to 66.45.42.237.
      Escape character is '^]'.
      220-Hello Port80Software.
      220 WFTPD 3.1 service (by Texas Imperial Software) ready for new user
      QUIT
      221-Goodbye Port80Software!
      221 Windows FTP Server (WFTPD, by Texas Imperial Software) says goodbye
      Connection closed by foreign host

      I guess they need to release a new product, FTPMask ;)

  9. Not so inaccurate .. by jcam2 · · Score: 4, Interesting

    Even if these Port80 guys are on Microsoft's payroll, the point they make is still quite correct - it make no sense to measure market share by simply counting web hosts. If all the high-traffic web sites on the Internet are running IIS while the numerically greater but less popular remainder are running Apache, can you meaningfully say that Apache has a higher 'market share'?

    Unfortunately, short of tracking people's surfing habits or getting access to web server logs, there is no easy way of working out the popularity of a site. Netcraft's method of polling every known webserver is really the only practical method available, if it is not truly accurate.

    1. Re:Not so inaccurate .. by Prof.+Pi · · Score: 5, Interesting
      it make no sense to measure market share by simply counting web hosts. If all the high-traffic web sites on the Internet are running IIS while the numerically greater but less popular remainder are running Apache, can you meaningfully say that Apache has a higher 'market share'?

      Didn't Netcraft themselves cover this topic last year? IIRC, some pro-MS group made the same argument, that you should only count the big guys. They looked at the Fortune N (I forget what N was) and found that lo and behold, IIS came out on top.

      Then Netcraft came back with another study, where they ranked companies not by their Fortune ranking (i.e., total revenue), which would tend to favor MS as that's the "safe" choice for big companies. Instead, they ranked companies by how much revenue they made on the Net (so companies like Amazon would rank much higher), and found that by that measure, Apache was again on top.

  10. I think this says it all by sjbe · · Score: 3, Insightful

    "A developer of tools for Microsoft's web server software..."

    Come on. I expect them to pull for their team but let's get real. They are not a neutral party and it is in their interest for people to believe that IIS is more common, whether or not that is actually the case. I don't exactly blame them for trying to spin the "facts" in their favor but following the money does hurt their credibility in this matter.

  11. Re:They might have a point... by iCEBaLM · · Score: 3, Insightful

    One box running multiple sites should not be less valued than multiple boxes running one site each for this simple reason:

    Linux can do it better than Windows and therefore more Linux boxes are going to run multiple sites!

  12. Top 1000 companies... by khym · · Score: 2, Insightful

    So why should a criteria of "large companies" be better than "all websites"? Large companies aren't going to select a better web server just because they're large, and the coroprate culture of large companies can be it's own sort. If you're going to limit yourself to certain types of companies, shouldn't the limit themselves to, say, the 1000 largest dot-coms? Look at companies that couldn't exist without their website. I rather doubt there'll be much IIS among them...

    --
    Give a man a fire, and he'll be warm for a day, but set him on fire, and he'll be warm for the rest of his life.
    1. Re:Top 1000 companies... by Waffle+Iron · · Score: 3, Funny
      I've surveyed the web for actual content using similar criteria, giving proportional weight the Fortune 1000. I've been able to conclude that:
      • Most websites on the Internet have an annoying Flash intro.
      • Most websites on the Internet make you select your country of origin before letting you see the main page.
      • Most of the images on the World Wide Web are of small groups of people in business attire with earnest expressions focusing attention on some common problem.
      • All websites have an Investor Relations page.
      • A significant number of websites will use the Javascript features of your browser to lock you out of their site on the premise that your browser does not support Javascript.

      If you have a website and you're not doing these things, then you're not using current best practices. I suggest that everybody upgrade to these universal web standards as soon as they can.

  13. To the slow poke here... by rgelb1 · · Score: 3, Insightful

    ...this story is a plant to sell their ServerMask software.

  14. Astroturf, anyone? by darnok · · Score: 2, Insightful

    You know, I wouldn't mind reading this "research" if only the companies involved were forced by some law to declare where their funding's coming from.

    "Yep, we've just proven that Linux is the number one desktop in the world today. This statement brought to you by Novell/SuSE" would sit just fine with me; I could file the statement accordingly.

    As things currently stand,
    - I get to treat all such "research" as crap, regardless of whether it is or not.
    - I get to continually challenge corporate decisions that are made on the basis of such research. "XYZ Research Inc says XYZ is the best product, and they also say they're in no way related to XYZ Inc. It must be true because it's in this magazine"

    I know exactly where it all started, and I'm gonna whack those guys from the "Ponds Institute" if I ever find out who they are...

  15. It's just plain wrong. by Mustang+Matt · · Score: 3, Funny

    I put in my apache/linux server and it said it was running IIS 5.0

    --
    The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
    1. Re:It's just plain wrong. by LostCluster · · Score: 3, Insightful

      Not quite. See, if you're saying your running IIS but actually not, you're immune to all IIS-exclusive hacks. They simply aren't gonna work against Apache... so you give the illusion you're Superman when they fire bullets at you. Of course, you're still at risk to kryptonite should an Apache expolit be released... but hackers looking for Apache servers to hit will think you're an IIS server and hopefully not bother with you.

      It's security by misdirection... a cousin to security by obscurity. Not a complete security solution, but it does help a bit in convincing hackers looking for an easy target that you're not one, so move on to the next victim.

    2. Re:It's just plain wrong. by polyp2000 · · Score: 2, Informative

      Why would anybody do that?

      I had a mate that needed to do exactly that. He was running an apache webserver, and as such he was unable to get tech support. His way round this was to have Apache look like IIS by getting it to serve IIS headers.

      nick

      --
      Electronic Music Made Using Linux http://soundcloud.com/polyp
  16. Corporate Web Servers by ryanw · · Score: 4, Insightful

    You have to look at their survey. It's talking about the CORPORATE web servers. I work for a major corporate america company. We have close to 4000 servers handling our "web" environment. That consists of web, app, and database servers. There's more IIS then anything else out there for sure in corporate america. Expecially on the WEB front end. In a corporate environment there are about 20 Windows to 1 Unix boxes. Mostly due to Windows servers being so cheap and can't handle as much load per server. But on the DATABASE backend there is much more UNIX to Windows.

    Another thing is Corporate America is barely getting their feet wet with Linux/Apache. The UNIX boxes that are installed are not running Apache, they're running something from a major vendor (ie. Netscape, etc). Up until this year there was NO linux in the corporate company I work for. If a MAJOR vendor will not support a product, corporate america will not install it. They love to point the finger at the vendors. If there's nobody to point a finger at when something goes wrong, it will not get installed.

    Until Redhat started selling Linux for $5k corporate america wouldn't even bat an eye at it. Now they're eating it up like hot cakes cause it's EXPENSIVE! Linux is no longer a free thing. Now powerful execs can point fingers and plus be able to throw around the "L" buzz word and feel like they're pushing the envelope.

    1. Re:Corporate Web Servers by Sevn · · Score: 3, Informative

      As a career admin who has worked for 15 fortune 100 company as either an employee or a consultant in the past decade, and currently as the project lead replacing an aging proprietary UNIX solution for a telecom spanning an ENTIRE STATE you are on crack. To dot the I's and cross the T's I hired FIVE independant firms to do cost benefit analysis on proprietary versus open source even though I already knew the answer. The long and the short of it is, over a 5 year period for our particular needs the BEST case scenerio for cost with the cheapest possible proprietary solution factoring in maintenance, upfront costs, and scale was 10 million dollars. The highest price for an open source solution was 4.3 million and that was because it was a hybrid solution that was about 50 percent proprietary and not purely open source. The solution I went with was 90 percent debian based (since redhat is doing it's thing, and SuSe is uncertain because of the merger) and 10 percent Solaris/Oracle and will cost an estimated 2.3 million. And for the record I freaking HATE debian but it makes the most sense for this particular situation.

      --
      For every annoying gentoo user, are three even more annoying anti-gentoo crybabies. Take Yosh from #Gimp for example.
    2. Re:Corporate Web Servers by Maestro4k · · Score: 2, Interesting
      • Another thing is Corporate America is barely getting their feet wet with Linux/Apache. The UNIX boxes that are installed are not running Apache, they're running something from a major vendor (ie. Netscape, etc). Up until this year there was NO linux in the corporate company I work for. If a MAJOR vendor will not support a product, corporate america will not install it. They love to point the finger at the vendors. If there's nobody to point a finger at when something goes wrong, it will not get installed.
      While I understand Corporate America's dislike of Linux so far (like you said, no one to point fingers at when something messes up), and can extend that to Apache (same thing), I don't understand why Corporate America would still use IIS after all the worms and worms after worms after security holes ad infintum. Netscape's out there as a commercial product for Windows servers as well as UNIX/Linux, and I know there are other ones as well, just not that I'm familiar with. I'd think they're tired of pointing fingers at the MS vendors over worm attacks, and would want something, ANYTHING, besides IIS nowadays.

      Or are the bigwigs in Corporate America so out of touch with reality they don't realize that moving from IIS would probably save them tons of money just in manhours saved from less patching/recovering?

  17. Something smells... by pridefinger · · Score: 5, Interesting

    I tried several sites myself with my own javascript and guess what?

    My results were were different than their's more than half the time! I figured they had multiple servers running, etc., so I rechecked at least 5 times on all sites (all sites checked, that is ~50)...NO CHANGE!

    Take disney.com, for example. Their site says IIS 5.0. I got netscape...so did netcraft.

    One word... BULL#%&*!

    -Pride

    1. Re:Something smells... by a.koepke · · Score: 5, Interesting
      I just checked this too... Port80 displays MS IIS and Netcraft displays Netscape. I thought I would do my own check. This now shows a flaw in both checks, Netcraft and Port80.

      andreas:/var/mail# telnet disney.com 80
      Trying 198.187.189.55...
      Connected to disney.com.
      Escape character is '^]'.
      HEAD / HTTP/1.0

      HTTP/1.1 302 Moved Temporarily
      Server: Netscape-Enterprise/3.6 SP3
      Date: Thu, 27 Nov 2003 06:44:12 GMT
      Location: http://disney.go.com/
      Content-length: 0
      Content-type: text/html
      Connection: close

      Connection closed by foreign host.
      andreas:/var/mail# telnet disney.go.com 80
      Trying 198.187.189.93...
      Connected to disney.go.com.
      Escape character is '^]'.
      HEAD / HTTP/1.0

      HTTP/1.0 200 OK
      Server: Microsoft-IIS/5.0
      P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
      Set-Cookie: SWID=E4481904-1BC1-4D6B-A21F-5FB993D69628; path=/; expires=Thu, 27-Nov-2023 06:44:39 GMT; domain=.go.com;
      Cache-Expires: Thu, 27 Nov 2003 06:47:13 GMT
      Cache-Control: max-age=300
      Date: Thu, 27 Nov 2003 06:44:39 GMT
      Content-Type: text/html
      Accept-Ranges: bytes
      Last-Modified: Thu, 27 Nov 2003 06:42:13 GMT
      ETag: "ba9b4197b1b4c31:b10"
      Content-Length: 6260
      Vary: Accept-Encoding, User-Agent
      Via: 1.1 redline-7 (Redline Networks Accelerator 2.2.8 0)

      Connection closed by foreign host.


      Interesting, Disney.com is a Netscape webserver which just does a 302 Moved header and sends the client to Disney.go.com which is an IIS box.

      So the actual Disney site you end up with (Disney.go.com) is IIS so in that case Port80 are sort of right in reporting it as so. But Netcraft are also right in reporting Netscape for the Disney.com domain since that is what Disney.com is running, Disney.go.com is a seperate domain and would be counted seperately.
      --


      (\(\
      (^.^)
      (")")
      *This is the cute bunny virus, please copy this into your sig so it can spread
  18. Servermask didn't see that coming! by morcheeba · · Score: 4, Interesting

    Port80 Survey header check
    Microsoft OLE DB Provider for ODBC Drivers error '80040e57'
    [Microsoft][ODBC SQL Server Driver][SQL Server]String or binary data would be truncated. /surveys/top1000webservers/headercheck.asp, line 121


    A suggestion for their servermask product: COVER UP ERRORS THAT GIVE AWAY INFORMATION. Seriously, if they think that headers are going to give away a lot of info, then forced errors will, too. But, there is boatload of other techniques (including passive techniques) that get around their security-throught-obscurity program.

  19. A website's a website by andih8u · · Score: 4, Insightful

    It doesn't matter if the domain is parked or serving thousands of pages...domains are just as easily parked on IIS as on Apache.

    --


    slashdot, news for crazed liberal socialist zealots
  20. Where's Google? by RT+Alec · · Score: 4, Funny

    I could not help but notice that Google, Yahoo, and Slashdot are omitted from their "top 1000" list. Yet rumors persist that these three web sites get a fair amount of traffic.

    1. Re:Where's Google? by ChaosDiscord · · Score: 4, Informative
      I could not help but notice that Google, Yahoo, and Slashdot are omitted from their "top 1000" list.

      The "top 1,000" list is based on the Fortune 1,000. Google, Yahoo, and Slashdot aren't on the Fortune 1,000. The theory is that the Fortune 1,000 indicates Real Companies, and that this is what Real Companies chose. However, many of these Real Companies are holding companies or target highly specialized audiences (like people needing drilling supplies). Many of these Real Companies are actually running what we would consider toy web sites: almost no content, entirely static pages, very few pages, and almost no visitors. So while this may represent what Real Companies chose, it does not necessarily represent what people with Real Work chose.

    2. Re:Where's Google? by jrumney · · Score: 2, Informative
      The "top 1,000" list is based on the Fortune 1,000.

      No, it's not. Look at the examples they gave of "Top 1000" sites that switched to IIS in the last month: CDW (CDWC, Nasdaq-100), Martin Marietta Materials (MLM, not part of any index), Warnaco (WRNC, not part of any index)

  21. Like that's going to work by BigRedFish · · Score: 5, Informative

    a product .... to confuse script kiddies

    I am running Apache on Linux, and I still get 1000 hits a day trying to crack MSADC with buffer overflows, and FrontPage exploit attempts. It's not like the script kiddies check the server ID or pay any attention to it even if they do.

    1. Re:Like that's going to work by caluml · · Score: 2, Interesting

      Set up some fake scripts like /default.ida, which append the IP address of the attacker to a file ( /var/log/denylist )?
      Then just run an iptables on that file every minute, blocking all in it.

  22. Ok, so use the survey's at securityspace.com by Anonymous Coward · · Score: 2, Informative

    The surveys at securityspace.com attempt to weight webserver popularity by site popularity.

  23. A good methodology by cgenman · · Score: 4, Informative

    If you are conducting a survey to find out what is the "best of the best" in server software, why survey Family Dollar Store? Or Land 'O Lakes? You should be choosing technically savvy, solution neutral companies are likely to choose the best. These are the actual companies that have a big web presence and you would not expect them to choose a platform which would affect their bottom line badly... As opposed to Sears Roebuck, whose online presence can be compared to Amazon's retail presence. Would we ask Amazon how to organize endcaps? Let's pick a few technically adept companies at random here...

    Amazon - Apache
    AT&T - Netscape
    Bell South - Apache
    Cisco - Unix
    Dell - IIS5
    Earthlink - Netscape
    E-Bay - IIS4
    HP - Apache
    Intel - IIS6
    Lucent - Netscape
    Motorola - Apache
    National Semiconductor - Netscape
    Nextel - Netscape
    Qualcomm - Netscape
    PC Connection - IIS5

    I can't survey any more companies, because Port80's IIS6 server is slashdotted. However, if is apparent from this data that nearly 1/3rd of all websites that count are hosted on Netscape platforms. Apache and IIS share 1/4th each, and Cisco's odd unix variant wrapps up the rest.

    Personally I'm amazed that Netscape is holding on to a lead... I would have expected them to be out of the running long ago. I'll have to check them out.

    1. Re:A good methodology by servoled · · Score: 3, Interesting

      This is too small of a sample to produce meaningful results. Also some of these companies may be running a certain platform based on business deals made way back in the day and are reluctant to make the investment needed to completely replace their infrastructure (which may explain the strong presence of netscape, who knows).

      There are really too many factors involved to simply choose a number of websites and determine which is the best server software based upon what the majority of those sites are running.

      --
      "I have a porkchop, you have a porkchop. I have a veal, you have a veal".
  24. Cheap and flashy graphics by ChaosDiscord · · Score: 5, Insightful

    I'll ignore for the moment the question of the quality of their data. I'm sure others will endlessly debate it (and I'll probably join in). Let's look at something else: The quality of their presentation.

    First, let's take a look at the most recent Netcraft server survey. Let's see, clean display. The scale grid is subtle and doesn't draw attention to itself, but makes it easy to see exactly where a line falls. There is little wasted pixel data. It's easy to see trends and make comparisons. For the curious the exact numbers for the last two samples is listed (regrettably one two samples are listed). The graph labels the data it shows ("Market Share for Top Servers Across All Domains August 1995 - November 2003") leaving the reader to form his own opinions. On the down side, the scale confusingly marks 7% increments and the yellow line for Netscape/SunOne almost disappears into the background. Still, a well above average for graph. Definately room to improve, but better than most people expect to see.

    Now let's example the Port80 server survey. Wow, what a difference. The grid is a much more dominant element. The 3d effect means that bars further in the back appear taller (by up to 15 pixels, or about 7%) and makes it hard to compare a specific data point against the scale. The complexity of the 3d bars complicates things, the "top" of the bar is actually larger than the month to month shift in the numbers. The "area" of the bars implies size (intellectually you know it isn't, but your gut says otherwise), this means that the largely obscured middle bars (Netscape and Apache) seem smaller. Ultimately bars are the wrong choice, we're examining points over time (suggesting a line chart), not clusters of data. The chart is labeled with a conclusion ("Microsoft IIS Maintains Dominance Of the Corporate Web Server Market"), suggesting interpretations to the reader. On the up side, they provide heavily broken up information for the most recent sample point (regrettably it's a graphic). They include a worthless pie chart. If you want to show market share a line chart showing historical data would be much more enlightening.

    Conclusion? Port80's graphs suck. Hard. It's a stunning example of how not to create high quality graphs. The creators need to be beaten with copies of Tufte's information display books until they get it. This is the sort of amateur crap I expect on PowerPoint slides from people more interested in being cool than being useful, or perhaps from the graphics department at USA Today. As an engineer I'm disappointed.

  25. All year, except for half of it. by Froggy · · Score: 3, Insightful

    Anyone else notice that the spokesman for Port80 claims that they have been running the survey all year "except for a period between February and June"? That means they've been running for about eleven months, except for the five months when they weren't running...

    I don't think they have much in the way of credibility, even without their transparent bias. They seem to have a creative way with arithmetic.

    --
    It is a woman's prerogative to change other people's minds.
  26. we have arived. by hsidhu · · Score: 3, Funny

    Microsoft OLE DB Provider for ODBC Drivers error '80040e31'

    [Microsoft][ODBC SQL Server Driver]Timeout expired

    /includes/Referer.asp, line 7

    we live in an era where you can market shades to a blind man, and thats what these folks are doing. leave them alone to make innovative products like ServerMask.

    1. Re:we have arived. by hendersj · · Score: 2

      I guess we know how well their products work under load, don't we?

      --
      Insanity is a gradual process; don't rush it.
  27. Absolutely Nothing by servoled · · Score: 4, Interesting
    What does that say about the quality of the respective servers?
    It says absolutely nothing because you are not factoring in the amount of traffic handled by each machine, the connection speed, processing power, RAM, speed of I/O communications between the processing system and network interfaces, hard drive latency for retrieving data, etc...

    You can't make an accurate comparison unless you can remove all the other factors which directly affect how the server will perform.
    --
    "I have a porkchop, you have a porkchop. I have a veal, you have a veal".
  28. ./ effect by ryanw · · Score: 4, Funny

    Port80Software has been slashdotted. As of 23:41 MTN Standardtime Nov 26th, 2003.. their box is completely down.

    Wonder what they're running ...

  29. Wow by Micah · · Score: 2, Funny

    Their wonderful IIS sure didn't stand up well to a Slashdotting.

    Remind me again why I don't switch from Apache?

  30. Re:Lies, damned lies and statistics by saden1 · · Score: 2, Funny

    * 70% of statistical survey are sponsored by corporations.
    * 89% of statistical survey are lies to serve a purpose.
    * People lie 65% the time.
    * 63% of people lie for financial gains.
    * Microsoft is 10% evil.
    * I lie 16.66% of the time.

    --

    -----
    One is born into aristocracy, but mediocrity can only be achieved through hard work.
  31. Conflict of interest. by Shanep · · Score: 2, Insightful

    "Netcraft is biased"

    "develops software products to enhance the security, performance and user experience of Microsoft's Internet Information Services (IIS) Web server."

    Entities who could be accused of having a conflict of interest, ought not bother at all with statements like these. It will only end up making them loose integrity.

    --
    War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
  32. Except... by Theatetus · · Score: 4, Insightful
    For example, Slashdot counts for something like 13 sites - the individual sections (like apple.slashdot.org - I'm not listing all of them)

    What about boxes like the ones where I work that run many (dozens, hundreds even) domains on one physical server? That's where the real difference creeps in; it's how 60-whatever % of sites run on Linux while 60-whatever % of boxes running web servers run Windows. Lots of the Linux boxes run multiple sites (and I don't just mean www.foo.com and images.foo.com; I mean they run www.foo.com and www.bar.com and www.baz.com and www.qxt.com on the single box).

    So, take one of my boxes at work: it currently hosts 53 second-level domains and about 200 subdomains from them. The one I'm thinking of has its own class C netblock, but we have similar ones that just have a single IP address for their dozens of sites. Do you want that counted as one server, as 53, or as 200? Netcraft says it's 200. Port80 says it's 1. I'd like to count it as 53. Netcraft's way tells you what people who make web hosting decisions like. Port80's way tells you what people who make hardware and software buying decisions like.

    --
    All's true that is mistrusted
    1. Re:Except... by RoLi · · Score: 2, Insightful
      Can't you take a course and just read? It's not that hard.

      Netcraft says it's 200. Port80 says it's 1.

      Wrong. Port80 says it's zero, zilch, nada because they only count the frontpage of Fortune 1000 companies and nothing else.

  33. And they are running.... by MavEtJu · · Score: 2, Informative

    We detect that www.port80software.com is running Yes we are using ServerMask.

    Date: Thu, 27 Nov 2003 07:15:24 GMT
    Server: Yes we are using ServerMask
    Set-Cookie: It works on cookies too=8, SM130P.5Q..NS12H57M64MP00.N2356; path=/
    Cache-control: private
    Content-Length: 21881
    Connection: keep-alive
    Connection: Keep-Alive
    Content-Type: text/html

    --
    bash$ :(){ :|:&};:
  34. Numbers look legit, but of questionable value. by ChaosDiscord · · Score: 5, Insightful

    They list the 995 sites they include (they're using the Fortune 1,000, and (looking at some of the earlier reports), apparently 5 Fortune 1,000 companies don't have sites. (If they're still Slashdotted, you can download the pages from Google's cache. start here.)

    A bit of quick Perl hackery pulls back the following values, roughly in line with what they report. The second column is actual sites found.

    54.0% 537 Microsoft-IIS
    18.2% 182 Netscape-Enterprise
    16.1% 161 Apache
    _3.6% _36 OTHER
    _3.4% _34 IBM_HTTP_SERVER
    _2.7% _27 UNKNOWN
    _1.8% _18 Lotus-Domino
    _____ 995 TOTAL

    That said, I doubt the usefulness of the survey. It's a survey of Fortune 1,000 companies. These are often companies whose web presence is minimal. What does a giant holding company need with a web site? Heck, five of the companies didn't have any site at all! Of those sites that exist, many lack any sort of complexity (say, thousands of pages, or lots of dynamic pages). Simply put, many of these sites would run fine an almost anything, they don't represent Hard Work. I'm a lot more interested in what Google and Yahoo choose to run than in what the Radian Group and the Kiewit run.

    Now Netcraft does have the problem they cite: Netcraft weights everyone equally. Perhaps that introduces bias. Perhaps we should select a set of sites that is high bandwidth, typically has at least some dynamic systems in place (say, to handle selling accounts), and is a popular target for hackers? How about porn sites? Porn operators have a hard job, thanks to Smutcraft you can see what they run.

    Second, it looks like they've chosen one site for each company. For Amerco, for example, they chose UHaul.com running IIS. Reasonable enough (UHaul is part of Amerco), but it's interesting that they skipped amerco.com (running Apache). Not a great example, surely (especially since uhaul.com is certainly doing more real work than the very thin amerco.com), but it shows that there is a selection process of some sort, and any selection process risks introducing bias.

  35. Free Software Wins again. by Anonymous Coward · · Score: 5, Informative
    and what would that one line be?I want my $50 worth on my apache server


    • Unpack the Apache distro file (apache_1.x.xx.tar.gz) and run the configure script.

      Now do the following commands:

    • cd src/os/unix
      (With Apache 2.x, cd os/unix)
    • vi os.h
    • Search for:
      #define PLATFORM "Unix"
    • Replace "Unix" with whatever you want your OS identification to be. (Some of the more creative ones I've done are 'NachOS,' 'PathOS,' 'StratOS,' 'ZerOS,' and 'WinDos'...anything.)
    • Save the file.
    • cd ../../include
    • vi httpd.h
      (With Apache 2.x, vi ap_release.h)
    • Search for:
      #define SERVER_BASEVENDOR "Apache Group"
      #define SERVER_BASEPRODUCT "Apache"
      #define SERVER_BASEREVISION "1.x.xx"
    • Replace "Apache" and "1.x.xx" with whatever you want your Server and version number to be. (I recommend "Port80Software-Is-A-Fucking-Ripoff" and "Holy-Jumping-Jesus-This-Was-Easy", respectively.)
    • Save the file.
    • cd ../..
      (With Apache 2.x, cd ..)
    • make

    You're done. Congratulations. You just saved yourself $49 dollars!!!
    1. Re:Free Software Wins again. by ivan.ristic · · Score: 5, Informative

      If you're using mod_security on your Apache server then you only need to add one line to the configuration file:

      SecServerSignature "MyServer/19.5.1"

  36. Sites Vs Servers? by phorm · · Score: 2, Insightful

    So basically, they're using a (questionably biased) survey of "servers" running IIS Vs others.

    No excuse me, but wouldn't be able to run 100 sites on an apache box without problems beat the pants off having to run 100 seperate IIS boxen?

    I mean, if say, 70% of the websites in the world were to be run on 30% of the servers, I'd say those 30% of servers had something over the other 70%...

  37. Perspective by rduke15 · · Score: 3, Insightful

    There is not much point in bashing one or the other survey as being biased. Of course they are (whether intentionally or not), since a single survey will only ever show a single perspective.

    - Netcraft shows servers by hostnames
    - Port80 shows servers for US Fortune 1000 companies

    Both are interesting (even though the Port80 graphs suck, and their software is broken).

    But both are meaningless by themselves if you want a serious view of server software usage.

    Adding Netcraft's SSL survey (which isn't free) would help to get yet another perspective.

    Then a breakdown by IP addresses instead of hostnames would be interesting, but Netcraft doesn't seem to publish that.

    And what about non-US Fortune-N companies?

    And web servers whose main business relies on the web (as this post suggests)?

    And stuff you definitely cannot get like the sites with the most traffic? (maybe you could get "sites-with-a-lot-of-traffic-which-do-banner- advertizing-with-major-banner-advertizing- companies").

    If you take the survey for what it is, it's interesting. Just don't expect it to tell you more than it can.

    Port80 is not about market share, it's about market share in US-based Fortune 1000 companies this summer. A very limited, but nonetheless interesting survey (if you care for surveys, that is).

    Who will do a survey of slashdotted sites? Shouldn't be too difficult. Anybody bored in some rainy region of the globe?

  38. Re:Sample:One means Value of Knowledge: Zero by ryanw · · Score: 2, Insightful
    Uhmm, how many companies have you worked for? How many hits does your site get in a day? How much of your company's business is critically dependent on your web presence?
    I have worked personally for 3 major corporate companies (fortune 500) and have friends that work in several others. Yes, the web is a huge dependency for my current location. I'm still sticking to my original comment. Linux is sure picking up the pace due to RedHat Advanced Server. The EXPENSIVE ONE. But it is not no where near as deployed as other major UNIX (non-linux) distributions in Corporate America. And that would explain the results of this survey.

    Another poster commented saying that Netcraft offers similar surveys to members. They are saying results of the Fortune 1000 to be very similar to this report.

    Settle down. Relax. Linux will be where you think it is today within 3 or 4 years.

  39. The TRUTH is ... by Jerry · · Score: 2, Informative

    that Microsoft's web server installs across ALL TOP DOMAINS have dropped to their 1997 levels, while Apache has almost doubled their 1997 levels. No amount of MS PR cash can change that fact.

    Hiding your IIS server behind a server mask or mis-identifying it as an Apache server isn't going to stop a virus or trojan... they can't read. They just try the exploit and if it works... it works. Not only has that been happening a lot on IIS servers, and MS software in general, the rates of infections/infectors seem to be growing... which explains why Apache had another large jump since last month, and MS has fallen by almost the same amount.

    It's one thing to have your web site broken into, its another thing to pay to have it broken into. That's what you're doing when you buy & install MS web servers and the anti-viral software which supposedly will 'protect' them. It's obvious something is not working....

    --

    Running with Linux for over 20 years!

  40. I don't get your comments by mikkom · · Score: 2, Interesting

    Why are everyone complaining about netcraft surveys based on domain names when every netcraft monthly survey also has statistics for active servers See this months survey for example, especially "total for active servers"

  41. Yes they are... check this out by imtheguru · · Score: 5, Funny

    i tried their header check for www.apache.org [link is here]

    Port80 returned this result:
    "We detect that www.apache.org is running Apache/2.0.48-dev (Unix)."

    But further down the page is this gem:
    "No matter what the above results show, this company may be running Microsoft IIS and protecting its Web server identity with ServerMask."

    WTF?!

    --
    Yet Socrates himself is particularly missed.
    A lovely little thinker but a bugger when he's pissed.
    1. Re:Yes they are... check this out by kyrre · · Score: 5, Interesting

      Apperantly servermask is their product. When I try a site I knew running IIS response is like so:

      Protect your Web server identity with ServerMask!
      Why let anyone find out you're running a Microsoft IIS server? Don't tempt potential hackers!

      Try ServerMask FREE for 30 days. Download Now!
      Buy ServerMask for only $49.95 today!


      No: "No matter what the above results show, this company may be running Apache and protecting its Web server identity with ServerMask."

      Security through masking the server string sounds very secure. sigh.

  42. Comment removed by account_deleted · · Score: 2, Insightful

    Comment removed based on user account deletion

  43. Fortune 1000 sites are not the busiest? by chrome · · Score: 2, Interesting

    I don't know for sure, and I don't have any data to back up my assertion, but I have a strong feeling that Fortune 1000 sites are not the busiest sites out there.

    For instance, a Fortune 1000 server probably only serves a few sites.

    Most people running server farms doing mass hosting can serve tens of thousands of sites off a single server running Apache (or Zeus, etc).

    I really doubt the relevance of this, especially in light of the fact that a lot of large companies will have a "MS software only" policy these days.

    But, this is all conjecture of course.

  44. Hey, that's FOUR lines! by mangu · · Score: 4, Funny

    So typical of "open sores" zealots...

    "EXPERTS CONFIRM: CONFIGURING OPEN SOURCE SOFTWARE IS 300% MORE DIFFICULT THAN ORIGINALLY CLAIMED"

  45. Real problems with methodology by DoctorNathaniel · · Score: 2, Insightful

    In skimming threads, it looks like people have missed the real problem: that the have pre-selected there sample.

    There sample is the servers of the "fortune 1000 companies". Now, I don't know how the Fortune 1000 chooses it's companies, but I'll bet they don't choose those companies that have succeeded due to good IT choices. Microsoft will be on the list.. but how much money does Google make? Is it on the list?

    Moreover, and this is the really important point, they are completely ignoring every other kind of site. Government, educational, research, NGO, military, etc, etc. It ignores all the sites that don't make any money but are vitally important.

    OK, they're just doing the study to prove that _companies_ use MSII. But even that's bad: it only proves that BIG companies use microsloth. This may be an intelligent decision for big companies, but not for small ones.

    So, in general, the only thing that Port80 really says in it's study is that big, rich companies use Microsoft. This implies no causality: few of these companies make money from the web.

    The Netcraft survey shows that PEOPLE use Apache.. and I think that's much more interesting.

    ---Nathaniel

  46. salt by Minna+Kirai · · Score: 2, Informative

    should be taken with a mountain-sized grain of salt

    People who enjoy the taste of salt add it in proportion to the amount of food they intend to eat. "Take with a grain of salt" means "Eat so little that just one grain is adequate seasoning", or just "eat very little". The suggestion to only consume a small amount is meant to imply a low level of trust. It is the opposite of expressions like "Swallow if whole" and "Swallow it hook, line, and sinker".

    Expanding the salt grain to mountainous proportions therefore means that you will accept the survey results with total creduluity.

  47. Re: More results by rduke15 · · Score: 2, Informative
    Well, I should have better things to do, but I couldn't resist looking at the results.

    So with "the nation's 500 fastest-growing private companies, from Inc magazine" data (see parent), the dominance of MS, to my great chagrin, is even worse:
    Total: 440

    57% (254) Microsoft-IIS
    34% (153) Apache
    2% ( 12) Rapidsite
    0% ( 3) Lotus-Domino
    0% ( 3) ConcentricHost-Ashurbanipal
    0% ( 2) Netscape-Enterprise
    0% ( 2) WebSTAR
    0% ( 2) Apache Tomcat
    0% ( 1) Sun-ONE-Web-Server
    0% ( 1) Lasso
    0% ( 1) Apache-AdvancedExtranetServer
    0% ( 1) Stronghold
    0% ( 1) WebSitePro
    0% ( 1) Xitami
    0% ( 1) Zeus
    0% ( 1) NetPr
    0% ( 1) Resin
    Who can find some interesting top-something companies list on which MS would get the low rating it deserves?
  48. Lets see... by bruns · · Score: 3, Insightful

    So lets see, they want to sell us a product which supposedly increases the security of IIS boxes, without even actually increasing the security in the process, but rather mangling the headers to look like Apache, in the hope someone will skip over it.

    Since when do the web server scanning viruses actually check the headers to see what type of server it is?

    I would think that someone who was scanning for vulnerable web servers would notice "This is a server" or "Yes we are using ServerMask" quickly and realize that someone is playing a game of hide the IIS server. Thats one hell of a big fucking redflag.

    None of their products actually offer any *real* security from what I see. They just hide the errors and obvious from normal people. It won't stop someone from nmaping the IIS box and see that its running Windows NT/2k/2k3. It won't stop those lovely Windows based viruses that scan for exploitable webservers.

    Lets not forget what happens when SQL/ODBC errors pop up and completely give away that your an IIS slave. Its so freakin easy to cause a server's script to throw back errors for analysis.

    If anything, they are saying that, "Yeah, IIS sucks, look how we can make IIS pretend to be like the much more secure and powerful Apache web server."

    Why not just run Apache in the first place? You don't have to pay money to a third party just to change basic configurations, and you get the most secure web server in existance.

    It seems painfully obvious.

    --
    Brielle
  49. Greetings from Port80 Software by jflima · · Score: 2, Informative

    Sorry not to be replying to any particular post, but the sheer volume makes that a little difficult to manage.

    It was good to see that, after a relatively brief spate of misdirected criticisms of our survey as being tainted by pro-Microsoft 'bias,' many contributors here saw that the data itself is pretty uncontroversial (and in fact easily reproducible), and instead began to address themselves to the questions that the survey was intended to raise -- namely, questions about what is an appropriate sampling methodology when attempting to measure HTTP server 'market share.'

    Those are the sorts of conversations we were hoping to start, and it's good to see them under way here with such vigor.

    Just to be clear: We have no real objection to the Netcraft results per se -- only to their being marketed as an unambiguously accurate picture of something called 'Web server market share.' We simply think that sampling this market is a more complicated affair than the endless recitation of the most commonly-sited Netcraft numbers would suggest.

    A number of the contributors here who grant the legitimacy of our criticisms of Netcraft's methodology have raised the point that a sample based on Fortune 1000 sites isn't necessarily a good proxy for Web server market share either. (Since some of these sites are nothing more than glorified brochureware, and so on.) I think that's entirely correct.

    In a sense, our survey simply sets one type of partial snapshot, with its own kind of built-in sampling bias, alongside another. But then our aim wasn't to be definitive. It was simply to remove the halo of definitiveness from the Netcraft survey -- and to get people thinking about what it would take to be definitive in this context.

    And as I say, some of that thinking is on display here. Folks like ChaosDiscord are almost certainly right to suggest that it would be more accurate (or interesting) to sample the server choices of high-traffic sites. We hope to cover some of this territory in future surveys.

    Thanks to all those who looked past the fact that we happen to make commercial software for IIS, and actually engaged with our survey's findings and implications. And happy Thanksgiving to one and all.

    Joe

    Port80 Software

  50. I'm sorry, you're point is completely invalid by Niscenus · · Score: 2, Interesting

    Hence, it would seem apparent, after only a very small time here on slashdot, that if someone can take the time to spellcheck their post then they are ALSO more likely to VALIDATE their owm information.

    <PHB mode="true">
    I have just recently been informed to ignore people like you, but I can't remember from where....
    </PHB>

    --
    "Yeah...it was the numbers that were irrational, not the murderous cult of vegetarians...." -- Hippasus of Metapontum