Apache Webserver Surpasses 50 Million Website Mark

chris81 writes "For the first time ever, the Apache Web Server is powering more than 50 million websites, according to Netcraft's Web Server Survey for October. Although relative share fell by 0.67 percent, the total number of sites powered by Apache grew to over 52 million. Microsoft's IIS finished second with more than 15 million sites served."

Comments

...and

[Neo-Rio-101]

Netcraft confirms it

Re:...and

[KiloByte]

I wonder how they count it when you have different names for a single site:

<VirtualHost *>
                ServerName urukpr0n.angband.pl
                ServerAlias urukporn.angband.pl urukp0rn.angband.pl urukpron.angband.pl
[...]
(No, this site isn't what you think.)

This is especially important if you count the fact that in a lot of cases www.$SITE is a CNAME for $SITE.

Re:...and

[Anonymous Coward]

but Apache GREW 0.74 % !!!!

Re:...and

[diegocgteleline.es]

That's what the "active sites" means I think - and that would make 23 millions of real apache servers

http://survey.netcraft.com/index-200007.html#activ e

Re:...and

[Anonymous Coward]

Not 23 million actual servers, just 23 million different sites. Probably hosted on just a few hundred thousand physical servers. Netcraft "active sites" calculation is based on an estimate from contacting each server IP address a few times using a selection of the registered names and then comparing them. e.g. if you host 4000 domains which all say "We own this domain $domain, why not offer us money for it?" Netcraft will notice that 4000 names lead to that IP address, connect say 14 times, get a very similar response each time and conclude that there is only one active site.

23 million servers would represent almost 1% of all unicast IPv4 addresses (and AFAIK Netcraft don't look for IPv6-only servers)

Re:...and

[Anonymous Coward]

They count both hostnames and active sites. The 50 million number is for hostnames.

If you want to test a server yourself, go to http://www.netcraft.com/whats

To read the survey in full go to http://news.netcraft.com/archives/2005/10/04/octob er_2005_web_server_survey.html
You can also always find the latest survey at http://news.netcraft.com/archives/web_server_surve y.html

Re:...and

[buanzo]

well, the same applies for IIS :)

Re:...and

[dtfinch]

You just know that web hosts want to milk their IIS installs for as many sites as possible. It's cheaper to add more ram and hard drives than to buy another Windows Server license to host more sites.

Re:...and

[queenb**ch]

What about all the apache instances that serve up multiple URL's too? We have four apache instances here that serve well over 100 URL's.

Is that 4 or5 100????

Inquiring minds want to know....

2 cents,

Queen B

Err....

[Anonymous Coward]

>>Microsoft's IIS finished second with more than 15 million sites served.
Now did they try to find how many actually work ;)

Re:Err....

[Skiron]

12,000,000 of them are within microsoft.com domain (spoofed Apache httpd)...

Re:Err....

[diegocgteleline.es]

since they were detected, I assume all of them?

Re:Err....

[ohjethuth]

Take a crap on IIS = you win *1 Insightful*
Take a crap on Apache = you win *1 Flamebait*

This is great, i've cracked it!

Re:Err....

[Anonymous Coward]

>>Microsoft's IIS finished second with more than 15 million sites served.
Now did they try to find how many actually work ;)

And how many had goatse on them?

Re:Err....

[Anonymous Coward]

Huh?

I'm impressed

[Killjoy_NL]

Not just that so many people and companies host websites on Apache, I'm more impressed that there are so many websites?

Such an enormous collection of data, it boggles my mind.

Re:I'm impressed

[AvantLegion]

True. But once you remove the porn, there's only about 500 or so.

Re:I'm impressed

[rolfwind]

I would be interested to see what OSes those sites are running on, I'd suspect it would kill the "Linux is just as insecure as Microsoft" myth.

BTW, does Netcraft have a version of the DowJones 500 to see what the top 500 sites are running? I can't seem to find anything....

Re:I'm impressed

[aussie_a]

Such an enormous collection of data, it boggles my mind.

Here's a list of what the sites are (from most populous): 1: Porn sites
2: Spam sites
3: Spyware sites
4: Scamming sites
5: Warez sites
6: Blogs
7: Message boards
8: Wikipedia duplicates (where they copy and paste Wikipedia entries)
9: Software related sites
10: Other business related sites
11: Education-related websites.

As you can see, most of it is just rubbish.

Re:I'm impressed

[DrSkwid]

It's no myth.

Re:I'm impressed

[lucas teh geek]

It's a pitty you've been modded funny, i would have modded you insightful

Re:I'm impressed

[alanw]

I would be interested to see what OSes those sites are running on, I'd suspect it would kill the "Linux is just as insecure as Microsoft" myth.

BTW, does Netcraft have a version of the DowJones 500 to see what the top 500 sites are running? I can't seem to find anything....

There's the What's that site running? page, the Longest uptime page and the monthly most reliable hosting page.

Re:I'm impressed

[drstock]

"I'm fairly sure that if they took all the porn off the Internet, there'd only be 1 website left, and it would be called Bring Back The Porn."
- Dr Cox from Scrubs.

Re:I'm impressed

[JamieKitson]

You missed one:

8a: Wikipedias (where they copy and paste web resources)

Re:I'm impressed

[Kjella]

It's a pitty you've been modded funny, i would have modded you insightful

Quote the GP:
"Here's a list of what the sites are (from most populous): 1: Porn sites
(...)
As you can see, most of it is just rubbish."

<slashbot>Pr0n is rubbish? It must be a joke, +1 Funny.</slashbot>

Re:I'm impressed

[DexterF]

"Data"? That's a tad euphemistic, isn't it.

Re:I'm impressed

[Killjoy_NL]

For me it's data until I need something, then some of the data becomes information :)

Re:I'm impressed

[oztiks]

I can see your point here but you have to also look at it this way, demand and resources.. Realistcally warez and porn sites are huuuge resource hogs and if you look at the trends of data that comes out of netwatch you can see when apache spike for a month IIS weakens and vice versa. Plus percentile wise the domain to server differential is only about .2%

Re:I'm impressed

[alexhs]

1: Porn sites
2: Spam sites
3: Spyware sites
4: Scamming sites
5: Warez sites

What are the differences between these five ?

You also forgot ad-serving sites between 5 and 6.
It's not because you have an ad-blocker that they don't exist ;)

Re:I'm impressed

[masklinn]

Uptime isn't reliable since last time i checked Linux boxes still had an uptime bug (the 497 days reset).

Re:I'm impressed

[gstoddart]

True. But once you remove the porn, there's only about 500 or so.
Yeah, but why would you remove the porn?

Re:I'm impressed

[tb3]

Yes, but Windows servers have an uptime bug, too. It's called "Windows Server".

Re:I'm impressed

[masklinn]

Actually no, the uptime bug of windows server can be found under the reference "Windows" in most documentations

Re:I'm impressed

[Ignignot]

I know! Who cares about 2 through 11 anyway. We should convert those other sites to porn sites!

Re:I'm impressed

[Anonymous Coward]

How did you come up with the list of all the upcoming sites that'll be slashdotted?

What are you? Some kind of timetraveler?

Yours truly,
Anonymous Slashdot Admin.

Re:I'm impressed

[Anonymous Coward]

Decent stats tools usually acount for known wrappings.

Re:I'm impressed

[CapnGrunge]

8b: Uncyclopedia

Re:I'm impressed

[petermgreen]

just to clarify thats a reset of the uptime counter not of the entire machine

Oh!

[Martz]

Isn't that the number of servers required just to power /.?

I smell a rat!

Re:Oh!

[Anonymous Coward]

An unfunny Joke is not flamebait .
This is flamebait :

Some Slashdot moderators have the intelligence of brain damaged slug

So what your saying is:

[a.d.trick]

There are more servers out there, and IIS is growing faster than Apache?

Re:So what your saying is:

[diegocgteleline.es]

No, IIS isn't "growing faster than apache", it has grow faster than apache this month. If you look at other web server surveys (or at that graphic) you'll find different numbers

Re:So what your saying is:

[dbrutus]

Actually, Apache's share is up. The article is wrong. Last month it was 69.15% of the market and this month it's 69.89% of the market.

Apache License?

[putko]

Can someone please explain the subtelties of the new Apache license?

Is the license such that MicroSoft could merge it with their stuff, and not give away the source?

Re:Apache License?

[QuantumG]

      1. You must give any other recipients of the Work or Derivative Works a copy of this License; and

      2. You must cause any modified files to carry prominent notices stating that You changed the files; and

      3. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and

      4. If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.


The last clause there is what makes it incompatible with the GPL and what made the OpenBSD folks fork it (they folked before the license change to include this clause). In answer to your question, yes, indeed anyone is free to extend and distribute binary forms of the software without having to hand over source code for their extensions (or even for the code they didn't write).

But here's a question for you. If you're required to give "any other recipients of the Work or Derivative Works a copy of this License", does that mean that the extended work has to be under this license? Or does it just mean you have to give the license to them, even though it isn't applicable. What stupid wording. Presumably it means you can't change the license on the software.. but you can apply any license you want on your extensions.. which means you can prohibit the software from being distributed, even though "this license" says you are free to distribute it.

Re:Apache License?

[Anonymous Coward]

If you redistribute a derivative work, you have to include a copy of the license because the original parts are still under that license, obviously. You cannot just change the license of the original parts -- the additions are another story.

Re:Apache License?

[Anonymous Coward]

It has always been that way.

The thing is, it isn't the code that's of value, it's the ongoing project. Sure, someone may use the code, but maintaning a fork isn't trivial. People who fear non-GPL open source licenses fail to realize this; the fact that Apache hasn't been displaced by a closed-source fork should be proof enough that open source can work even when the license doesn't force people to keep the source open.

Re:Apache License?

[QuantumG]

Bah. If you compile a proprietary extension into an Apache licensed program it doesn't matter that you're technically allowed to copy the Apache licensed portions. You can't seperate the two (and even if you could, the seperate parts would be useless) so the entire program is practically under a proprietary license.

Re:Apache License?

[zootm]

But here's a question for you. If you're required to give "any other recipients of the Work or Derivative Works a copy of this License", does that mean that the extended work has to be under this license?

I think that that clause is intended to ensure that the distributers of the derived work let people know that the system is based upon a system with a more "free" licence, to ensure that those who buy the derivative work know that these parts (which are likely to be substantial, in this case) are included.

I expect it's something which is perfect wording in legalese but looks funny to us Average Joes and Joannes trying to inspect it. I am not a lawyer, etc., though.

Re:Apache License?

[dirkx]

But here's a question for you. If you're required to give "any other recipients of the Work or Derivative Works a copy of this License", does that mean that the extended work has to be under this license? Or does it just mean you have to give the license to them, even though it isn't applicable.

It means exactly what it says (see the original; the above suffers from crcual typo's) - you must pass on the license (which include the important disclaimers) along and as it pertains to the agrement under which you got the apache code under - but that does not mean that it applies in a contaminating sense to your own code, code you have added, nor does it mean you have to provide soure or certain licenses pertaining your own work along as wel further downstream.

This is not the same as making a contribution back to the ASF, which is what most of the license is about; and in that case it gets a bit more complex; and you specifically need to take patents into account as well.

Re:Apache License?

[ajs318]

People who fear non-GPL open source licenses fail to realize this; the fact that Apache hasn't been displaced by a closed-source fork should be proof enough that open source can work even when the license doesn't force people to keep the source open.

The Apache project, and the various BSD projects, work their collective bollocks off to make sure that if anyone tries to create a closed-source fork, they will have a superior open-source alternative.

As much as I admire all that hard work, I simply don't feel confident that I personally could go to such extreme lengths just to prevent code that I wrote for the benefit of all humanity from being locked up. Other people get to exercise their rights because I live up to the obligations incumbent upon me.

All closed-source software by definition abridges two of the Four Freedoms; and many EULAs would seek to abridge one or both of the other two if only they were legally enforceable. I would much prefer to see the Four Freedoms protected by the Law of the Land.

Micosoft salesrep

[kryten_nl]

Microsoft salesrep: "You know, Apache's relative share fell by *cough*0.*cough* 67 percent!!!"

Re:Micosoft salesrep

[Anonymous Coward]

I'm curious (not just bating the MS fans). Why would anybody run IIS on Windows instead of Apache over some kind of *nix? Most of these machines will be headless, carefully specced for the job, and maintained by experienced computer users. So why on earth run an MS solution when it's so obvious that the free solution is so much more stable? Am I missing something?

Re:Micosoft salesrep

[Hydroksyde]

Some of them aren't run by experienced users, they're run by people who have basic IT skills, and can do day to day maintainance on a windows network, outsourcing whenever anything gets over their head. IIS is also arguably faster, as it's running on a single architecture, on an OS designed by the same developer.

Re:Micosoft salesrep

[jellomizer]

Well there are the MS Fans out there who believe Microsoft's propaganda, and/or believe that Microsoft is the only serious player out there.

Secondly there are a lot of companies that are strictly a Microsoft shop, and the cost of moving is to high and the staff is use to windows so they stick with windows solutions they already bought.

Third they have a group of .NET developers and it is easy to for them to make a Web App on IIS vs. Getting Mono on Apache working, and working threw any of the glitches.

IIS is arguably easier to use then apache because you don't need to go threw and end a text file and add commands that may not be part of the default configuration.

Fear from ignorance, they are afraid if they don't use IIS then they will not be able to support the IE users, heck whenever they look at a pro-linux site who uses advanced CSS it rarely renders properly for them.

They already have Windows [NT, 2000, 2003] servers and they have IIS on them so they will use it, because they already paid for it.

It has been a long time since I heard of a major security flaws in IIS being affected and much longer for Apache. But you are expecting all the consumers to be logical, that is just crazy.

Re:Micosoft salesrep

[Anonymous Coward]

IIS is also arguably faster, as it's running on a single architecture, on an OS designed by the same developer.

IIS is not arguably faster than Apache httpd, it is faster. What is arguable is the wisdom of running a server at ring0 (kernel address space). Apache was not designed for raw speed, it was designed to be full-featured, stable and correct. If you want to see IIS trounced by a kernel based httpd, take a look at TUX and this (typically flawed) benchmark. The only good thing I have to say about IIS is that version 6 appears to have undergone a security audit and is no longer being rooted by simple HTTP GET requests (a genuine Microsoft innovation) like previous versions.

Re:Micosoft salesrep

[slavemowgli]

IIS is arguably easier to use then apache because you don't need to go threw and end a text file and add commands that may not be part of the default configuration.

If your IT department is afraid of editing text files (I assume that was supposed to mean "edit", right?), then you have a bigger problem than being dependant on Microsoft, anyway.

Re:Micosoft salesrep

[jellomizer]

The fear of editing a text config file is not a fear of using the editor but knowing what commands to change and type without any help from the application to say what you entered is crap so when you made 20 changes and run it and it bombs out then you need to figure what you changed was wrong or made a typo. Bringing up and down the server for each of the 20 changes could drive people nuts when the web server is acting funny.

Re:Micosoft salesrep

[Baricom]

Can't you do a syntax check in Apache without restarting it? I think it's the -t switch.

Re:Micosoft salesrep

[McGiraf]

# apachectl configtest

by the way IIS has a ton of settings that cannot be changed by the GUI, you have to and regstry key for them.

Notice the similarities

[grazzy]

In the graphs acceleration compared to 2001/2002? :)

Actually...

[DavidHOzAu]

It's because of php's increasing popularity, as this page shows.

Re:Actually...

[QuantumG]

I wonder how it compares to this graph.

Re:Actually...

[hostpure]

It is most likely because of PHP and a fair collection of PHP Blogging scripts which are available. I mean just look at the sheer number of blogs at the moment and it isn't hard to understand just how many new sites there are now. Must be a dot blog boom (I doubt it will be too long before we see the .blog TLD)

Re:Actually...

[Anonymous Coward]

So it's quite funny that PHP developers are still recommending not to use apache with a threaded MPM (because of 3rd party libs not php I know). Dual core CPUs are there, the apache + php duo should be able to get top-performance from your systems to keep both on the top...

Re:Actually...

[smallguy78]

The web, powered by 10-18 year olds downloading free php/mysql/apache photo album/blogging/forum software.

We're so privileged to have such a huge information superhighway at our fingertips.

Not all PHP users are 10-18 year olds using premade scripts of course.

Re:Actually...

[Anonymous Coward]

PHP has nothing to do with Apache. You can run it also inside IIS.

Re:Actually...

[imroy]

Just out of interest, here's the mod_perl graph (a little out of date though). *sigh*

Also, here's SecuritySpace's Apache module survey which covers everything else.

Re:Actually...

[Adhemar]

I have the feeling that the reason why Java-based web programming never really took off, and PHP is being widely used so widely, lies in the fact that PHP is freely shipped with the most popular web server.

So, the popularity of PHP (compared to Java) is more due to the popularity of Apache than the other way around.

Re:Actually...

[Anonymous Coward]

That's true. Some of the 10-18 year olds sign up on Slashdot to troll comments. Kind of like you.

Let me know when your birthday is coming up, we'll have to take the training wheels off your bike this year.

Re:Actually...

[consumer]

Apache HTTPD does not come with PHP. PHP is not an Apache project. Tomcat (a Java servlet runner) is an Apache project, although it isn't shipped with the httpd either.

Re:Actually...

[gothfox]

Interesting? What a load of bullshit. First of all, PHP is not shipped with Apache and as for Java web programming never taking off... look what serious guys use, not bloggers and wannabe homepage webmasters. Surprise, surprise, it's usually some Java technology or ASP.NET.

Re:Actually...

[tacolicker]

We should expect temperatures to fall soon as a new wave of pirates emerges.

Re:Actually...

[shutdown -p now]

You can, but there are quite a few Apache-specific features which are not available under IIS. Also, most PHP tutorials suggest Apache for a server (and MySQL for a database), and most preconfigured packages available are Apache/PHP/MySQL.

Odd lines in chart

[inkswamp]

The chart marked "Market Share for Top Servers Across All Domains August 1995 - October 2005" is interesting. I'm not entirely sure I understand what it means, but July 2001 and June 2004 show an almost mirror image in terms of the blue and red lines (Apache and MS.) When one goes up, the other goes down and vice-versa. Strange. I wonder what exactly was happening during that time period to cause that.

Re:Odd lines in chart

[Kjella]

I'm not entirely sure I understand what it means, but July 2001 and June 2004 show an almost mirror image in terms of the blue and red lines (Apache and MS.) When one goes up, the other goes down and vice-versa. Strange. I wonder what exactly was happening during that time period to cause that.

Several big hosting providers were trying to switch their hosting between Apache and IIS. Providers that are big enough to actually make those kinds of dents in the graph. As you can see from the final result, most of them figured out Apache was the better solution. I wouldn't use IIS to serve HTML either, only if the content required .NET and you didn't really have a choice.

Kjella

Re:Odd lines in chart

[inkswamp]

That makes sense. Thanks for explaining.

I wouldn't use IIS to serve HTML either,

I've dealt with both Apache and IIS professionally and by far--by far!--I have encountered the most issues with IIS, from little annoyances to full-blown meltdowns. I'm not sure how IIS survives in the market place when its competitor is more robust, functions better and is free. Chalk one up to the marketing people at MS, I guess.

Re:Odd lines in chart

[larien]

The big movers are the domain registrars; they'll host several hundred parked domains on a single server. While they're all using the same content (probably the same files, even), they'll show up as hundreds of sites. If they move from Apache to IIS (or vice versa), several hundred (or thousand?) websites appear to switch.

Re:Odd lines in chart

[Rocketship Underpant]

"July 2001 and June 2004 show an almost mirror image in terms of the blue and red lines (Apache and MS.) When one goes up, the other goes down and vice-versa. Strange. I wonder what exactly was happening during that time period to cause that."

I suspect that red "hump" on the Microsoft graph coincides with major version releases of their IIS and Windows Server 2003. People and companies tried it out, then switched back to Apache over time.

Some of the sharper spikes are sometimes due to large ISPs with thousands of hosted domains that migrate to a new platform (either to or from Apache) or get bought by another ISP that uses a different platform. For example, Microsoft's spike in July '02 was due to Register.com moving their domain parking system to an IIS front end, even though practically speaking, the proportion of actual sites hosted on IIS did not increase.

Re:Odd lines in chart

[odie_q]

Their selling point is integration. I have a client who design, sell and admin content management systems, and they are a pure MS shop. Their products rely heavily on the integration between IIS, Exchange, .Net and Active Directory. From what I have seen they would have a lot less hassle with a system of separate components that actually work and fit with their product instead of shoehorning their stuff into the MS conventions, but they are convinced that the superior integration of Microsoft's offerings give them a significant advantage.

On the other hand, they have pretty good knowledge about how to program for Microsoft products, and no knowledge whatsoever about any competing products, so in their case they are obviously better off using the stuff they know.

Re:Odd lines in chart

[guruevi]

Well. That is because of the contracts running with Microsoft. We have a contract (as hostingprovider) that x-% of the servers has to be Windows based so we recompiled Apache to show up as IIS and the next month Netcraft confirmed it, we moved 15000 sites (URL-forwarding) to IIS.

Re:Odd lines in chart

[Anonymous Coward]

we recompiled Apache to show up as IIS

Hehe...

the next month Netcraft confirmed it, we moved 15000 sites (URL-forwarding) to IIS.

But wouldn't it look strange that there are 15000 IIS sites, and not one of them is goatsed?

Re:Odd lines in chart

[Anonymous Coward]

but they are convinced that the superior integration of Microsoft's offerings give them a significant advantage.

Care to give a couple of their URLs so that we can convince them otherwise? Post anonymously if you are afraid that people are going to click on the URLs and be offended by the images that will certainly soon appear there...

Re:Odd lines in chart

[JamieKitson]

It's percentage. Since it's basically a choice of two, if one goes up the other must come down.

Re:Odd lines in chart

[RoLi]

I'm not sure how IIS survives in the market place

They survive because of customer lock-in (aka "Integration" in salesspeak), "standardization" (with desktop systems) and the delusion (which is interestingly put forward by both pro- and anti Microsoft people) that "sooner or later" Microsoft will dominate every market and so it's better to bet on the winner.

However, with years of IIS being pretty stagnant or slowly losing marketshare, this delusion cannot be sustained forever, more and more people realize that OSS is not just a fad and is here to stay.

Also with each round of forced upgrades on the IIS-side, some jump ship.

It will probably will take a decade or two, but then IIS-fans will find themselves in the very situation they wanted to avoid: Being a tiny minority, fighting with bad 3rd party support and being frowned upon.

In some countries it already happened: In Germany, IIS runs only 5.56% of domains (down from over 20% 5 years ago) - cheap German webhosters don't offer Windows anymore at all, some webhosters charge extra for Windows and only few charge the same (however those are usually the most expensive webhosters anyway)

Re:Odd lines in chart

[Sweep The Leg]

I have as well. The biggest problem with IIS is the metabase which is already gone in the new version to be released. I'm sure the other security issues will still be there, but oh well.

Re:Odd lines in chart

[inkswamp]

I understand that. I was wondering what the real world events were that caused it, especially for such a prolonged period of time. As the other responses here explain, it turns out it was some big customers jumping back and forth.

Now can we have the results for Gopher servers!

[Viol8]

Just curious. Also would be nice to see the current amount of WAIS
and Archie servers left! :o)

Re:Now can we have the results for Gopher servers!

[MoogMan]

7 and 3 respectively.

Re:Now can we have the results for Gopher servers!

[Viol8]

Don't happen to have the addresses do you? I fancy a trip down
memory lane today...

Re:Now can we have the results for Gopher servers!

[kc_cyrus]

There are still many Gopher servers around, check out the directories at:

Floodgap Gopherspace

and

gopher.quux.org

security trash talk

[Anonymous Coward]

talk security all you want but be fair and give ms high marks here. by far, apache has more viruses and security issues as a percentage of its market share than iis does. it doesn't look like that at first because of the difference in market share but iis is actually more secure when you analyze the numbers. people ignore apache issues because windows issues are more relevant to the vast majority of home users so ms security issues get reported on more frequently, further working to skew the average person's perceptions.

that news to me

[h4ckintosh]

I woulda thought Apache had already surpassed this statistic. Anyone else struck by this?

What will LAMP's success mean to M$?

[linumax]

Well, actually they have their own plans.
and part of the plan is giving some for free! See SQL Server 2005 Express Edition's Pricing Policy and the same for Visual Studio Express Edition which will be free.
I don't do much open-source programming but I'd like to thank all those guys who do, cuz if it was not for their efforts, M$ would have never given something for free (at least as in beer!!)
Anyway, the point is that some small businesses might be attracted to M$'s side by giving these development tools for free and this might have an effect on Apache and as a whole LAMP's market share.

Re:What will LAMP's success mean to M$?

[nogginthenog]

4 GB maximum database size

Looks a bit like MS SQL Desktop Engine. That's been around for a while - originally bundled with Visual Studio, some Office versions and other MS stuff, but downloadable recently-ish from MS for free.

Re:What will LAMP's success mean to M$?

[killjoe]

I think this is awesome. Open source is forcing MS to give away software they would normally charge thousands of dollars for. This certainly will not help their bottom line. Every penny MS doesn't make is one less penny going to kill open source or lobbying govt. Whoo Hoo.

Well happy birthday or something

[Xiph]

I really can't see this as anything that'll come as a surprise to anyone, nor the fact that apache came first. I also have a feeling that the apache guys see this the same way, as it is nowhere to be found at http://apache.org/foundation/news.html/. but i guess any round number is worth celebrating, after all free as in drunk, is as important as any other freedom ;)

Re:Well happy birthday or something

[Anonymous Coward]

They used to gloat about it pretty regularly. Have a look at:

http://web.archive.org/web/19961028114216/http://w ww.apache.org/

I guess they got tired of bragging.

What would be really interesting...

[sosume]

What would be really interesting would be a figure of total pages served (over the entire internet), grouped by server type. Or the average return opn investement, per server type. Number of hostnames really says nothing, I can add a few thousand myself with no trouble at all.

Re:What would be really interesting...

[wfWebber]

And you think it's harder to add a couple of zillion pages?

I'd prefer something like "Commercial servers with over 1K visitors a day".

Re:What would be really interesting...

[DaHat]

I agree, hostnames alone is pretty worthless. Personally I would like to see statistics based on IP address and not host names.

It's pretty easy for any person to colo a LAMP setup and host the webpage of everyone they know who doesn't want to be on geocities anymore... far easier than plunking down the cash for a Windows 2003 install with IIS6.

Of course, there are always studies like that of Port 80 software who found that 53.7% of corporate web servers were running IIS, vs the 22.7% of Apache.

See http://www.port80software.com/surveys/top1000webse rvers/ for more details.

Three considerations

[VincenzoRomano]

#1. Sites vs servers.
Netcraft states they count the sites while they don't mention whether they count 2nd level domains (foo.com), 3rd level domains (www.foo.com, support.foo.com) or what else. They just say they "received responses from 74,409,971 sites" while not defining what a site actually is.

#2. Growth.
There has been a growth of about 3.73% in the number of (so called) web sites. There must be some hidden winner(s). That is, there must be some group of web servers that is getting the great part of the growth all at once! Netcraft is failing to mention who they are!

#3. Webserver (or website) identification.
It's all but trivial to identify web servers. Are they using some special tool like amap and nmap or just looking at the server response content? How accurate this identification can be?

Re:Three considerations

[munehiro]

With all the "personal interpretations" of statistics out there in favour of microsoft products, who cares?

If apache have a marketing appearence why we should consider to normalize it?
They don't, we don't.

Re:Three considerations

[VincenzoRomano]

Well, techies don't care about statistics, they care about the meat.
Bit managers very often care about statistics and give money to techies and get money from the market accordingly to statistics.
If my considerations are real, that statistics company could cheat!
Apache people seem to be techies.

Re:Three considerations

[rjw57]

Follow the links in TFA. They you'll get to http://survey.netcraft.com/index-200007.html which says
"The Netcraft Web Server Survey is a survey of Web Server software usage on Internet connected computers. We collect and collate as many hostnames providing an http service as we can find, and systematically poll each one with an HTTP request for the server name."

Re:Three considerations

[slim]

They just say they "received responses from 74,409,971 sites" while not defining what a site actually is.

Netcraft is very clear about this.

One server running 10,000 virtual hosts is 10,000 "sites".

This is why historically thttpd did very well in Netcraft surveys -- it was good at hosting thousands of sites from one server (and allowed throttling of over-used sites).

Innovation

[Anonymous Coward]

Don't want to be a troll, but what are the latest innovations Apache introduced lately to stay on top? I think we don't talk often enough about this software here on Slashdot. No, I'm not new here...

Re:Innovation

[Viol8]

"I think we don't talk often enough about this software here"

Thats cos webservers are , however you want to look at it, pretty
boring programs from a technical point of view.

Re:Innovation

[the_2nd_coming]

all the innovation is done in the modules, not the server

Re:Innovation

[Anonymous Coward]

I think the greatest innovation of Apache is that works reliably and is cheap.
While many other companies are trying to implement these features, no one has managed to clone both of them.

15 million servers...

[jromz03]

still needs to learn its lesson.

what operating systems are popular with Apache?

[SgtChaireBourne]

I would be interested to see what OSes those sites are running on

Netcraft used to show a summary with that information. I'm not sure why they stopped showing it, since they do still collect it and show it for individual site queries. I suppose if enough people ask them to reinstate it, they might actually reply to one of the messages and explain the rationale. More likely than not it probably made it evident that one of their major advertisers **cough**MS**cough was losing market share to both other http servers and other platforms.

Along the same lines, I saw a recent IDC report that showed (if one looked at the data oneself) that MS was continuing to lose market share in the server room, at least percentage wise. My guess is that they took most of Novell's share around 2000 when they ran the smear campaign against Netware and then have been slowly hemorrhaging marketshare since then.

Re:what operating systems are popular with Apache?

[Anonymous Coward]

It's probably more along the same reasons that google withdrew OS stats.

Those things are so inaccurate that they aren't realy worth mentioning seriously. But people refer to them seriously which makes google/netcraft look bad. They don't want to release information that they know is widely innaccurate.

Netcraft gathers information on web servers becuase web servers give identity strings to certain queries. The OS requires different sort of detection to be accurate and it would take too long.

Re:what operating systems are popular with Apache?

[rolfc]

Actually they still show the os.

look at http://uptime.netcraft.com/up/today/top.avg.html

to see ths longest running servers and their os

Re:what operating systems are popular with Apache?

[Ian.Waring]

Some of the OS numbers used to get bent out of shape by people front ending Windows machines with Linux based cache or content distribution networks (Akamai being a notable one). Which is why MS used to show up as running Linux for www.microsoft.com. The methodology has probably improved since.

Ian W.

Re:what operating systems are popular with Apache?

[deejer]

How do you slowly hemorrage marketshare? Hemorrage suggests rapid loss of market share which is the opposite of slowly.

Quality issue

[SgtChaireBourne]

Yes, it's interesting to see that competition forced a reduction in price from MS' side, but you still have the problem of quality.

Qualitywise, MS SQL Server is the IIS of the database world. Only if you somehow got locked into .NET or some other proprietary hook into MS would you need MS SQL over an industry standard like Postgresql or MySQL which are in approximately the same niche. Those two are even starting to nibble at the heels of Oracle in some contexts, unlike MS SQL.

MS has tried give aways before with IIS. People learn their lesson and move on, unless they get locked in. The same goes with SQL databases.

So a purchase price of zero is an advantage, but the main reason people use Apache and the other parts of LAMP is the quality. The price is just gravy.

Re:Quality issue

[Anonymous Coward]

Qualitywise, MS SQL Server is the IIS of the database world. Only if you somehow got locked into .NET or some other proprietary hook into MS would you need MS SQL over an industry standard like Postgresql or MySQL

Uh, based on what? What you read on Slashdot?

Re:Quality issue

[Marthisdil]

If your app/OS can't live securely in a networked environment w/o a firewall then it shouldn't be using TCP/IP anyway

So you're saying that no OS should use TCP/IP? Because nothing is secure - if you believe so, you're more of an idiot than Bill Gates.

Re:Quality issue

[Anonymous Coward]

I can't believe the parent was moded to insightful.

Obviously you haven't ever used MS SQL or done a features comparrison. MySQL and Postgre are hardly an industry standard and are flies to Oracle and even MS SQL. They are good for personal or small websites definitely, but they are not enterprise class like Oracle and MS SQL.

SQL Server is not considered the IIS of the database world. IIS is garbage and the only time I ever use it is to host .NET apps, and even then I'd rather use Apache with Mono anyway. MS SQL is hardly garbage and is a wonderful product, albeit with its quirks, just like Oracle. I'd argue that MS SQL is probably the best mid-level DB out there with features that no open source DB has come close to matching thus far.

Don't even give me the garbage about how MySQL has stored procedures either. Stored procedures in MS SQL run through an query engine and get an execution plan that can be cached to dramatically speed up repetitive queries. MS SQL will even look at your join order and optimize it unless you've told it otherwise. I'm certain that neither product has anything even close to that level of sophistication. Then there's replication, remote queries, data integrity issues, the list goes on. I have my issues with Microsoft but MS SQL 2000 is probably one of the best DBs ever put out. Please actually use a product and learn about it before you bash it.

I write enterprise apps for both web and desktop in C++, COM+, Python, .NET (C#/ASP.NET), Perl, and Java. If you even believe for a second that one of my colleagues or I would ever use Postgre or MySQL over SQL Server, you must be joking. FYI, Apache is the #1 choice for colleagues, clients, and myself alike but we use IIS because SQL + .NET is a great combination that can scale nicely despite any animosity we feel towards Microsoft.

I'm only posting under AC because I've always been too lazy to get a slashdot account but posts like this make me want to get one. Please stop reading slashdot and start actually developing software before you spit back more propoganda.

Re:Quality issue

[pedestrian crossing]

I've got to disagree with you on this one. MS-SQL is about the -only- MS product that is worth a damn.

MySQL? I think you need to lay off the Kool-Aid. Postgresql? Maybe, but it doesn't come with the suite of tools that you get with MS-SQL.

Really, I dislike MS as much as the next slashbot, but MS SQL server is the exception to the rule.

Re:Quality issue

[raxx7]

You are wrong. :)
PostgreSQL has a propper query planner (MS SQL's may be better or worse, I have no idea), support for prepared statements and will "cache" the execution plans for statements in Pl/SQL stored procedures.
I don't know about Firebird, but I'd expect it to have about the same features. These are fairly common features in RDBMS. Not having them is the exception.

Replication is avaliable for MySQL, PostgreSQL (and Firebird too I think), although PostgreSQL's replication are still third party tools and I don't know which replication modes are avaliable to each RDBMS.

Regarding data integrity, what flaws would you point to PostgreSQL or Firebird?

I have no idea about what you mean by "remote queries".

Re:Quality issue

[gothfox]

Qualitywise, MS SQL Server is the IIS of the database world.

Sorry, MySQL is the IIS of database world. And not even IIS6, it's like IIS4 or something like that. MS SQL is actually a solid and robust product, one of Microsoft's best (our company uses DB2 almost exclusively, but we experimented with MS SQL and results were very good).

Those two are even starting to nibble at the heels of Oracle in some contexts, unlike MS SQL.

Man, this is so funny what you just said. You probably don't even understand how actually funny it is. MySQL nibbling at Oracle, muahahahaha.

Great news, but keep in mind ...

[oztiks]

This is really good news for the OS community, it shows a community product being chosen over a commerical application in the industry.

But keep in mind just because the server is not IIS and is Apache doesnt mean they arent running Windows Apache, I find lots of Windows admins leaning to Apache even when they have IIS readily available.

Re:Actually...there wont be a blog domain

[mikek3332002]

There will never be a .blog TLD because
(1)It will probably contain porn so the chritian extremists would partitions the US to ban it,

(2) The free speech supports would also want it banned because it could allow goverments to ban blogs just like http://slashdot.org/article.pl?sid=05/10/25/235524 3&from=rss

Just need to check

[peterpi]

I'm just updating my fanboyism and I need to check some figures.

• IIS' 20% market share is rubbish.
• Firefox's 10% share is the greatest thing evar.

Re:Just need to check

[Anonymous Coward]

IE comes with Windows, Firefox requires a download and install. That's a lot of innertia to overcome.

IIS has centralized marketing, Apache's dominance had very little to do with marketing until a few years ago.

There's certainly no arguing the fanboy dominance on /., but your two data points are not so rediculous as they may seem to some.

Re:Just need to check

[birdowner]

True. But IIS is fairly stagnant (sometimes dropping) and Firefox is fairly stagnant (and mostly rising). The difference is greater in countries where choice is available: Germany, for instance.

IIS? Are you sure?

[Anonymous Coward]

I know of at least one ISP who makes their Apache webservers identify themselves as a version of IIS so that they can read the logs and monitor what sorts of requests might be breaking the real IIS servers they share bandwidth with.

Re:IIS? Are you sure?

[petermgreen]

even with apache identifying itself as apache you STILL see requests that are targeting IIS security holes. It seems its easier for attackers to just fire at as many hosts as possible rather than checking them first.

Re:IIS? Are you sure?

[Anonymous Coward]

I know of at least one ISP who makes their Apache webservers identify themselves as a version of IIS so that they can read the logs and monitor what sorts of requests might be breaking the real IIS servers they share bandwidth with.

For even better effect, insert the following into your .htaccess or httpd.conf, and name all your php scripts with a .asp extension:
AddHandler php-script asp

Re:IIS? Are you sure?

[HermanAB]

Like this (http://uptime.netcraft.com/up/today/top.avg.html) : www.windows-sc.necsoft.com 102 1267 1310 1310 BSD/OS Microsoft-IIS/5.0 Running MS IIS on BSD - Duh...

Re:IIS? Are you sure?

[ajs318]

I have found a company apparently doing exactly this: Initial CityLink.

When you visit the link http://www.city-link.co.uk/track_parcel/track_parc el.asp, the server wants to set a cookie. The name of the cookie is PHPSESSID.

"Is that so"

[Rolf Tollerud]

This Netcraft statistic is comfort drug to the Slashdot's unwashed masses. If you instead count only real servers own by the company (dedicated servers) IIS is 4-5 times more used then Apache. To bundle 500-1000 different IP customers together on one computer distort the statistic. But Slasdot is never known for reason, logic and common sense of course.

"Allow me to laugh"
Rolf Tollerud

Re:"Is that so"

[waamaral]

You do realize IIS can also serve several domains with a single install, right?

Re:"Is that so"

[shawn_f]

Um, you are missing the point...IIS can only handle one domain per "real server". Apache can handle 500virtuals and a bowl of cereal to boot. Counting your way, Microsoft would always win due to them creating this "one server / one application" tiered computing mentality that most *nix users have never come to grips with, nor ever wanted to shell out the $$$ for it...

"Sing to me, Goddess, of the wrath of Achilles, Son of Peleus...

Re:"Is that so"

[MicroSharmuta]

Must've used the XP or 2000Pro Version of IIS. Artificial restriction to 1 web site and 10 concurrent connections. How would anyone use it if there was a single server limitation on the Server versions...

Re:"Is that so"

[Anonymous Coward]

We run hundreds of domains off a couple IIS servers. Your comment IIS can only handle one domain per "real server". is outdated by at least two revs of IIS. When IIS 4 came out, Virtual Servers were supported, and you could then host multiple domain names per IP and web server.

Oh, and IIS is Y2K compliant too, in case you missed that (which probably happened in the same timeframe!)

Re:"Is that so"

[Anonymous Coward]

We run hundreds of domains off a couple IIS servers.
Why?

Re:"Is that so"

[tepples]

You do realize IIS can also serve several domains with a single install, right?

True, but given identical hardware, Apache HTTP Server running on Linux or BSD can serve more parked domains per machine than IIS on Windows can.

Re:"Is that so"

[jbplou]

Are you on crack, you can place multiple domains on IIS. If you are going to make points about one product being better than another atleast know what both can do.

Re:"Is that so"

[shawn_f]

No, I don't smoke crack...of course you can put multiple domains on IIS. My point was that IIS is incapable of handling more than one domain at a time per box...load a few sophisticated web applications, and you need a monster of a box, or several...also, IIS does not do well on servers that have more than 2 cpus, so another limitation...

and so on, and so on...

Yes, I do know about the product, you just misunderstood my response it seems.

Yay!

[Kranfer]

Apache is doing awesome, however now that Microsoft is second, expect to see the commercials on TV:

"Is your host using IIS? No? Is it using ASP? NO?! Are you using OPEN SOURCE! (Evil sounding) opeeeennnn sourrrrceeeee.... If so you need to experience IIS! With its ability to make your developers coffee in the morning, and to block users who use that evil Google software from hacking your system! Call 1800MICROSHAFT today to get your free 12 minute introductory offer to IIS! Thats right TWELVE minutes folks! Microsoft nevers gives away free time on any of their products! During that 12 minutes you could host your own Porn site, or just blog about stupid stuff no one cares about, all using asp .net and a cheesey Access Database. Call today!"

Yay for Apache, but I really do think Microsoft will cause some issues on this and start pushing their stupid server software. While I do think IIS is easier to setup I think Apache is MUCH MUCH more stable. (experience with Tomcat and ::gasps:: JSP!)

Re:Yay!

[John Nowak]

Ah yes, just want I wanted... Another American appoximation of irony.

Re:Yay!

[Anonymous Coward]

to block users who use that evil Google software from hacking your system!

Indeed, inurl:asp inurl:article_id is one wicked google query! But what are they gonna do? Block requests that have google in the Referer line? Not a bloody hell efficient, just copy-paste the URL from google into the location bar, and no trace in the Referer

your free 12 minute introductory offer to IIS!

... and during the next 12 minutes, some kind hax0r will introduce your IIS to a new friend: Mr B. Goatse!

During that 12 minutes you could host your own Porn site,

And if you don't do it yourself, some friendly neighborhood hax0r can do it for you...

all using asp .net

Ha!

and a cheesey Access Database.

Actually, believe it or not, Access is less insecure as a database than SqlServer.

SqlServer conveniently allows to concatenate queries, which means that you can pickyback those ' update articles set article_deck = '<script>window.location="http://goatse.ca/"%3B</s cript>' -- requests into almost any URL parameter.

Access on the other hand doesn't allow you to sneak in an update into a select that way, it doesn't allow to read msysobjects so the only way you can get access (no pun intended...) to the web site is to find a login box and login as ' or 1=1 or ''='. Which is much more cumbersome, as most ASP sites don't unfortunately have an obvious administrative URL.

Rumors are however that Access does interesting things if you give it a pair of pipe symbols, but I've never seen this working though...

Re:Yay!

[Sweep The Leg]

Generally in .NET people don't use dynamic SQL, they use stored procedures. In fact in some cases it's harder to do dynamic SQL. If you're not running your site with at least parameterized, escaped, dynamic SQL if not stored procedures you need to just shut it down anyway. *Waves at all the PHP sites running badly written scripts out there*

Re:Yay!

[ArsenneLupin]

If you're not running your site with at least parameterized, escaped, dynamic SQL if not stored procedures...

You know that. I know that. But does the average Microsoft code monkey know that? Most probably not! If they'd been that computer-smart, they wouldn't have chosen Microsoft...

you need to just shut it down anyway.

That's what they'll do eventually, especially after their site has been linked from Slashdot. But quite often, even the notoriously slow Slashdot editors manage to be faster than the operators of these insecure sites, and just remove the link....

*Waves at all the PHP sites running badly written scripts out there*

PHP is usually not subject to SQL injection because:

• The gpc_magic_quotes setting, which is disabled by default, automatically escaped quotes, foiling a great number of SQL injection attacks.
• The databases used most often with Php (MySql, PostgresSql, Oracle) do not allow to concatenate several statements in one request.
• Php in its usual configuration doesn't tattle valuable database error messages back to the browser.

Domain registrars

[miller60]

Larien is correct. The changes indicate infrastructure shifts at domain registrars, specifically Network Solutions and Namezero (as alluded to in this Netcraft post from 2003 and this one from 2001. Both briefly shifted from Solaris to Windows, and then back again.

Apache open recipe

[folababa]

well thats what you from collaboration. It has shown here that Two is better than one. Freedom is better than slavery.

Why use IIS?

[vhogemann]

Now, I'm not trying to be a troll. I just want to understand the reasons that make someone choose IIS over Apache, since (AFAIK) the later is more secure, more capable, and performs better under heavy load.

Can anyone point me some?

Re:Why use IIS?

[Anonymous Coward]

Now, I'm not trying to be a troll. I just want to understand the reasons that make someone choose IIS over Apache, since (AFAIK) the later is more secure, more capable, and performs better under heavy load.

Can anyone point me some?

Sure! Microsoft can:

For reasons, see these case studies:
http://www.microsoft.com/windowsserver2003/iis/eva luation/casestudies/default.mspx
- better uptime
- better TCO
- easier to maintain
- more secure
- improved leveragement of potential monetizement of business platform migration plan total cost of... (bribes)

To migrate from Linux/Apache to Windows/IIS:
http://www.microsoft.com/technet/prodtechnol/windo ws2000serv/technologies/iis/deploy/rollout/lapa2ii s.mspx

There!

Re:Why use IIS?

[Anonymous Coward]

Actually ISS is much more secure than apache. You have it backwards.

Re:Why use IIS?

[ooh456]

Here are the top 10 reasons people choose IIS over Apache:

10. Because they don't know what they are doing.
9. Because their customers don't know what they're doing.
8. Because they are partnered with MS.
7. Because they are racist against Native Americans.
6. Because they get some orgasmic thrill from spending money on slower, inferior products and services.
5. Because the same reason they use Hotmail over Gmail.
6. Because they are really using Apache... but configure it to report itself as IIS to confuse attackers.
5. Because they are originally from another dimension where IIS works better than Apache.
4. Because they were playing a practical joke on their users and then died suddenly.
3. Because they are brainwashed from listening to too many Steve Balmer speeches.
2. Because really all those IIS servers out there are just Microsoft's own servers trying to keep MSN.com running.
1. Because they smoke a lot of crack.

Re:Why use IIS?

[ggeens]

One word: ASP.

Many corporate sites start of as a set of static pages with a "Contact us" web form. ASP is typically used for that as it requires only minimal programming effort.

Later on, when more dynamic content is added, they will often stick with IIS since they already know it.

Re:Why use IIS?

[ajs318]

ASP requires only minimal effort? HAH!

PHP requires just as little effort if you turn register_globals back on.

It's only insecure if you let it be insecure. Blindly doing an iteration such as

foreach ($_POST as $i => $_) { ${$i} = $_; };
foreach ($_GET as $i => $_) { ${$i} = $_; };

is really no more secure than having register_globals turned on in the first place. The real insecurity came from the order in which the variable sources were processed; by default a query string in a GET request would clobber a session variable. Doing GET first, then POST, then cookies and finally sessions fixes it {although you can't do some nifty tricks which are useful for testing}. So my preference is

variables_order = "EGPCS"
register_globals = On

which gives me the best of both worlds; I'm not cluttering up my code reading form variables out of globals, but neither is it possible to override session variables with a query string.

Beside which, there is nothing quite so insecure as the fact that any PHP script running on the same server can fopen() any file in any other user's webspace -- and some cheap hosting companies really are stupid enough to use the same login and password for Linux login and MySQL database. And on Mandrake {not that anyone uses that in a serious hosting environment}, it was the default for any user to be able to use `poweroff` at the command line. I wonder if that included, or still includes, the Apache daemon's user? :)

Re:Why use IIS?

[Anonymous Coward]

Because Microsoft rewrote the entire thing from scratch two years ago, and in that two year time only two vulnerabilities were actually found with it. One was with WebDAV, which isn't installed by default, and can cause a DOS of the site. The other is with cookie handling in a dynamic site which may lead to information disclosure, but which is easily worked around. While both exploits are remote, neither allow a person to take control of the server in question.

Apache 2.x has had more vulnerabilities in the last month than IIS has had in the last 24, so that shows which is more secure. And for those that don't agree that IIS 6 has only had two vulnerabilities, actually read the damned vulnerability report. Windows Media Streaming services is not IIS 6. It's not installed with IIS 6, neither by default nor optionally. A vulnerability in a service which may use IIS 6 is not a vulnerability in the underlying platform.

As for performance, in the rewrite of IIS 6 Microsoft took a page from Tux and added kernel level queuing and caching. This increases the speed at which static content is served tremendously. In the dynamic market ASP.NET is anywhere from four to ten times faster than ASP, but more interestingly has built in health monitors to address potential programming problems with the site. The entire worker process serving the site can be recycled to reclaim resources if a threshold is triggered, and pending requests are not affected by this as they are maintained by the separate queue engine. I don't have any real benchmark numbers. It appears that specweb has fallen out of favor lately as the number of benchmark reports in general has declined rapidly in the last few years.

Where the latest versions of IIS are concerned, people will be wise to remain wary, but to immediately brand the successor with the ills of the predecessor is inappropriate. Microsoft listened to Gartner and everyone else and redeveloped their product entirely, as well as don't install it by default, nor install any dynamic features by default when it is being installed. The result, as I said, is two vulnerabilities, neither of which allow a remote user to obtain system access, in two years. I would say that they did a pretty decent job, held to any standards.

Re:Why use IIS?

[Anonymous Coward]

Here's how we ended up with IIS:

We started business in the mid nineties on a shoestring and a Visa card. We went into small and medium sized businesses, and helped them get "onto the internet" - email, browsers, a network link, a router, a website. We went with a non-Microsoft suite whenever we could get away with it, having the normal bias against them.

We recommended and installed Netscape Browser. We got burned by that one.

We recommended pop mail. People wanted more. We got burned by that one.

We hosted some very simple websites on a Linux machine. We went through a major growwth period, and found out that it was VERY difficult to find tech people for a small, under-funded business to hire that knew Linux. Everyone knows windows. Co-ops often don't know Linux (or didn't in 1997). We had a handful of Perl sites that died and no one could bring them back to life. Good techs were out of our price range.

We started building new sites on ASP and Windows. It was brainless. Low cost people could build them and maintain them. At one point, the partners got together and decided that we would never again "bet against Bill Gates". (ok, we were really drunk when that line came out, but it's been said in numerous meetings since then.)

Ten years later, we have pumped more than ten million dollars of sales through this business, and we have a huge Microsoft web application business. Do we like Microsoft? No, most of our employees hate MS! But it pays our checks. Half the staff reads Slashdot (Hi Guys! Get back to work!) and all of them are anti-MS guys. But it pays the bills.

We have a few non-MS projects underway, but all are experimental. We get RFP's that SPECIFY "must be Microsoft platform" (I'm working on one right now - or I *should be*). Three years ago, we would get "Linux preferred" proposals... and now, from the same companies, it "must be Microsoft".

Follow the money!

Re:Why use IIS?

[Rolf Tollerud]

The real reason people choose IIS over Apache?

That I can tell you:

Because they are serious contract consultants in mission critical enterprise business and not Slashdot teenagers.

"Many smaller company websites are hosted by service providers running Linux servers even if the company itself isn't".

Microsoft ASP.NET and IIS Serve Majority of Fortune 1000 Sites http://www.techweb.com/showPressRelease.jhtml?arti cleID=X333718#_

Microsoft Leads Port80 Web Server Study According to the survey, 53.5 percent of the sites surveyed ran Microsoft IIS. This was more than double the 19.3 percent running Apache.
http://thewhir.com/marketwatch/mic030304.cfm

"Microsoft seems to be winning its war against Linux" (Info-Tech Research Group) http://linux.slashdot.org/article.pl?sid=05/05/21/ 1318229&tid=109&tid=106

Slashdot = "preaching to the congration"

Rolf "get the facts" Tollerud

Re:Why use IIS?

[Billly Gates]

Think corporate ... actually think american corporation mindsets?

They want to support only one platform that everyone is trained to use. Now which company do you think that is?

Revised (serious list) from the other guy posting ...
1.) Corporations already have Visual Studio.net and guess what? It includes C#.net. Now which webserver do you think it runs on?
2.) IIS is already included on the cdrom with windows
3.) MCSE's know how to or could learn how to use IIS
4.) Nobody ever got fired for using Microsoft software
5.) PHB's love Microsoft
6.) Most intranet environments use ASP and IIS anyway as visual studio is widely used and deployed. So their programmers are already trained.
7.) Geeks use Windows at home so therefor are familiar with Windows
8.) People who make decisions on software usage read glossy brochures with buzzwords and dont read /. Infact many could just be like this guy.
9.) There is a false believe that using Microsoft would equal a fully integrated platform where everything works seaminglessly and TCO is lower.
10.) There is some minimial integration with things like using NT's PDC database (IISAM??) to authenticate users. (Note I do not run IIS nor am I a programmer)
11.) They smoke crack :-)

Mind you I am not saying the 10 reasons are correct. But rather its what corporate america believes to a large extent and choses IIS over apache. Real hosting companies and individuals happen to know better otherwise. :-)

Re:Why use IIS?

[Anonymous Coward]

Oh, so you're trolling here too, eh?

Why don't you just realize that nobody cares about you anymore? You're trolling technique is so stupidly transparent and 90'ish it's not even funny to ridicule it. It's just boring.

Crawl back under your .NET-rock and be content with what you have.

Twit.

Re:Why use IIS?

[ooh456]

Yeah, your mom had you using IIS and that's why you're so slow and insecure.

IIS

[Fls'Zen]

Maybe Microsoft will finally give in and make WSUS run on Apache.

mod Up

[Anonymous Coward]

the chaanel to sign and exciting; Influence, the best. Individuals

Re:mod Up

[Anonymous Coward]

goat.cx has a relatively dull picture of a pumpkin. For the real McCoy, use goatse.ca, or just hit a random ASP server near you ;-)

Not Yet Ready for Primetime....

[Anonymous Coward]

I just dont think that Apache is ready for primetime yet.... Happy hour maybe, but definitely not primetime.... :-)

Mod down: unsubstantiated claim

[ArsenneLupin]

If you instead count only real servers own by the company (dedicated servers) IIS is 4-5 times more used then Apache.

Care to quote the source of this blunt claim? While it is certainly true that many domain-name parking services use Apache, Apache would still lead by a large margin even if those were accounted for.

Re:Mod down: unsubstantiated claim

[Anonymous Coward]

Care to quote the source of this blunt claim? While it is certainly true that many domain-name parking services use Apache, Apache would still lead by a large margin even if those were accounted for.

Care to quote the source of your *own* claim? Or some evidence?

Re:Mod down: unsubstantiated claim

[Anonymous Coward]

Yeah i very much doubt this, i've worked development and hosting for a while now and i've noticed a few things, one of which is that big business love the reasssurance of using .NET because it means they can get some "dime a dozen" programmer to write applications (not to say there arnet any good ones out there its just very overly prescribed these days) second its supported by microsoft and that makes managers feel better about themselves (oh one day they'll learn :P).

I can also safley say smaller businesses dont touch .NET and therefore lean to the cheaper alternatives. Furthermore, the most prized product both in EV1 and ThePlanet is the sale of the linux boxes with their arrays of control panel software, on top of that there is Virtuozzo / Xen / UML / Vserver (the list is practically endless) of virtual server software that focuses on selling linux+controlpanel based packages for companys to resell hosting from.

Dont get me wrong though Microsoft based hosting is a strong market these days in the hosting world but for most Avg Joes out there they dont really care what platform it is unless they need to run .NET or ASP apps for a specific reason.

On top of this 90% of the hosting providers love linux+cpanel blends far too much because of their cost effective nature, no SQL licencing, no .NET framework costs, not having to buy Windows licencing, and also there is billion security hardening companies on WHT (www.webhostingtalk.com) who will arm you too the teeth in security and manage this security for you on a regualar basis.

Simply put its much easier to be a linux hosting company rather then a windows one these days sadly because of just how easy these control panels apps make things there alot of hosting businesses out there dont really know a hell of a lot about linux..

The hosting industry is linux dominant and it can be seen by what the biggest product range most dedicated server companys these days carry. Also if the hosting reseller company doesnt sell linux hosting as their product they'll most likly be running a *nix server somewhere in the background routing packets or acting as a firewall or fileserver ... and it just sits there and hums away while the windows boxes around them get rebooted and rebooted and rebooted, and formated, reinstalled, then rebooted and rebooted and rebooted :))

Apache share *INCREASED*

[krygny]

"Although relative share fell by 0.67 percent, the total number of sites powered by Apache grew to over 52 million."

From September to October, Apache's share went from 69.15% to 69.89% (+0.74%).

Re:Apache share *INCREASED*

[cakesy]

Yeah, but from October to September, Apache's share went from 69.89% to 69.15% (-0.74%).

Makes you think, doesn't it?

Meanwhile, back in the "real" world

[tim_abell]

Sure it would be interesting. Could you propose a method of collecting this data?

Perhaps while your at it you could tell me which the visitors to my website are loaded and gullible!

Oh, and just in case my sarcasm is misdirected, do you mean the total number of pages available on each website (which becomes fuzzy with active content), or do you mean how many page requests have been served by each server on the net?

Logical Target

[soloport]

Look. Apache is targeted by all the script kiddies because it's SO popular. I mean, if you were a script kiddie and saw such a huge target as Apache, compared to the IIS install base, which one would YOU go after? You IIS *zealots* are a big turn-off to the rest of the web serving community.

Re:Logical Target

[Anonymous Coward]

I mean, if you were a script kiddie and saw such a huge target as Apache, compared to the IIS install base, which one would YOU go after?

Crap. All IIS runs on Windows. Only Microsoft build IIS. Not all Apache run on Linux, get built my the same people or run the same version of libc. IIS is still the largest uniform target.

Re:Logical Target

[cnelzie]

Haha! You funny.

    Anyway, if you know your crap and are out to compromise servers, then you can easily determine what kind of server Apache is running on. If you then really know your crap and compromise that Apache server, chances are you have a very powerful OS via some form of UNIX for which to direct new attacks from.

Re:Logical Target

[Anonymous Coward]

Your argument is screaming from the logical torture you're putting it through. I hope you get some kind of reward for thinking that way - it would sadden me greatly to learn your brain actually does that sort of thing naturally.

Re:Logical Target

[pellenys]

Que? Very powerful OS? In what way does it help you attack remote systems in a more destructive way than with a non-UNIX OS like Windows? If 'power':

= number-of-CL-utilities-included then this isn't an issue because the compromising payload would include the missing functionality anyway.

= Network or system performance under load then the benefit is negligible

= position on internal company network then it doesn't matter what OS it is

= ability to kill Spiderman then I concede.

I'm obviously missing something: could you explain?

Re:Logical Target

[cnelzie]

See This

Re:Logical Target

[pellenys]

Ah. I didn't realise!

Re:Logical Target

[cnelzie]

Actually, there's a significant number of updates that can applied to a compromised server, without rebooting the server. Thus enabling the cracker to "lock-down" the server to keep others from cracking what he/she has already cracked, without necesarily alerting the administrator of the server. For most important Windows security patches, there is still a need to reboot the machine, which could cause a noticeable lapse of service, enough for an Administrator to perhaps investigate the cause.

Re:Logical Target

[pellenys]

Mmm although I would suggest that the cracker is unlikely to invoke a security update. If it's a web server of a vaguely high profile (as opposed to a dusty Pentium on an ADSL line serving Bugzilla in someone's shed, as an over-described example) then you would hope that the administrator in question keeps an eye (or clamp) on traffic heading out of the server anyway. This should be particularly robust on the more conscientiously user-locked environment of a UNIX server (Admin ineptitude excepted).

For purposes of attacks on other Internet hosts, I guess that a static IP-ed server is too easily traced anyway. Much better to use a dronebot hive of unfirewalled moving-IP Win98 PCs.

Re:Logical Target

[kai.chan]

Absolutely. According to Microsoft's logic, malicious people are targeting the biggest install base, causing the biggest player, Apache, to have all sorts of security problems. Oh wait, no it doesn't.

Morale

[Anonymous Coward]

Fair observation. It's got something to do with the OS community's need for high morale. We need to feel like we make a difference in the face of a company that spends millions of dollars on strategies to discredit us.

50 million apache powered websites...

[MadJo]

...let's slashdot them.

Why is apache so popular?

[Some Random Username]

Not that there is anything particularly horrible about apache, but alot of sites could use something smaller, and less of a memory hog like lighttpd. But yet they use apache anyways "cause we're using linux", as if the only webservers that exist are apache and IIS.

Re:Why is apache so popular?

[SumDog]

Because most of the tools we use for web development work and are actively maintained on Apache. mod_php, mod_perl, mod_ruby, etc. Sure you can use these via CGI with any web server, but the in process execution makes them more convenient to use.

Apache has turned into a de-facto standard. People can expect security updates for it, and the large user base insures its longevity. With any major piece of software, there are always better alternatives. But still, people use sendmail, even though we have postfix and qmail. People use bind...

Apache works, is solid, scalable and is supported by many languages and many people. That's why most people use it.

Re:Why is apache so popular?

[Some Random Username]

Actually, I found that having the language mashed into the webserver was a bad thing. PHP, perl, ruby, python, java, etc, etc, etc all can do fastcgi. This gives you persistant apps, just as fast as if it were in the webserver, but without the ability to crash your websever, running as seperate users, and with the ability to do things like store persistant objects without having to do anything special at all. Even just simple things like using persistant database connections without having to have one connection for every apache thread/process is really nice. I don't want a database connection open just to serve a static file.

Lighttpd works, is solid, scalable, and is supported by many languages and many people. Its also has a much smaller footprint than apache, and some cool modules apache doesn't have alternatives for. So why don't most people use it?

This just in

[Peeptophe]

IIS passes 5 Trillion crashes mark.

Netcraft is so inaccurate

[SumDog]

The problem is that I know many system administrators that change their server's response to be Apache even though it's IIS. By the same token I know several Apache servers that respond as IIS and are used as honeypots; their logs are parsed for several known exploits and worms.

People have always mentioned this problem with mining for server usage statistics. What does netcraft do to try and filter out a lot of these false statistics? Is there any thing they can do? Is there any other way to identify a "true" Apache server? I can't check for the existence of php or aspx files because both IIS and Apache support both (aspx via mono).

If you were developing a new statustics mining server for determining service types on the internet, what would you use to identify the "true" Apache/IIS servers?

Re:Netcraft is so inaccurate

[Alioth]

There's no point spoofing your identity: any hacks/scripts/worms etc. do NOT check it - they try the exploit regardless of what the server reports itself as. That's why your Apache log (which is reporting itself as Apache) is full of attempted IIS exploits. Skript kiddies and worms _do not check_.

Make me proud

[monklegacy]

Numbers like that can make a developer proud.

Or scared, if they know something is wrong. ha ha ha

Re:Quality issue ... ?

[Anonymous Coward]

How this post got modded Insightful, mysql and quality? Mysql starting to nibble oracle? What a joke really.
Mysql is all but a database ffs access is a better relational db than mysql, and it's really far from being entreprise ready unlike MS SQL / oracle and in a lesser extend Postgresql ( thing are slowly changing for postgresql happily ). .Net / IIS / MS SQL plateform is much better than LAMP and arguably ( well not for my part, but I will stay open ) to a J2EE plateform.
Not only with .Net you have everything you need or almost in the API ( paging for one of the many exemple ), but it's opened enough to add what you want unlike LAMP or J2EE where you have to code everything from 0 unless you want to have some fun with licence hell( hey let's take this code in lgpl, oh and this one in BSD, oh nobody will see that I will take GPL code ).

you forgot Apple

[toby]

and their 5% (?).

well

[Anonymous Coward]

if they count subdomain as an another server, no wonder really, hello livejournal, every fucking blog out there!

M3-Lite.

[Anonymous Coward]

M3-Lite

"3 SERVERS IN 1

First, it is really 3 servers in one. Besides serving up the ANSI Standard M Language, it also provides M database services to other software packages through ODBC or standard socket connections. Perhaps most exciting of all, it contains a complete web server, robust enough to put your Apache or MSII server out of business. And forget about CGI or various web server API's to link your database to the web -- you have a direct connection.

SMALL IS BEAUTIFUL

We hope that you will be pleasantly surprised at how small and quick it is. We have been actively fighting the "software bloat" that seems to have taken over and you will be glad to notice that it can be downloaded from our web site in just a few seconds. At only 76K, it's actually smaller than some web pages.

This "smaller footprint" translates into faster startup and shutdown. With almost instantaneous startup, there is no wait. It means less code space that has to be loaded in RAM which yields more memory for disk and routine caching."

Why is apache marketing so successful?

[Anonymous Coward]

"So why don't most people use it?"

Marketing.*

*It's amazing how much this is discounted. As though technical merits is all you need to be successful.

22 days old?

[Laaserboy]

From TFA:
Posted by wss at October 4, 2005 08:40 AM

Which means that the news is 22 days old. Given that this is a monthly survey, the slashpost seems a tad bit behind the times.

One of us should write a bot that posts a story 21 days after the fact and see if we can beat the masses that happen upon Netcraft and re-print old news.

Lockup License?

[Anonymous Coward]

"As much as I admire all that hard work, I simply don't feel confident that I personally could go to such extreme lengths just to prevent code that I wrote for the benefit of all humanity from being locked up. Other people get to exercise their rights because I live up to the obligations incumbent upon me."

Funny how non-GPL code can be "locked up", but every time Slashdot does a story on the RIAA/MPAA there's always a comment(s) about how "their information is going to be freed", or "everyone has ideas". Either digital goods can be locked up, or they can't. You all can't have it both ways.

Big clue stick for you. Non-GPL code can't be locked up. The only thing that's "locked up" is the code that the "locker" writes themselves. The original code is only a FTP away. Here's the other side of the stick. The GPL allows one to effectively "lock-up" all the code they download AS LONG AS THEY DON'T DISTRIBUTE! That means that one can gain a business advantage indirectly. e.g. company runs more efficiently. Also (until the latest GPL comes out) one can present GPL code as a web-service without distributing. And last, as Nvidia and others have shown one can gain open-source advantages without giving away one's code.

So basically the "lock up" excuse really is a "They will not Gimme! Gimme! Gimme!"

Re:Lockup License?

[QuantumG]

I wrote a rant about the BSD vs GPL debate a while ago. You might find it interesting (not that you'll come back to read this comment as you're posting anonymously so I'm just wasting my time).

I'l bet that 49 million of them...

[callipygian-showsyst]

I'll bet that 49 million of them are virtual domains on the same server with names like make-money-fast-heres-how.info investment-secrets-2005.info splog-world.info, etc.

Domain Registrar

[drasfr]

Yup. I can confirm this. I used to work at a major domain registrar, using Linux/Apache and Microsoft visited us and asked for us to migrate our servers to Window/IIS for the sole purpose of increasing the netcraft numbers... We were doing URL forwarding. By the way, the conversion was VERY painful... even though they engineers came on site to work on the code for this.

Lockup License?-Reply.

[Anonymous Coward]

My being an AC has nothing to do with coming back. Anyway I read your rant, and I don't agree. Now as far as a rebutal...well just wait till the next GPL/BSD debate (we'll have one soon enough), and post your link.

Re:Lockup License?-Reply.

[petermgreen]

My being an AC has nothing to do with coming back

registered memebers by default get an e-mail notification which means they are very likely to come back. Unelss they've bookmarked the post ACs will only come back if they happen to read through the articles comments again and spot thier original post.

and even if an AC does come back noone else can tell if its really the original poster or not.