Slashdot Mirror
The Setup Behind Microsoft.com
Toreo asesino writes "Jeff Alexander gives an insight into how Microsoft runs its main sites. Interesting details include having no firewall, having to manage 650 GB of IIS logs every day, and the use of their yet unreleased Windows Server 2008 in a production environment.
My blog
How can anyone complain that they're running Server 2008? My company's software quality dropped considerably when we stopped eating our own dogfood two years ago. When techs, engineers and everyone else is stuck with the same problems as the future ell-users, shit gets fixed a lot faster and a lot better.
FTA: "Router ACLs are in place to block unnecessary ports" While that might not provide SPI and other benefits of a true firewall, it's still a hell of a lot different than plugging a box into a wide open connection.
How many times have you seen the microsoft.com website down / hacked?
Reliability in numbers. If you have 30 machines running your website, no one will notice if one goes down.
- oZ
// i am here.
Windows Server 2008 is (or rather, will be) effectively "Windows Vista Server Edition", just as Windows Server 2003 is effectively "Windows XP Server Edition".
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
It's called Alpha testing in this case. It's good marketing on their part to say, "We're so sure our software is good we use our pre-Beta software in a production environment." Never mind the fact that they have Server 2003 waiting ready to take over when their 2008 server horks itself.
Let's set aside the natural urge to bash MS into oblivion. Let's (just for now) ignore conventional advice about network security and firewall use. Now, not only are these guys a Microsoft shop...they ARE Microsoft. MS claims their software is stable and secure. Perhaps it is -- when was the last time microsoft.com was taken down by malevolent hackers?
That said, with their closed source and closed-doors policy to revealing details about the inner workings of the OS, _Microsoft_ may be the only company that can successfully deploy a 100% Microsoft powered solution. How many registry changes, service daemon modifications, and other tweaks have been made to get their config running this way? The world may never know. It's probably impossible for the consumer world to ever have that level on knowledge about the Windows environment, and thus run it at peak security levels. For most consumers and businesses, a Linux OS with properly implemented firewalls is much more secure than an out-of-the-box Windows deployment and router ACLs.
khasim (12/9/06): In a blind taste test, more people preferred Coke over the Pepsi that I had previously pissed in.
I was assuming he meant Host Based Intrusion.
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GIT d? s: a-- C++++ UL++++ P++ L+++ E- W++ N o-- K- w--- O- M+ V PS+ P
Isn't that just you announcing your ignorant of which tools to use? Are you that kid in gym class that was always trying to put his shoes back on without untying them, rather than take the seconds to untie/re-tie he'd stomp himself around the locker room for minutes until they fit right. Oh and, how long would it take you to create and print a tri-fold pamphlet using sed? Perhaps you're the problem, not the app.
Using router ACLs to block ports is pretty much the same thing as using iptables on Linux to filter ports. So, IOW, yes, blocking unnecessary ports on a router means that the router is a firewall. Something is filtering packets and even if it's called a router and not a firewall, that's the function it is serving.
If it walks like a duck and quacks like a duck...
My blog
Cisco Guards for DoS detection and automated response In other words, they don't use firewalling where you have administrator defined rules to control traffic flow, they use networking equipment that accept administrator defined rules to control traffic flow
What in the world do *you* perceive the difference being between a 'firewall' and a router blocking ports based on source and destination being compared with a set of rules (aka ACLs)? Generally, firewall rules *can* get more complex than that, but mere port blocking by an intermediate router has been considered a firewall, even if it doesn't log violating or accepted packets, even if it doesn't have complex rules about connection state. Even if it doesn't have the word 'firewall' emblazened on the chassis somewhere.
XML is like violence. If it doesn't solve the problem, use more.
In order to apply the 'ACLs' they describe, they *have* to inspect the packets, by definition. They may only compare a relatively small number of fields (src ip, dst ip, make sure it is a TCP packet *and* the destination port is 80). They might not make use of any logging or stateful inspection (then again, stateful may add next to nothing, so long as they don't need to contact external servers for any updates), but that doesn't mean they can get away with saying 'look, no firewall!' All he's saying is that port 80 (and maybe a few other hand selected ones) are 'wide open' (except something else blocks DoS for them even on those ports). Honestly, I doubt you'll find many public web services that puts a more restrictive 'firewall' than MS just confessed to having in an article where they declare 'no firewall!'
XML is like violence. If it doesn't solve the problem, use more.
Actually you're wrong. They're blocking ports. Port blocking != firewall.
Ah, the little children. Do you know what the first firewalls were? Routers with access lists. Anything that blocks anything from going to one place from another is a firewall. Port blocking is a firewall, and there exists no firewall I know of that can't be configured to do nothing other than port blocking. You don't have to inspect packets, track flows, or any of those other things to be a firewall, all you have to do is offer some means of restricting traffic. And blocking ports does that.
Learn to love Alaska
Actually, I prefer a custom coded OS with a revision testing regimen that would make most developers and system engineers cry and a lack of bells and whistles. But what do I know, I only work in a division that supports life support systems.
In God we trust, all others require data.
Ok, but is the OS *still* organized like crap? I mean, is C:\Windows still a dumping ground for a bunch of arbitrarily named data files, log files, drivers, and libraries using, for the most part, the old 8.3 naming convention?
.NET has made this significantly less painful, because it was considered ahead of time (it's not much easier to actually manage, but that's the tools more than anything, and just takes a bit of experience.... which unsurprisingly, is what dealing with the idiosyncracies of the old systems take anyway!)
Dude, if you can't hack that right now, how are you dealing with unix instead?
If any platform's based on a standard of bizarre naming due to space saving stupidity, that's it. Far more so than windows. Infact, name any mature platform that's based on reasonable standards for it's underlying API's and structure.
Didn't think you could. While it's true that things like the FHS are helping on the unix side, try telling an oldschool developer like oracle that they need to follow it. They'll laugh. and laugh.
and laugh.
Windows is in much the same position. At least
ash
Because at least Unix has conventions.
Really? Ok, lets open up C:\Windows on one of our Windows servers. Hmmm a folder named "$hf_mig$". I suppose you know what that means or what convention that follows? Or C:\Windows\adam. Kinda looks like it might be some directory tools. Maybe ADAM = Active Directory AdMinistration? What's that doing there anyway? I could keep going down the list. I suppose there is a very good reason why there are
First of all, I was only talking about superficial organization. And if you want to see something nice, have a look at OS X some time. Not only is the System (/System) well organized, but most applications are neatly self contained in
I could give fuck-all what Oracle thinks. My Debian systems are very well organized, thank you very much. I don't find desktop wallpapers in
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death