Slashdot Mirror
The Chinese (Web Servers) Are Coming
Glyn Moody writes "The February 2009 Netcraft survey is not the usual 'Apache continues to trounce Microsoft IIS' story: there's a new entrant — from China. 'This majority of this month's growth is down to the appearance of 20 million Chinese sites served by QZHTTP. This web server is used by QQ to serve millions of Qzone sites beneath the qq.com domain.' What exactly is this QZHTTP, and what does it all mean for the world of Web servers?"
My guess on the QZHTTP thing is that they're simply sending their own banner, rather than that of their real server. It's not exactly rocket science. Anyone who's good enough to handle millions of domains can set one line of configuration I wish we had some examples. The qq.com domain itself, besides being pathetically slow, gives these headers:
telnet www.qq.com 80
Connected to www.qq.com.
Escape character is '^]'.
GET ? HTTP/1.1
HTTP/1.0 400 Bad Request
Server: squid/2.6.STABLE5
Date: Tue, 24 Feb 2009 17:17:23 GMT
Content-Type: text/html
Content-Length: 1336
Expires: Tue, 24 Feb 2009 17:17:23 GMT
X-Squid-Error: ERR_INVALID_URL 0
X-Cache: MISS from rainny.qq.com
Via: 1.0 rainny.qq.com:80 (squid/2.6.STABLE5)
Connection: close
So, I'd guess they're basing that analysis on the Via or X-Cache lines (or both)
For those who aren't familiar with the headers, this is what it looks like from Slashdot
telnet slashdot.org 80
Trying 216.34.181.45...
Connected to slashdot.org.
Escape character is '^]'.
GET ? HTTP/1.1
HTTP/1.1 400 Bad Request
Date: Tue, 24 Feb 2009 17:19:49 GMT
Server: Apache/1.3.41 (Unix) mod_perl/1.31-rc4
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding, User-Agent
I'll simpify the rest, and just show the "Server:" line.
Apache.org: Server: Apache/2.2.9 (Unix)
Microsoft: Server: Microsoft-HTTPAPI/2.0
Whitehouse.gov: Server: AkamaiGHost
cnn.com: Server: Apache
Serious? Seriousness is well above my pay grade.
Ah, what does it all mean? I dunno, are the Chinese proposing some sort of new web server protocol standard? Is there a new RFC out?
They've just called their software 'QZHTTP'. Try 'telnet qzone.qq.com 80' and 'HEAD / HTTP/1.0' and you'll see for yourself:
Server: QZHTTP-2.3
I don't think anyone's suggesting there's a new protocol here.
I don't know about malware in QQ's software, but QQ is much more than just China's answer to Microsoft Messenger.
QQ is a portal site that links to search engines and also provides users a place to create their "home" on the Internet, much like live.com and other sites.
Yes, QQ is insanely popular in China, as is MSN and Yahoo! chat.
Try qzone.qq.com rather than just qq.com.
HTTP/1.1 200 OK
Date: Tue, 24 Feb 2009 17:41:06 GMT
Server: QZHTTP-2.3
Content-type: text/html
Content-length: 1728
Connection: close
And I see that they serve up a whole html object (not just headers) in response to a HEAD request.
That's a quality implementation of the protocol right there.
nippon kyuu kyuu
demo ashita wa wandahoo
ijiwaru sarete mo
futon haireba
guu! guu! guu! guu!
pasu! pasu! pasu! pasu!
ohayou
I think you are mistaken here.
The sites in question are not qq.com they are subdomains of .qzone.qq.com
(BTW http://qzone.qq.com/ by itself does not use QZHTTP 2.3 web server software it uses Apache)
like
http://182273490.qzone.qq.com/
Here is the netcraft report for that site:
http://uptime.netcraft.com/up/graph?site=182273490.qzone.qq.com
These sites appear to be running on Linux and state they are running QZHTTP-2.3 web server software.
Yes you can edit the banner but often netcraft digs further into it then this (response times, packet information, etc) and doesn't blindly use the banner value.
It is likely to be using a modified version of Apache like Google do with their GWS (Google Web Server) software.
And thus given a separate version of web server software in its own right. So I suspect there has to be a significant changes to the normal operation/code of Apache (or whatever they have modded). It could be a whole new set of web server software but likely a significantly modified version.
Hope it helps
"Get some Cyrillic fonts" doesn't make any sense. It's not a lack of fonts that are causing the problem, it's the non-unicode character encoding (Latin-1).
It is pitch black. You are likely to be eaten by a grue.
trickle-down economics *works*.
Yeah, it got Reagan elected. As an economic theory, it's bunk - rich people are rich because they spend a lot less than they earn.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Lets just look recently eh?
Giving money to the rich in the form of tax cuts has left the economy in a great state has it not?
Frankly the naivety of folk who believe in the con called trickle down effect borders on complete stupidity.