Slashdot Mirror


User: alistair

alistair's activity in the archive.

Stories
0
Comments
147
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 147

  1. Re:LDAP is lightweight on Red Hat Opens Netscape Directory · · Score: 1

    I run some half million object LDAP servers and have the following issues with referrals.

    i) ACL Management is inconsitent. e.g.

    A client connects to server A. They bind and that establishes the branches and attributes they are allowed to access. They search and receive a referral to server B. They then connect to this server. However, the credentials are not always passed correctly for that server resulting in some unconsisency in the data to be returned. This seems to vary by server vendor but more specifically by the API being used to access the servers, what may work in NET::LDAP in PERL may produce different results in JNDI or ADSI.

    ii) Referrals use hard coded server names. When our clients access our LDAP servers we always give them a list of 3 servers (or LDAP Proxies) mapped to DNS aliases which they should access, as no one server or proxy can be available 100% of the time but in 5 years of running the service we have never had 3 servers out at any one time.

    However, if a referral server fails, that is what clients are accessing. You then have to change every server reference in the referral entries or change DNS which can take time to propagate. Maybe you can have multi valued attributes in your referral fields but not all clients and APIs will implement this.

    iii) Referrals can behave differently at different points in the tree.

    If you have a entire tree branch and you ise a referral to move it to another server this can work well.

    However, if you have, say, 100,000 people entries and then a referral to another 100,000 on a different server, different clients work differently. Some will read the first 100K entries and then the next on the second server. owever, I have found a number will follow the referral first. This also causes issues with ACL parsing.

    The above usssues are real world exaples from trying to integrate over 300 applications with the Netscape / iPlanet / SUN ONE series of Directory servers over a 5 year period, so your milage may vary. However, I think referrals should have been better specified or could do with refinement.

    Does that go some way to meeting your burden of proof? (don't get me wrong, I like them, I just feel they could do with some refinement).

  2. Re:LDAP is lightweight on Red Hat Opens Netscape Directory · · Score: 1

    Hmmm, an interesting discussion.

    I still disagree, the key points for me is that LDAP is Lightweight and provides Access to data. I think the designers of the protocols have done an excellent job in designing a protocol which is lightweight and can be extended through supported controls; we use about two of these but I know other LDAP developer who use far more and have even written their own to extend the protocol.

    What I don't think LDAP is ever good for is replicating between servers, it is an awful protocol for this and the attempts by commercial servers to use changelogs and persistant LDAP serches to monitior the changelog crude and unreliable.

    But I don't think that is what LDAP should be used for. Client to server should be LDAP, data holding server to data holding server should be whatever works best for those servers.

    I know some years ago there was some work on LDUP, a distribution and update protocol for LDAP servers, but that stalled and maybe that is what you are referring to. However, we are now moving into middleware. If we have an efficient replication protocol for sychronising databases why limit it to LDAP, why can't we bring in AD, Oracle and the rest, that would be a far bigger win which would benefit more of our users.

    But none of this is a critisism of LDAP as an access protocol, it is the fault of all vendors, open source and commercial, who provide distributed data stores.

    There is nothing to stop people who require rock solid guarenteed replication from using X500, many major vendors offer these servers and almost all of them offer LDAP interfaces. Or use Oracle or Sybase which both offer LDAP interfaces.

    But please, lets not criple LDAP's simplicity and speed by extending it to do everything. With the possible exception of DNS, a well configured and indexed LDAP server is the fastest indexed data retrieval server you can install, full stop.

    I will agree, referrals are broken but n exactly the same way as HTTP redirects are broken, the web has found ways around that and your LDAP environment can too.

  3. Re:LDAP is lightweight on Red Hat Opens Netscape Directory · · Score: 1

    Agreed, "referrals" are a hack, as were "alises" which appeared and then were dropped from the Netscape and SUN series of servers.

    However, you have to accept that this is an issue of hourses for courses. I run a global network of LDAP servers which processes tens of millions of queries per day across a corporation. 95% of our queries want to know what cost center a users is, what the phone numbers for people called "alistair" are or are used for password or token authentication.

    Referrals aren't an issue here, we just replicate all the people data worldwide. Integration with clients is, we integrate with PERL, JAVE, MS Excel and a huge range of third party vendor apps and this is hard enough with a very simple protocol like LDAP, we simply couldn't support these apps if we had to access the data with a heavyweight API.

    WRT LDAP servers implementing chaining, if this is proprietary, so what. LDAP is an access protocol, once I have access the interface on a data source my client shouldn't care if I hold the data locally, read from an alternate server or pull it from a completely different data source as long it is returned in a format consistant with the LDAP protocol. Techniques for bridging between databases, eDirectory, MS AD and standalone LDAP Directories are well understood, I don't see a major issue here.

  4. Re:Comparison on Red Hat Opens Netscape Directory · · Score: 3, Insightful

    I have used both and run both in production at a major corporation.

    In many ways eDirectory is far more sophisticated. It is more close to a true X500 directory and it has some very sophisticated tools for data replication and management. The admin console is streets ahead of the old Netscape Java Console for starters and the APIs are very well developed. It is very easy do do operations such as prune and graft on the Novell Directory than on the typical standalone LDAP directories (Open LDAP, SUN ONE) where you have to essentially delete and recreate the entry rather than just modify the base DN.

    One key differentiator is replication strategy. eDirectory and Microsoft AD are genuine multi-master directories, you can configure them to accept updates anywhere and the data then replicates among the cloud of replicated servers. Open LDAP and Netscape's LDAP are have pyramid structure replication, you update a master, it updates slaves and these can update further consumer servers. This approach can have some advantages if you want to secure updates and be able to take a consistent snapshot of your data at a particular point in time.

    Speed is also an issue. I feel that SUN ONE is currently the leader in raw search speed, Netscape produced a very fast server on the same database backend and a suspect Novell is a little slower as it is more feature rich. You will probably only notice this if you are making in excess of 20 searches per second to your box.

    So I would advise people to check out eDirectory. Novell have a great history of making some superb product which they then do their upmost to keep secret from paying consumers. If it is free it could well meet most of your needs, especially as the console makes it very easy to set up and populate with sample entries.

  5. SUN ONE not quite direct descendent. on Red Hat Opens Netscape Directory · · Score: 3, Informative

    This isn't 100% correct. SUN ONE is a merge of the Netscape Code base with the Innosoft Code base they aquired in around 2001. Both Netscape and Innosoft developed their own directory servers based around the Open LDAP reference installation. What made Innosoft more advanced was its capability for several masters (it's not true multi - master in the sense of eDirectory from Novell or Active directory but that is no bad thing).

    SUN aquired the Netscape Code in partnership with AOL and also bought Innosoft. SUNs Directory 4.x servers are the Netscape code, 5.x are Innosoft.

    Having said that I have happily tested both servers with 4 million entries on a fairly small box and run 500K entries in production. We managed uptimes of in excess of a year on some of our 4.x servers running over a million queries a day, not so bad.

  6. Re:This really makes me on Voyager 1 Crosses The Termination Shock · · Score: 1

    Hmmmm, somewhat agreed, but these things are not always binary, we can't say that if the US didn't fund a space program, they would give the world clean drinking water (and both these problems are equally hard IMHO).

    So lets applaud what each country does well and try to force change in what we do badly. Both the parent poster and I critisized the UK, and rightly so, but this story from the BBC gives me some hope and pride in my country.

    So lets take the good points where we find them and campaign to change those parts we don't (and you could do worst than starting here.)

  7. Re:This really makes me on Voyager 1 Crosses The Termination Shock · · Score: 4, Insightful

    Fully agreed, it is nice to see someone articulate this so clearly on Slashdot. All countries contain a wide range of contradictory trends in their societies but the space program stands as a lasting achievment for all of mankind and one we have to thank the US for pouring so much of it's investment into.

    The nearest we have in Europe is the European Space Agency. Now celebrating thirty years this has run some major programs and developed some excellent lauchers. Although it has a European Branding, my impression is that almost half the funding and most of the political drive has come from France, with very little in the way of contribution from the UK. If you ever get the chance and find yourself in South West France, check out the excellent Cité de l'Espace museum near Toulouse. This is easily Europe's finest space museum with a wide range of information on space exploration and the European Space Program, inclding two Skylabs to walk through and a full size Ariane 5 rocket which dominates the skyline as you approach.

  8. Re:Memory Prices (somewhat) improved on iMacs Freshened with 2.0 GHz G5, Bluetooth, WiFi · · Score: 1

    OK, but "you" still ship 256 Mb in one of the Workstation lines, surely it would make sense to ship 512 Mb in the economy workstation and 1 Gb in the larger lines, especially if you give all home users 512 Mb.

    As for my iMac, I bought it in February 2002, so you are right, it is over 3 years old rather than 4 years old. I just noticed that the 3 year Apple Care package ran out the other day so I started thinking of it as 4 years old

  9. Memory Prices (somewhat) improved on iMacs Freshened with 2.0 GHz G5, Bluetooth, WiFi · · Score: 4, Informative

    I'm very pleased to see they have finally started shipping 512 Mb RAM as standard as this has to be considered the minimum to see OS X in its full glory. The prices to go to 1GB are much better, $125 extra for 1GB using up both DIMMs and $175 for the memory in one stick, leaving you free to buy the additional elsewhere (if you need it on this level machine).

    It leaves me puzzled why they are still shipping 256 Mb on the Power Macs (why, why?). However, this looks like a very sensible feature improvement which should provide the perfect all in one home machine and stop the iMac from having their sales canibalised by Mac Minis at the lower end. Sadly my previous generation iMac, which is now 4 years old, is still running perfectly, especially now it has Tiger, so this may still be a hard sell to buy this year.

  10. Flat branches here on Deploying OpenLDAP · · Score: 1

    I have managed a large corporate LDAP implementation which has around 120,000 people in a flat branch of the tree. I have tested this to a million and have seen real world implementation with similar numbers.

    Branches of trees should be used for your replication design and security model, they were very important as search bases in X500 but much less so in a typical LDAP directory.

    Consider a organisation which has people in multiple countries. It is just as efficient to run a search from the base of people and searching on country name then to set the base as countryname and search for all people (assuming countryname is indexed)

    However, moving objects in LDAP is painful and complex. So with a flat tree you would simple rename the countryname attribute, in the deep tree model you would effectively have to delete and recreate the entry to move it (some servers are better than others, but all do this with less than optimal efficiency)

    You can still restrict your applications access to one country, either by using a filter in the ACL or using an LDAP proxy (SUN now give one away with their very useful Directory Server)

    As for replication, on some servers you can do filtered or fractional replication which can improve the effeciaency of this process by allowing only certain parts through, ofthen this is more efficient than being forced to use a replication structure by your tree (which is very hard to change once your service is established).

    The sad thing from a replication point of view in that when SUN brought out DS 5+ we lost the client request and timed replication, this certainly had its uses when you wanted to push updates out at specific times. As Red Hat have the code now I hope this is one feature they retain in their offering.

  11. Re:Don't pass go... on Google Fires Blogger? · · Score: 2, Funny
    One comment from his blog (which may not come true)
    "on the plus side, this first paycheck is going to be huge... (which unfortunately means i'll probably end up getting taxed huge on it. doh!)"
  12. Re:adios on HP CEO Carly Fiorina to Step Down · · Score: 1

    Try adding aapl (apple) to the list, follows HPs downward trend to Jan 03 and then breaks away to overtake them all (as of this month). Looks like BWJones (comment above) made a smart investment choice.

  13. Affiliates on Nanotech Brings Battery Life Extender for Mobiles · · Score: 1


    I checked this company to see if they were partners of Vend-a-Temp. Their current partner list suggests not but surely it can ony be a matter of time.

  14. Re:eMac on The Ten Worst Products of the Year · · Score: 1

    I have one of the first second generation iMacs (the sunflower design). The specs seem very similar to this and I paid about double for this when I bought it three years ago. Yet it is perfect for what I want to use it for and will probably remain so for two more years at least.

    I use it for Office (both Microsoft and Open), digital photos (iPhoto (included)) my MP3 collection (iTunes(also included)), web browsing, email and watching the occasional movie.

    After 3 years, 4000+ digital photos, 3500 MP3s and around 800 office documents the hard drive is at under 30GB used.

    I have only ever had one problem with this machine (just after it was purchased) and an Apple engineer came to my house and fixed it under guarantee.

    The eMac is sold to the education market and it seems my uses of it would be very similar to this target market. My work machine runs Linux and has a 20GB hard drive and I have happily held onto this for getting on for three years.

    To my mind this would be a perfect machine for a 3 year student course, especially given the extended guarantee is of such high quality. Compared to my recent work supplied Dell Laptop running XP which has had so many issues and is so difficult to fix almost non of my team want it (and it costs around $1800).

  15. Not a nail for Microsoft. on Failed Win XP Upgrade Wipes Out UK Government Agency · · Score: 5, Interesting

    "On another note, How did upgrading seven machines to XP BSOD 60000"

    If you read the register article, it says that they were attempting to only push the update out to 7 PCs, but it actually went to all 60,000.

    I would imagine they were using something like Microsofts SMS services or Bigfix to push out packages, and simply selected push out to all instead of a test community.

    I don't think this is a nail in Microsofts coffin, I have seen similar things happen in the mainframe world where patches intended for dev hit live production systems with similar bad consequences. It has to count as a bad day at the office for the person pushing the button though.

    It also highlights the difficulty in pushing out big updates to major networks of PCs, be they running Windows or Linux. The complexity of moving from Win NT to XP has proved so complex in my organisation that for the future Longhorn upgarde and beyond we are now looking to Citrix to allow the migrations of applications across servers and essentially use the PC as a thin client for all but core office and email apps.

  16. Apple and Open Source on Some iPod Fans Dump PCs For Macs · · Score: 1

    That may be true, but at least apple recognise this and provide some excellent developer guidelines and documentation to boot. For example have a look at

    Darwin Open Source where you can download the source and documentation for what is essentially OS X.3.6

    or

    X Open at the Source

    Apple seem to be very good at recognising the Open Source and Free Software tools they build upon, nothing in the GPL / BSD licence says they have to go to these lengths. And lets not forget the good stuff they have donated, from Darwin itself to Rendezvous to their excellent and often overlooked Open Directory toolkits, which should be of interest to far more than the mac community.

  17. Telewest are actually very good. on BT to Offer Free Internet Calls · · Score: 1

    Are BT better than Telewest? I doubt it. I have had a Telewest connection for almost 2 years now and have nothing but good things to say about it. I bought a 1Mb connection, about a year ago this upgraded this to 1.5Mb for the same monthly charge. The installers came on time and did a very professional job, all rigged up in under half an hour including a very good job of cable laying to my PC cupboard and making good.

    I have only noticed one 20 minute outage in the time I have had the service. Their customer support and billing have also been very good. I have a number of other friends who use them in London and they all have had good service. By contrast I have heard some real horror stories about BT....

  18. I stand corrected on Microsoft To Launch Homegrown Search Engine · · Score: 1

    5 minutes ago that was exactly the result, now it returns around 1,500,000 results and is looking faitly accurate. Maybe they noticed people were visiting the preview site and decided to turn the back end back on.

  19. Search for Windows..... on Microsoft To Launch Homegrown Search Engine · · Score: 5, Funny

    No Results Found

    Needs some fine tuning before it's ready for the prime time, me thinks.

  20. Great publicity on Firefox 1.0 Released · · Score: 1

    For an open source browser, this is having a fairly major impact on society at large. As a case in point, The Guardian (the UKs major left leaning / liberal newspaper) had a major editorial on the subject today, which can be read here (in today's print edition as well as online)

    As a longtime corporate Linux user, I have to say that nothing has made this more possible than having a good OS browser such as Mozilla and Firefox, kudos to both.

  21. Not a clear case on Konfabulator Coming to Windows · · Score: 4, Insightful

    I don't think it does. Apple have produced Dashboard only for the Mac, Microsoft produced IE for Windows, Mac and Solaris (seeting up a UNIX team specifically for this purpose) and then made them available free specifically to hurt a competitor. As soon as Netscape died so did those ports (and perhaps they'll appear again if Firefox takes off).

    Microsoft also threatened PC manufacturers who didn't want to include the IE browser and took measures to prevent other shipping with Netscape. They produced other products like Outlook Express and IIS and gave them away free to specifically hurt Netscape's market share. The changed the licencing from NT 3.51 workstation to NT4 workstation simply to stop people using NT workstation to run Netscape and other competing internet server products.
    The list goes on. But if Microsoft had simply produced a Web Browser and added it to NEW versions of its OS do you think there would be a case for an anti monopoly trial?

    If Apple announces Dashboard for Windows and Linux and all old versions of Mac OS then you have a valid comparison. But extending their OS in this way as part of the core OS looks to be a logical extension.

  22. Why Open Source Codes are essential on BBC Wants Help With Dirac Codec · · Score: 4, Informative

    Anyone wondering why we need more Open Source Codecs should read the excellent companion article on today's register, a long OP Ed piece on Steve Ballmer entitled Love DRM or my family starves: why Steve Ballmer doesn't Get It.

    In it Steve explains why the Digital Home has to come from Microsoft and specifically Microsoft's committment to DRM everywhere. A facinating, if biased piece.

  23. THat book.... on Car With A Mind Of Its Own -- Part 2 · · Score: 1

    The book is "Parliament of Whores: A Lone Humorist Attempts to Explain the Entire U.S. Government".

    In it he explores the "how the admirable Audi 5000 sedan came to be the favored bait in the Sudden-Acceleration Media Hack and Liability Lawyer Bottom-Feeder Tournament"

    A great read, he has a lot of sympathy with the "generally inteligent" staff at the department of transportation who investigate "Sudden acceleration syndrome" and generally conclude that acceleration occurs when you press the gas rather than the brake pedal.

    This is possibly his best book, although "Holidays in Hell" and "All the Trouble in the World" are also excellent reading.

    As a liberal (although not American) I find it a great shame that the best the American Left get is Michael Moore and the Right get P.J. O'Rourke, 1000 times more funny and more intelligent.

  24. Re:I don't get it... on Stern Will Jump To Sirius In 2006 · · Score: 1

    Benny Hill was cancelled by ITV in 1989 although he ramained popular in other contries, including France and the US. He made several shows for the US only after his cancellation in the UK. There is far more of his material available in the US than the UK (source Wikipedia).

  25. Re:correct me if i'm wrong on XAML Development Today, But Not From Microsoft · · Score: 2, Funny

    "Do I know more than you about your own language???
    Its "per se" and it's latin."

    Unless the author of the original post is around 2000 years old and dead I would suspect that Latin isn't their language.

    To be a proper pedant you should probably spell its without the apostrophe and capitalise Latin as a proper noun.

    English seems to have many spellings over the years, "per say" got the meaning across well enough for me.