Internet Virus Just Killed AC2...

[Velael]

Well, while it's fashionable to bash Microsoft's enterprise products recently (mostly by folks who uses little to none of those products), a large number of people still do use them - actually, a vast majority, in one fashion or another. Microsoft doesn't print money, they sell shit that people use, and those people use it because it makes business sense for them. I really don't give a shit one way or another, my job is to get connectivity to you, no matter what OS you are using.

MS has never done a very efficient job at advertising changes in patches, and maitaining security has always been a struggle for them. However, with this one, people have nobody but themselves to blame. Sites like sqlsecurity.com and others have for the last 2 months informed folks to block off untrusted connections to UDP1434 because it was known to be used by a wide number of exploits, there is no reason a competant admin should have let his box get comprimised last night.

That being said, I want these fucks that did this to give back the 24 hours of my life I just spent trying to get my company's network functioning again, because 2 of my 3 up-stream providers took it in the ass like some chick in a Ron Jeremy film. At 1:10am EST when I finally got in contact with UUNet last night, they had officially gone to a nationwide network down status, for their entire network, kinda hard to rerout traffic when a major portion of the internet backbone, and most of the largest peering points are totally on their knees.

If it wasn't for the fact that the worm was soley contained in memory, and never written to disk, this attack might still be going on. However, in most cases, people were able to simply reboot all SQL servers they had, and drop their DOS attack within minutes, once word got out. Still, was a very long morning for many of us.

[Rensho]

Welcome Requiem from the MS fud dept. Tell all that bullshit to the MS techs being paged in the middle of the night and scratching their heads while they wait for a patch to be released or shut down a service while customers are bitching at them about why their site is down. Add in all this downtime to those superior performance numbers (0 hits/sec for how long now?) that MS products have.

Your crack about vi displays your complete ignorance about UNIX privileges.

Your targetting argument holds little water, remember that Apache rules the www server world, and how many exploits for apache come out vs IIS? Yeah.

MS products rely on a huge marketing budget rather than technical excellence to sell.

[Benren]

There, there. Keep bashing the big corporate man, keep clinging to the counterculture, and someday, someone will give a fuck.

It never ceases to amaze me how somewhere along the line, geeks everywhere decided that the answer to their universal quandry - just not being cool - was to get geekier.

I'll bet you're a big Akira fan, aren't ya'?

[Requiem]

Apache runs the WWW server world? For who? People like me who are running private websites such as this one which is running on Apache? Hate to break it to you junior, but even with as much traffic as this site handles, it's on a shitty little 1u 700MHz celeron media box. Apache scales like shit. It can't handle alot of computer. Maybe you missed the word ENTERPRISE. I think that you have absolutely no idea of the scope or magnitude involved in this discussion. Ever tried running Apache on a site that requires a real enterprise server? I have. Real being in excess of 32 Xeon, Itanium(in the case of a SSL server), or other non-Intel 64-bit processors and over 16gb of memory? The kind that moves so much data that there is an array of at least 500 badass 15k cheetahs running like crazy on the database to serve up all of the shit the users are requesting? It takes about 5x the computer, and about 10x the money(yes as computers get larger, they cost more per mip) that IIS does. Click on this: http://www.tpc.org/tpcw/results/tpcw_perf_results.asp What web server software is EVERY SINGLE ONE OF THESE SERVERS USING? See the title of the window? Let me fill you in on something about tpc.org. They don't do this themselves; The configurations you see listed and benchmarked are made by their respective companies just to show off their performance, because everyone knows that tpc.org is the major industry site to show that kind of shit off on. They do whatever they can to get these numbers as high as possible. Obviously you know something that the folks in the enterprise divisions of IBM, Unisys, and Dell don't. Actually, you don't know shit about large scale servers, and it's really obvious. You wanna know why you don't see many *nix or Solaris configurations there? Because it wouldn't be in the best interest of Sun, etc. to post there. They would get slaughtered outright in price/performance. Nevermind me though, I was only in charge of getting pre-release benchmark numbers from giant pre-production enterprise configurations I built up and shipped out to places like ZDNet for the Enterprise Marketting division of Intel. Retard. About the vi comment, your crack displays your complete ignorance about the entire situation. This was possible up until oh, about 7-8 years ago if I were to take a guess, perhaps even longer ago, on almost every ISP. Was it preventable? Sure, so is everything else if you have the foresight to prevent it. Most people didn't.

Doesn't hold much water? Let's say someone does find an exploit in Apache that makes every little mom&pop hosting service with their leet T1's spam the net. OH FUCKING NO!! That's enough to max out my(and mine only) 30 dollar a month 1.5Mbps downstream in my fucking house each. Why bother?

You know what really bugs me? People who always say "I hate xxx" when it's brought up in a conversation even if they don't know shit about it because it's the popular thing to hate, because of other retards just like them. Sadly, many many people do that. You all know the people I'm talking about, right? Why do people do that? Can you afford us some insight into this matter Rensho?

[Suineg]

What annoys me to no end is that the people bashing Microsoft are using all Microsoft products.

I do not bash Microsoft. I have worked with Linux and Solaris and tinkered with some BSD in the past. Out of the box most distros that every little idiot that thinks he knows what 'open source' is all about installs is the most unsecure thing you will find on the internet. Windows is not perfect I agree. Out of the box is more secure and stable then anything else out there. Notice I said out of the box.

I have seen Windows machines blow away *nix machines in contests when it comes to vulnerabilities. I think one year I was at Defcon and some Windows person won the CTF contest (which btw is a contest to hack everyone else on the network and not get hacked yourself). Exponentially Windows has more dumbasses using it though so the world sees its flaws first. If you pay attention to any bug or exploit site then you will see *nix issues come up hourly just as much as Windows.

[Flamebait]

Kickass posts Requiem. Makes me glad to be a comp-sci major. That was wicked cool. I learned stuff just from your posts.




P.S. I am really not being sarcastic at all, just so you know.

[eqwire]

Anyone seriously relying on Microsoft's products to run a serious SERVER application in a business environment is either:

1. Clueless
2. Does it because "noone ever got fired for buying Microsoft".



As for Apache ruling the web server world, it does indeed.

Check out http://www.netcraft.com/survey/ and see by yourself. I trust these numbers and most of the people I know do.

Apache: 66.24%
MS: 24.74%



There you have it. Basicly, Apache and Microsoft share 91% of the market, about all of it, safe to say.

Apache is slowly getting more market share, Microsoft is slowly losing market share.

Microsoft has illimited financial resources to promote their products, bribe officials, cockblock competition, hire competition's gurus, buy out competition.

Apache is a non-profit entity, doing exactly zero advertizing for their products. Yet they have 66% of the market share.

Microsoft's server software is shit. They do great office productivity stuff, MS Office is good, Windows is good to play games or read email, but their server software always sucked, sucks, and will always suck.

Just becaue there are 100 microsoft execs yelling "our software is the best one! Trust us!", doesn't mean it's true.

[Flamebait]

Hmmmm I like the percentages, but.... I still believe Requiem.
I think you are arguing two different things, those being web serving and decision support/web commerce serving. But I am a first year comp-sci student so am probably wrong.

[eqwire]

Apache doesn't scale? Hahahahahaha.

I hate to break it for you, but MOST of the BIGGEST web sites in the world are running Apache.

It is very easy to load balance and hence scale.

And you don't need a 100 000 USD Advanced Server Microsoft license to do so. Just need 5 minutes of time.

Heh.

[BirgittePovar]

Eqwire's web sight and Requiem's claim do not disagree with each other.

Try and wrap yourself around this: Just because 60+% in terms of pure numbers does something, does not mean that 60%+ of actual use comes from there. Just because 60% of the web sights use Apache doesn't mean that any of the really big ones do.

I don't actually know anything about this issue...all I know is that eqwire is using a claim that does not directly oppose Requiem's.

[Tuco]

me a favor and save your ignorant arguing

[Requiem]

Aparently you didn't read my second post. I specifically said that I was not talking about small-time servers such as this one, which is actually pretty large in the grand scheme of things. Someone said that they couldn't believe that people used Microsoft products for enterprise applications in reference to major backbones going completely down because of this worm. Where did you get the 15-year-old-nerd-playing-with-linux-for-the-first-time's home page with lots of "cool links" and some Final Fantasy midi's from? Why do you feel the need to discuss it on this topic? Probably at least 90% of those Apache web servers are not being used for an enterprise application. Good work son, I can see that you did your homework, but next time try to pay attention to the assignment more carefully. Class dismissed.

As for the scaling guy: Yep, you can buy 50 single processor rack mount servers and load balance em with another computer and Apache does just fine. That, however, is not scaling by the definition of the word in reference to server software, and I specifically mentioned that Apache couldn't handle alot of computer. Some applications need alot of computer. These applications are called enterprise applications. They require enterprise level servers. They are called enterprise applications because they require enterprise level servers, hence the term "enterprise level," which implies that the computer must be of sufficient level to handle these enterprise applications. Understand? Things like streaming media servers, and SSL servers that have to do a ton of encryption and decryption(two examples of an enterprise level task,) are simply retarded to try to do via distributed processing just for the sole purpose of running fucking Apache. Apache wouldn't be any better than IIS from either a user or administrator standpoint even if it did scale well; Just cheaper. SMP fucking owns distributed processing networks in efficiency, and so does a cluster network of SMP boxes. Nevermind the fact that distributed processing networks may suck dick in general, but they suck a special sort of dick at real-time processing such as this. They are only worth a shit for giant pre-determined tasks, like processing SETI data, where they receive a big block of shit to work on, send the results back to the master server when they are finished with it, then get a new block of shit to work on. SMP means that you have multiple processors in one motherboard, just like a dual processor board you can buy anywhere, except on a much larger scale in the case of enterprise level servers, say 32 processors, for those of you who do not know. You would have to spend so much more money to make a bunch of weak little rack systems do a major processing task like that over simple distributed networking, than you would to buy a real enterprise server, that you could buy IIS 100 times. Before this next section, I will explain what HTTP load balancing is. HTTP load balancing is where you have several single or dual processor(typically not larger because that defeats the purpose of cost-effectiveness; It is much more expensive per unit of performance to build a computer with many processors due to research/development, supply and demand, integration hardware, custom chassis/motherboards/daughterboards, etc) computers that all share the same database and simultaneously run the exact same web page using the information in that database. There is a computer running the HTTP load balancing software that monitors the load on each of the computers, and as new web requests come in, routes them accordingly to he least loaded server. It's cheap and effective for large web sites that don't have any need for massive processing power by some process they are running. Another example of an enterprise application that is not internet-related but makes up a very large segment of the really huge enterprise level servers in use today is a terminal server. A server running hundreds or thousands of virtual desktop workstations that people log into. Will HTTP load balancing help us here? Hmm, no, probably not. What about a massive VPN server like the ones that large businesses such as Intel and Microsoft use with thousands of simultaneous inter-office connections from all over the world? HTTP load balancing to the rescue? Not this time. The computers running the databases which are the central repositories for institutions such as the IRS, Visa, Mastercard, etc? Will HTTP load balancing save the day here? Looks like it fell short once again. Perhaps it could lend a helping hand for the giant servers that exist for the sole purpose of routing the billions upon billions of packets correctly and in a timely fashion that are in use in the offices of the aforementioned backbone ISPs that went down then? Sadly, no; It would be great if it could though. I could go on and on. I would like to point out again, for those of you who missed it earlier in this very same paragraph, that these types of tasks are what are considered to be enterprise level tasks. It doesn't really matter what any of you think, Microsoft software really is the best solution by far when it comes to both cost and performance for enterprise level applications. That's just the way it is whether you like it or not. Nothing you can do or say will change it.

Thank you, drive through.

[Aeka]

Hey I never said that MS wasn't allowed to make mistakes. Until machines write software (heaven help us all when that happens) people have to write software and people make mistakes.

Unless the software is super trival I expect bugs to crop up. There are millions if not hundreds of millions of interactions between "the software" and other parts of the system. Testing them all for 100% assurence is pure insanity. Debugging them is just as nutty. Even in the most mature software bugs crop up because of the behavior of external pieces of the system.

I don't harp on Microsoft or anyone else for having bugs. Bugs happen because humans as unpredictable beings are interacting with the machine which is dutifully predictable. I however harp on their handling of security issues. I would harp on any group, big or small, open or closed, that treated system admins as children.

The lack of a patch list is what bugs me the most. I've gotten more information from 3rd party boards and my own tinkering than I've gotten from Microsoft on how to deploy a machine starting from scratch. I don't know about you but that seems to me to be very backwards. Does MS really want people to believe that its just a few clicks and you've got a secured enterprise server? Now that is a good laugh. ^_^

Depending on the software installed on the machine the installing and patching process can go from inconsistent to just down right ugly. You could be doing things exactly right and still get mysterious messages. A patch failes...but why? Was it because that one of the previous patches rolled up the fix or did I miss a dependant patch? Apply patches in the wrong order can also cause settings to reset (you know...those unimportant settings that hardened the machine) or worse break it. The best case is that you can just back up. The worse case is the wipe and reinstall.

If patching MS stuff is going to be so "brittle" then I sure as hell want to plan out what I need before hand instead of finding out when I get there.

Sorry about the wandering rants. Its just one of my beefs with MS products. The lesson here is that Microsoft isn't necessarily bad...but its not necessarily helpful either. There is always room for improvment and room to grow otherwise why bother releasing new stuff? MS doesn't offer any more magic solutions than anyone else in the biz and don't let their literature fool you either. If any MSCE promises a "magic bullet solution" back away slowly then run for the hills. ^_^

[aychamo_aycono]

lol.. I dont know shit about internet security, but reading all theses posts, by using a skill called reading comprehension, I can understand what is going on.

And heres the problem: It seems some of you want nothing more than to prove Requim wrong. So you load your stupid google.com, and search for something, and past the link, without even reading anything.

After you post your 20 second google search results, I can predict what Requim is going to say, because you guys didn't even bother to read what he wrote. All you care about is tyring to prove him wrong..

So sad.

[Requiem]

Try as they might, they won't prove me wrong Aychamo... Sadly it is already apparent that they don't have the reading comprehension to understand the very text by which their owning is being delivered, so will probably continue to think they are right and argue anyway.