How Microsoft Fought True Open Standards V

Ten years ago, people were saying that open source would never be able to best proprietary software. But what they overlooked was the fact that Apache had already beaten Microsoft's IIS Web server offering back in the mid-1990s, and had never lost that leadership once. 

On Open Enterprise blog.

Many Happy Returns, Apache

We tend to think of free software as (mostly) new, so the fact that Apache celebrated its 15th birthday yesterday seems pretty extraordinary. We also typically think of free software as being the perennial plucky underdog, but as this post on the Apache Software Foundation Blog reminds us, Apache has been the leading Web server for almost its entire existence...

On Open Enterprise blog.

The Chinese (Web Servers) Are Coming

The monthly release of the Netcraft survey is always good, since it generally shows the continuing dominance of Apache in the Web server field. But this month has something new and vaguely frightening:

In the February 2009 survey we received responses from 215,675,903 sites. This reflects a phenomenal monthly gain of more than 30 million sites, bringing the total up by more than 16%.

This majority of this month's growth is down to the appearance of 20 million Chinese sites served by QZHTTP. This web server is used by QQ to serve millions of Qzone sites beneath the qq.com domain.

QQ is already well known for providing the most widely used instant messenger client in China, but this month's inclusion of the Qzone blogging service instantly makes the company the largest blog site provider in the survey, surpassing the likes of Windows Live Spaces, Blogger and MySpace.

Got that? QQ's server QZHTTP just put on 20 million sites in the survey - enough seriously to dent both Apache and IIS (and making the latter look suddenly vulnerable to losing its second place).

Does this represent the dawn of a new (Web server) era?

What makes this all slightly troubling is that I don't know anything about QZHTTP: I presume it's not open souce, since I can't find any links to its code. But can anyone give me any more details, please? (Via @codfather.)

Follow me on Twitter @glynmoody

The Empire (No Longer) Strikes Back

One of the most worrying moments in recent open source history was when it became clear that Microsoft was determined to wrench away Apache's crown as top Web server. This began in early 2006, and was soon showing dramatic results, as the April 2006 Netcraft survey commented:

This month's survey brings one of the largest one-month swings in the history of the web server market, as Microsoft gains 4.7 percent share while Apache loses 5.9 percent. The shift is driven by changes at domain registrar Go Daddy, which has just migrated more than 3.5 million hostnames from Linux to Windows. Go Daddy, which had been the world's largest Linux host, is now the world's largest Windows Server 2003 host, as measured by hostnames. The company said it will shift a total of 4.4 million hostnames to Windows Server 2003.

This was a staggering shift, and I feared it might presage a real effort by Microsoft to achieve a major PR win. Things reached their nadir in September 2007:

Apache gains over 3 million hostnames, and around 0.9 million active sites this month. But this is not enough to prevent its market share declining closer to the 50% mark, as Microsoft also gained over 3 million hostnames (a large part of which come from MySpace and Live Spaces, both of which use its Internet Information Server.

At that time, the gap between Apache and Microsoft's IIS was just 15%, down, from 50% just a couple of years earlier.

But since then, Apache has gradually pulled ahead; today the gap is around 18% - still far smaller than it once was, but increasing. I feel that the danger has passed, not least because Microsoft has realised that it was fighting yesterday's battles.

Tomorrow's fight will be about owning the cloud, and the main threat there is not so much Apache, as customised versions of open source software, of the kind employed by Google for its vast server farms: in the latest Netscape survey, Google has around 5% of the Web server market. It's still open vs. closed, but not as we know it.

The crucial point is that Microsoft failed to displace Apache, despite its almost limitless resources. This is the crucial lesson for the future, more important than any particular percentage market share: that Microsoft's attacks can - and have been - beaten off.

Should We Fear the (Microsoft) Geeks, Bearing Gifts?

On Open Enterprise blog.

Apache and the Art of the Press Release

Here's some interesting commentary on my recent post about Apache's declining market share in the Netcraft survey:

The Netcraft numbers are changing for one reason and one reason only: because a very large and powerful entity is doing whatever they can to change those numbers, even if it means creating millions of bogus sites. Even if it means paying registrars large sums of cash to move their parked domains over to IIS. Anything. It is of prime importance for them to be able to "beat" Apache, and we are seeing the result. People aren't switching to IIS. Companies aren't switching to IIS. Hosts aren't switching to IIS. At least not for technical reasons. MS needs this marketing success. It needs to "prove" that IIS is beating Apache and, by logical conclusion, MS is better than Open Source. Can't we all already predict what the press release will say? So with something so important on the line, and with a survey that can now be easily fudged, the battle call is "Change Netcraft!"

Of course, the graph itself makes it clear that on a certain day Microsoft decided: we will overtake Apache, cost what it may. But my point stands: whatever dirty tricks Microsoft may use to achieve that goal, it doesn't matter - it's too late.

The same post also links to this alternative web survey, by Security Space, where Apache still dominates utterly.

Is Apache About to Get Scalped?

Certainly looks like it:

Apache loses 2.8% share this month, partly through the strong growth at the major blogging systems, and partly due to 2.5 million domains on Apache expiring at trouble-free.net. Apache has around a 10% market share advantage over IIS now, which is the smallest gap between the two since IIS was launched in 1996.

The only consolation is that Apache's job is done: it has the shown the way. Today, if necessary, we can live without Apache as an example of how Microsoft can be beaten in a market, because the total open source story is now so strong.

After Netcraft

For over a decade, it has been a point of faith that Apache is not only a better Web server than Microsoft's IIS, but that this is demonstrable: the Netcraft survey of public Web servers shows that Apache has been consistently ahead.

Alas, for a variety of reasons - not least Microsoft's determination to reduce the gap, whatever the cost - Apache's lead is falling. So it's good to have this new survey that re-asserts Apache's superiority, and adds a nice extra twist:

Linux websites have better uptime and load faster than Windows-based websites. Research by WatchMouse, a website monitoring company, also shows that web server platform Apache outperforms the Microsoft IIS platform. Therefore, having a Linux website and an Apache webserver platform offers the best choice for professional web pages.

I feel another Microsoft-funded piece of research on its way....

Google Points Finger at Microsoft IIS

Interesting bit of shin-kicking here:

Web sites running Microsoft Corp.'s Web server software are twice as likely to be hosting malicious code as other Web sites, according to research from Google Inc.

Last month, Google's Anti-Malware team looked at 70,000 domains that were either distributing malware or hosting attack code. "Compared to our sample of servers across the Internet, Microsoft IIS features twice as often as a malware-distributing server," wrote Google's Nagendra Modadugu, in a Tuesday blog posting.

Together, IIS (Internet Information Services) and Apache servers host about 89 percent of all Web sites, but collectively they're responsible for 98 percent of all Web-based malware. Google actually found an equal number of Apache and IIS Web sites hosting malicious software, but because there are so many more sites hosted by Apache servers (66 percent versus Microsoft's 23 percent) malicious sites make up a much larger percentage of all IIS servers.

Will Microsoft Be Assimilated?

I knew that I knew nothing about aQuantive. Here, for example, is something rather important that I didn't know I didn't know:

Information available from Atlas' Web site indicates the Internet software company employs extensive use of open source software including Linux, Apache, MySQL, and Solaris.

Software engineers at Atlas' Raleigh office do client/server development in C and C++, software maintenance and "scripting", and developing and maintaining custom reporting capabilities.

Other sought after skills include Unix development, JavaScript, and those for Windows software administration like SQL Server and IIS.

The use of open source is not confined to Atlas with the second significant business unit Avenue A Razorfish boasting "we also frequently utilize open source technologies".

There was a similar situation when Microsoft bought Hotmail, which was running on Apache and FreeBSD for a long time after acquisition. Since aQuantive is much bigger, we can presumably expect Microsoft to have even more difficulty assimilating it.

Windows: Rat's Nest and Dog's Breakfast

As Edward Tufte has explained far more eloquently than I can, images are able to convey information far more compactly and efficiently than words. So you don't have to be a geek to appreciate the two images in this posting:

Both images are a complete map of the system calls that occur when a web server serves up a single page of html with a single picture. The same page and picture.

Well, not quite. The upper picture shows Apache running on GNU/Linux; the lower, IIS running on Windows. The former looks like a motherboard: complicated but orderly; the latter is simply a rat's nest.

As the post says:

A system call is an opportunity to address memory. A hacker investigates each memory access to see if it is vulnerable to a buffer overflow attack. The developer must do QA on each of these entry points. The more system calls, the greater potential for vulnerability, the more effort needed to create secure applications.

Now, some have criticised this on the grounds that people don't attempt to attack systems through static Web pages. This is true, but the point is, if this is the difference for a simple operation like displaying a Web page, imagine the contrast for more complex tasks. It is precisely those tasks that offer the greatest scope for finding weaknesses. Thus the images in the post above offer a graphic, if not literal, representation of the dog's breakfast that is Windows security. (Via Slashdot.)

Apache Starts to Patch the Holes

The latest Netcraft survey shows that Apache has pulled back some of the ground it lost to Microsoft's Web server last month. There have been some pretty massive swings recently, as the oscillations in the graph show: these are largely due to switches in the hosting sector, which can often involve millions of Internet names at a stroke. For example, Go Daddy moved over 1.6 million hostnames from Apache to Microsoft's IIS platform in June.

These new gains for Apache are important, because it suggests that Microsoft's relentless campaign to "convince" hosting companies to switch to its products (and who wouldn't love to be a fly on the wall for those conversations?) may finally have run out of steam. It will be interesting to see what happens next month.

How the Stacks Stack Up

The ever-interesting Steven Vaughan-Nichols, who goes back a long way in the free software world, has a fascinating article about a comparison of two application stacks, one open source, the other from Microsoft. The results were surprising:

The tests showed that such vanilla LAMP (Linux, Apache, MySQL, PHP/Python/PERL) stacks as SLES (SUSE Enterprise Linux Server) 9, Zope, ZODB, and PHP and a pure LAMP based on SLES, produced "C" results. They weren't bad, but they weren't anywhere near as good as an out of the box .NET stack based on Windows Server 2003, IIS (Internet Information Server), SQL Server 2005, ASP (Active Server Pages), and SharePoint Portal Server 2003.

The results mirror those of the Mindcraft tests back in the late 1990s, when GNU/Linux found itself whupped by Microsoft. But the consequence was a range of improvements that soon took free software past Windows. However disappointing the current outcome for the stack tests may be, I'm sure that the same will happen here.

Remember: every bug report makes open source stronger, and the same goes for adverse benchmarks.