Is Open Source Insecure?

Roaring Penguin Software ^ | 6-10-2002 | David F. Skoll

[dheretic]

So what is the going rate for your typical rentathinktank these days?

[Knitebane]

Not that it matters. Microsoft has always been ready to spend whatever it has to to maintain it's position.

Well, except to actually build quality software. They have more lawyers on staff than software quality engineers. They spend more money on fake grass roots support, fake benchmarks and fake studies like this than they do on software security auditing.

[pyx]

Interesting read. You'd best put on your asbestos hip waiders. The MS, one-size-fits-all, will be here soon to shovel more of their FUD.

[DoughtyOne]

[Askel5]

What's the "D" in FUD?

[ImaGraftedBranch]

Fake benchmarks?

Apparently you are living in the world of 2-3 years ago. While people like you keep the anti-MS tirades going, the world of high-performance, low-priced servers and server software configurations have passed you by. Industry benchmarks by the TPC council show that Intel Servers running Microsoft products blow away any comparable unix platform in price AND performance -- by a longshot!

Top Ten TPC-C by Performance Version 5 Results

All Results

Clustered Results

Non-Clustered Results

Rank	Company	System	tpmC	Price/tpmC	System Availability	Database	Operating System	TP Monitor	Date Submitted	Cluster
1		ProLiant DL760-900-256P	709,220	14.96 US $	10/15/01	Microsoft SQL Server 2000 Enterprise Edition	Microsoft Windows 2000 Advanced Server	Microsoft COM+	09/19/01	Y
2		IBM e(logo) xSeries 370 c/s	688,220	22.58 US $	05/31/01	Microsoft SQL Server 2000	Microsoft Windows 2000 Datacenter Server	Microsoft COM+	04/10/01	Y
3		ProLiant DL760-900-192P	567,882	14.04 US $	10/15/01	Microsoft SQL Server 2000 Enterprise Edition	Microsoft Windows 2000 Advanced Server	Microsoft COM+	09/19/01	Y
4		PRIMEPOWER 2000 c/s w 66 Front-Ends	455,818	28.58 US $	02/28/02	SymfoWARE Server Enterp. Ed. VLM 3.0	Sun Solaris 8	BEA Tuxedo 6.5 CFS	08/28/01	N
5		IBM e(logo) xSeries 370 c/s	440,879	19.35 US $	12/07/00	IBM DB2 UDB 7.1	Microsoft Windows 2000 Advanced Server	Microsoft COM+	04/11/01	Y
6		ProLiant DL760-900-128P	410,769	13.02 US $	10/15/01	Microsoft SQL Server 2000 Enterprise Edition	Microsoft Windows 2000 Advanced Server	Microsoft COM+	09/19/01	Y
7		IBM eServer pSeries 690 Turbo 7040-681	403,255	17.85 US $	11/22/02	Oracle 9i R2 Enterprise Edition	IBM AIX 5L V5.2	Webshpere App. Server Ent. Edition V.3.0	05/22/02	N
***		Bull Escala PL3200R	403,255	19.62 US $	11/22/02	Oracle 9i R2 Enterprise Edition	IBM AIX 5L V5.2	Websphere App. Server Ent. Edition V 3.0	06/03/02	N
8		HP 9000 Superdome Enterprise Server	389,434	21.24 US $	05/15/02	Oracle 9i Database Enterprise Edition	HP UX 11.i 64-bit	BEA Tuxedo 6.4	12/21/01	N
9		IBM e(logo) xSeries 370 c/s	363,129	21.80 US $	05/31/01	Microsoft SQL Server 2000	Microsoft Windows 2000 Datacenter Server	Microsoft COM+	04/10/01	Y
10		Compaq AlphaServer GS320	230,533	44.62 US $	07/30/01	Oracle 9i Database Enterprise Edition	Compaq Tru64 UNIX V5.1	Compaq DB Web Connector V1.1	06/18/01	N

*** - Duplicate results are shown with an asterisk (*) in the Rank column. Click here for more information about duplicates.

[ThePythonicCow]

Google is your friend. The first hit searching for "fud" is What is FUD?.

It begins:

FUD stands for Fear, Uncertainty, Doubt. It is a marketing technique used when a competitor launches a product that is both better than yours and costs less, i.e. your product is no longer competitive. Unable to respond with hard facts, scare-mongering is used via 'gossip channels' to cast a shadow of doubt over the competitors offerings and make people think twice before using it.

[ThePythonicCow]

Thanks for listing the fake benchmarks to which Knitebane referred. Fake in the sense that the money that Microsoft and Intel, in concert, can throw at this particular benchmark is now shown to be sufficient to get the highest score. Anything can be gamed, for a price.

Oh, and where's your rebuttal for the large number of other points made in the original post? Or is the only false word you could find in this entire post the single word "fake"?

[HiTech RedNeck]

It is a constant game of leapfrog. For the most part, the hardware is to be credited for these results, and it was optimized for Microsoft not for UNIX/Linux. But once a decent UNIX/Linux environment is optimized to these top servers it will edge out Microklutz yet again.

[ThePythonicCow]

Yup - Linux will take Intel to the high end systems, with dozens or hundreds of processors connected with cache coherent memory much faster than Microsoft.

[altair]

Bump for later comment.

[ImaGraftedBranch]

Are you kidding me? I've been in the software/hardware business for over 20 years, spending the last 15 of them in the computer performance monitoring arena for mainframes and servers. I've coded in assembler for the same duration, writing benchmark PROGRAMS to test new disk drives and control units for hardware vendors. I've written a 1.5 million line assembler software suite to monitor and report on all aspects of mainframe performance (both hw/sw). I *know* the business.

I've WORKED on many benchmarks during competitive bid processes for a large mainframe corporation, and I am fully familiar with vendors (including my own at the time) doing whatever they can to run the most work in the least time, per specifications.

It might have been possible to skew things 10 years ago, but do you even know what the TPC benchmarks are? It was Sun that started complaining several years ago (after years of owning these benchmarks) when Microsoft/Intel platforms started passing them by in intermittent tests. For the past three years, the Microsoft/Intel platforms have run away with the benchmark tests, while AT THE SAME TIME having to adhere to MORE strict guidelines at Unix vendors' insistence!

These guidelines are VERY strict and tightly controlled, checked, monitored and verified. Billions of dollars are at stake, and NOT ONE vendor complains about the results of a test, because they know that for the specified guidelines they did the best they could, and the guidelines have been finely tuned by the non-profit council to now simulate a very diverse, real-world operating environment (much at the behest of Sun -- be careful what you ask for.)

It is Sun that is asking for changes in the guidelines (such as lengthening the tests from 20 minutes to 2 hours, thinking that MS$ platforms/software would crash in the meantime), only to have their clocks cleaned each time.

If you guys don't know what in the heck you are talking about, then don't say anything. This is running on three years, fellas.

It would be one thing if MS$/Intel platforms were edging comparable Sun/Unix platforms slightly...but they are getting completely dusted in price and performance (Come on -- 700,000+ Transactions Per Minute versus 200,000+ for 1/2 to 1/3 the price!!)

It is not just the TPC-C benchmark (which is a very diverse, highly complicated business transaction environment), but other benchmarks as well (such as the web-related benchmarks).

You are right about one thing: MS$ has thrown tons of money at their products -- by partnering with Unisys, Compaq, HP (formerly), to obtain these companies' experience and expertise in adapting Operating System code, Database Code, etc., onto more powerful platforms with larger back-bones to enhance I/O, Multitasking and channel transfer to mainframe-level performance.

Yes, Microsoft has spent billions in the effort. Other companies such as Unisys and Compaq have also spent millions creating Win2K HW architectures that mimic their high-performance mainframe environments (i.e., Tandem and Unisys 2200/Clearpath), and they have schooled MS$ on how to update their code to take advantage of the hardware.

Once again, I know the facts on this one. Microsoft has spent the money partnering with mainframe-level companies that have created high-performance Intel platforms using their mainframe experience, and teaching Microsoft how to adopt their SW products to these enhanced Intel platforms.

Sun, sadly, has not kept up. It won't be too long before Sun's exhorbitant prices and performance levels of 1/3 of MS$ platforms will cause companies to ask themselves if they are, in fact, just buying the "name."

Win2k Advance Server software running on these high-performance platforms don't crash like Win95, fellas. That was yesterday's news...but you believe what you want.

This is the LAST time I will attempt to bring blind Unix followers into the future.

Have a nice day.

[steve-b]

I like the phrase used in the Slashdot story: "coin-operated policy paper dispenser".

[chilepepper]

Open source software is "so insecure" that the NSA is using it as a platform to develop super-secure Linux via the SELinux innitiative (see Wired's article). And they are SO AFRAID of the damage that open source can have on security that you can already download a version of it...

[chilepepper]

I have no doubt the benchmarks are correct, however, some of the other poster comments are correct as well. In particular, MicroSoft realized early on that the CLUSTER is the architectural secret to winning the benchmark wars. They invested their time and their money to get this working and the payoff was (is) the performance, as reflected in the benchmark. If you look at the UNIX benchmarks, most of them are NOT clustered, so they suffer accordingly.

Microsoft is in trouble when the UNIX community, Linux in particular, gets its act together in clustering SQL transactions, as is SUN and the AIX part of IBM (unless they incorporate the same technology which is quite possible since IBM seems to be throwing its lot in with Linux).

The reason M$ is in trouble is that on an unclustered machine, Linux will start to win the benchmarks since the OS overhead tends to be much lower (which is why Apache ALREADY cleans MicroSofts clock in the WWW Server wars...)

[chilepepper]

Oops, i just noticed: NONE of the UNIX benchmarks are clustered... no wonder the M$ boxes win.

[dheretic]

Benchmarks are of trivial importance compared to security and uptime. Why the hell would you want a server that's fast and not extremely stable? Solaris crushes Windows in uptime. That's what matters. What good is a fast server if it goes down in the middle of the night and you lose an assload of transactions?

[dheretic]

No offense, but your post seems a little juvenile for an assembler code monkey. I'm having a hard time buying it.

[ImaGraftedBranch]

Apache cleans microsoft's clock on Web performance? Think again.

TPC-W standards benchmark follows. Guys, get with the program...You do yourselves a disservice by not keeping up with the latest technology.

Top Ten TPC-W Results by Performance

Item Count 10,000
Rank	Company	System	WIPS	$/WIPS	System Availability	Database	Operating System	HTTP Server	Date Submitted
1		IBM e(logo) xSeries 440 w/ xSeries 330	9,666	33.92 US $	09/10/02	Microsoft SQL Server 2000	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	03/11/02
2		Dell PowerEdge 6400/900 with PowerApp.Web 120	7,783	24.50 US $	01/28/02	Microsoft SQL Server 2000 Standard Edt.	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	01/28/02
3		IBM e(logo) xSeries 350 with IBM xSeries 330	7,073	31.77 US $	12/17/01	Microsoft SQL Server 2000 Standard Edt.	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	12/17/01
4		Dell PowerEdge 6400/900 with PAweb120	6,622	25.70 US $	12/19/01	Microsoft SQL Server 2000 Standard Edt.	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	12/19/01
5		Unisys e-@ction Enterprise Server ES5085R	5,745	69.00 US $	03/05/01	Microsoft SQL Server 2000	Microsoft Windows 2000	Microsoft Internet Information Server 5.0	03/05/01
6		PoweEdge 6400/700Mhz w/PA. Web 100 & PA. Cache 200	3,130	67.50 US $	03/01/01	Microsoft SQL Server 2000	Microsoft Windows 2000	Microsoft Internet Information Server 5.0	03/01/01
7		Unisys e-@ction Enterprise Server ES5085R (4P)	3,008	81.77 US $	11/14/00	Microsoft SQL Server 2000	Microsoft Windows 2000	Microsoft Internet Information Server 5.0	11/14/00
8		IBM Netfinity 5600 with Netfinity 6000R	1,262	277.08 US $	08/01/00	Microsoft SQL Server 2000	Microsoft Windows 2000	Microsoft Internet Information Server 5.0	07/01/00

Item Count 100,000
Rank	Company	System	WIPS	$/WIPS	System Availability	Database	Operating System	HTTP Server	Date Submitted
1		e-@ction Enterprise Server ES 7000 (16P)	10,439	106.73 US $	07/10/01	Microsoft SQL Server 2000 Enterprise Edition	Microsoft Windows 2000 Datacenter Server	Microsoft Internet Information Server 5.0	07/10/01
2		PowerEdge 6650	9,708	34.60 US $	05/31/02	Microsoft SQL Server 2000 Enterprise Edition	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	05/31/02
3		IBM eServer xSeries 430 with IBM Netfinity 4500R	7,554	136.80 US $	06/08/01	IBM DB2 UDB 7.2	IBM ptx 4.6.1	Microsoft Internet Information Server 5.0	05/01/01
4		NUMA-Q E410	6,272	195.59 US $	02/02/01	IBM DB2 UDB 7.1	DYNIX/ptx 4.5.1	Microsoft Internet Information Server 5.0	02/02/01
5		IBM eServer xSeries 370 with xSeries 330	6,045	76.67 US $	05/31/01	Microsoft SQL Server 2000	Microsoft Windows 2000 Advanced Server	Microsoft Internet Information Server 5.0	05/31/01