tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Randy Layman <randy.lay...@aswethink.com>
Subject RE: IIS or Apache
Date Mon, 21 Jan 2002 18:24:33 GMT

	First my background, so you can understand where I'm coming from.  I
am a Software Engineer (title says Senior) who designs the solutions for our
clients (we do software consulting).

	For most of our MS Windows clients, they have limited IT staffs and
tend to hire the MSCE in a box type of support people.  Trying to get these
people to understand what is necessary in maintaining an Apache machine is
difficult since there is no class that counts towards their next MS
certification to teach them.  In these cases we have two choices - maintain
the system for them or use IIS (I hate long-term 24/7 support - I like what
life I have).

	A few of our MS Windows clients have competent or excellent support
staffs.  These people can learn Apache if necessary.  They are usually
familiar with IIS already, have the patches installed before most of the
world, and can make IIS bend to their every desire, including keeping the
coffee fresh (well maybe not quite that good).  In this case usually we find
that they would prefer IIS since it fits into their existing systems, they
know what the risks are, and they have a system in place to support and
maintain IIS.

	Yes, that means we don't usually install Apache onto Windows.
Another big reason is that if you install a Windows server then IIS is
almost always already there (and removing it can sometimes be difficult).
Additionally, a number of our client's IT staffs have indicated that we were
required to use IIS for whatever reason - for instance, one client has all
IIS servers set up to run PKI between the server and client for all internal
web requests.  By using the ISAPI plug in we were able to work with PKI
without worrying about setting up Apache to use their certificates, etc.
(As a side note, they use their switches and routers to slow down HTTP
traffic while keeping HTTPS flowing smoothly - their own way of keeping
people on internal sites and not public browsing).

	This doesn't mean that IIS is the only choice for Windows.  You need
to consider who will support the application and what they can support and
are familiar with, your risk level for hack attempts (remembering that you
are running Windows as the underlying operating system and all the security
risks that introduces), along with the effort required to get Apache
installed when IIS is probably already in place.  For us, the decision has
usually been for IIS, but that's usually because we can't get past the "who
will support it and what they know" question.

	Randy

> -----Original Message-----
> From: sumit.rajan@rhodesgroup.org [mailto:sumit.rajan@rhodesgroup.org]
> Sent: Monday, January 21, 2002 1:27 PM
> To: tomcat-user@jakarta.apache.org
> Subject: RE: IIS or Apache
> 
> 
> Randy Can you please give me some data / info in support of 
> your statement.
> 
> Because I am using Apache right now. It just occured to me 
> that, 'Does IIS
> fit better on windows than Apache ?' and i posted the 
> question. Before your
> reply I thought i was doing the right thing till now. But 
> your statement has
> made me think... Please elaborate your point.
> 
> 
> Sumit.
> 
> -----Original Message-----
> From: Randy Layman [mailto:randy.layman@aswethink.com]
> Sent: Monday, January 21, 2002 12:03 PM
> To: Tomcat Users List
> Subject: RE: IIS or Apache
> 
> 
> 
> Not that I necessarily believe that IIS is the best choice, 
> but the argument
> has been pretty one sided so far so I thought I would give a 
> little balance.
> 
> > -----Original Message-----
> > From: Cressatti, Dominique [mailto:Dominique.Cressatti@lansa.co.uk]
> > Sent: Monday, January 21, 2002 12:31 PM
> > To: Tomcat Users List
> > Subject: RE: IIS or Apache
> > 
> > 
> > >>Ever heard of managers ;)
> > yes and what do they pay you for?
> > tell you how to do your job or letting
> > you do your job ie finding the best web server.
> > 
> > If he willing to put his butt on the line for
> > deploying the worth web server and take full
> > responsibilities for breaking into your site,
> > fine.
> > 
> > Again do your job, compare which of apache and IIS
> > had the most bug/securities hols issues which
> > one tie you up to a specific platform ,which one
> > makes it difficult to replicate/migrate to a different
> > PC.
> 
> A major thing needs to be considered is Total Cost of Ownership (TCO).
> There have been a number of studies stating that one or the 
> other is cheaper
> to own.  In my opinion you want to go with what you know.  If 
> the support
> group knows Apache or IIS very well and the other in a limited or
> non-existent capacity then you probably want to choose the 
> one that your
> support staff can work with.
> 
> Another thing to consider is the necessary level of security. 
>  A totally
> secure system is impossible to have and be useful.  You need 
> to decide what
> your level of risk versus reward is acceptable.  If the 
> system is already
> behind a firewall with no external exposure then you can 
> probably afford to
> be a little less stringent on the security.
> 
> > 
> > As well if you go for IIS you gonna have to patch and
> > keep up with them fairly frequently (look at how many
> > patches had been released for IIS in the last year),
> > therefore it means more down time.
> 
> Two points here, first your company might already have other 
> IIS systems and
> you simply need to get your server on the list that needs 
> patches when they
> arrive.  Also, installing patches doesn't cause a lot of 
> downtime (assuming
> that the patch works correctly, which might be a big assumption).
> 
> > 
> > Apache is open source = if you find a bug that prevent
> > your site to stay up or compromise it, providing that
> > can code in C you can fix it there and then.
> > With IIS pray that MS 1) can be asked to fix it 2) they
> > do it quickly.
> 
> This, of course, assumes that you know C well enough to read 
> the Apache
> source, which is rather large.  Tracking down problems in a 
> project that big
> is very difficult.  You would probably be better off asking the Apache
> developers to make the fix for you.  As this point you would 
> probably get a
> faster response from Apache, but some big corporations can 
> make Microsoft
> jump very quickly.
> 
> > 
> > If apache/Linux is good enough for amazon.com to commit
> > there business on it why can't it be good enough for your
> > boss?
> 
> Maybe because Amazon.com hasn't made any money (profit) yet?  
> Also Amazon's
> level of risk tolerance might be different from another 
> company's that would
> change their choices.
> 
> 
> 	Again, I'm not advocating IIS over Apache, I just think 
> the decision
> is a little more complex that people have made it out to be so far.
> 
> 	Randy
> 
> > 
> > Dom
> > -----Original Message-----
> > From: Martin van den Bemt [mailto:martin@isallineed.org]
> > Sent: 21 January 2002 17:09
> > To: Tomcat Users List
> > Subject: RE: IIS or Apache
> > 
> > 
> > Ever heard of managers ;)
> > 
> > > -----Original Message-----
> > > From: Cressatti, Dominique 
> [mailto:Dominique.Cressatti@lansa.co.uk]
> > > Sent: Monday, January 21, 2002 18:08
> > > To: Tomcat Users List
> > > Subject: RE: IIS or Apache
> > >
> > >
> > > From stability/bugs/security point of view the choice is easy,
> > > use apache.
> > > Why on earth anyone would run IIS? given it track record (code
> > > red, nimba, etc...).
> > > apache is portable, try to replicate a config on another platform
> > > using IIS,
> > > even on another MS platform it's not that easy.
> > > With Apache on the other hand you bearly need to copy the 
> > structure and
> > > httpd.conf
> > >
> > > Apache has 60% market share and IIS about 20%
> > > yet IIS is top notch when it comes to the amount of bugs/security
> > > holls uncovered, apache bearly none.
> > >
> > > Again why on earth anyone with a bit of common sense 
> would consider
> > > running IIS.
> > >
> > > Dom
> > >
> > > -----Original Message-----
> > > From: sumit.rajan@rhodesgroup.org 
> > [mailto:sumit.rajan@rhodesgroup.org]
> > > Sent: 21 January 2002 16:51
> > > To: tomcat-user@jakarta.apache.org
> > > Subject: IIS or Apache
> > >
> > >
> > > Hi,
> > > 	I have a JSP application (with java classes) to run on 
> > Windows 2000
> > > server. For JSP i am using tomcat container. Can anyone 
> > please let me know
> > > should I use Microsoft IIS web server or Apache web server for my
> > > application. Please tell me which is better IIS or Apache 
> > on the following
> > > basis:
> > > 1. Stability
> > > 2. Speed
> > > 3. Load
> > > 4. Overall (considering any other parameters)
> > >
> > > Sumit.
> > > The information contained in this e-mail and any files 
> > transmitted with it
> > > may be privileged and confidential.  If the reader of 
> this message,
> > > regardless of the address or routing, is not an intended
> > > recipient, you are
> > > hereby notified that you have received this transmittal in 
> > error and any
> > > review, use, distribution, dissemination or copying is strictly
> > > prohibited.
> > > If you have received this message in error, please delete 
> > this e-mail and
> > > all files transmitted with it from your system and notify 
> > the sender by
> > > reply e-mail or by calling 1-888-338-6076.
> > >
> > > --
> > > To unsubscribe:   
> > <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> > > For additional commands: 
> > <mailto:tomcat-user-help@jakarta.apache.org>
> > > Troubles with the list: 
> > <mailto:tomcat-user-owner@jakarta.apache.org>
> > >
> > >
> > > --
> > > To unsubscribe:   
> > <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> > > For additional commands: 
> > <mailto:tomcat-user-help@jakarta.apache.org>
> > > Troubles with the list: 
> > <mailto:tomcat-user-owner@jakarta.apache.org>
> > >
> > >
> > 
> > 
> > --
> > To unsubscribe:   
> <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> > For additional commands: 
> <mailto:tomcat-user-help@jakarta.apache.org>
> > Troubles with the list: 
> <mailto:tomcat-user-owner@jakarta.apache.org>
> > 
> > 
> > --
> > To unsubscribe:   
> <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> > For additional commands: 
> <mailto:tomcat-user-help@jakarta.apache.org>
> > Troubles with the list: 
> <mailto:tomcat-user-owner@jakarta.apache.org>
> > 
> 
> --
> To unsubscribe:   <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> For additional commands: <mailto:tomcat-user-help@jakarta.apache.org>
> Troubles with the list: <mailto:tomcat-user-owner@jakarta.apache.org>
> The information contained in this e-mail and any files 
> transmitted with it
> may be privileged and confidential.  If the reader of this message,
> regardless of the address or routing, is not an intended 
> recipient, you are
> hereby notified that you have received this transmittal in 
> error and any
> review, use, distribution, dissemination or copying is 
> strictly prohibited.
> If you have received this message in error, please delete 
> this e-mail and
> all files transmitted with it from your system and notify the 
> sender by
> reply e-mail or by calling 1-888-338-6076. 
> 
> --
> To unsubscribe:   <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
> For additional commands: <mailto:tomcat-user-help@jakarta.apache.org>
> Troubles with the list: <mailto:tomcat-user-owner@jakarta.apache.org>
> 

--
To unsubscribe:   <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
For additional commands: <mailto:tomcat-user-help@jakarta.apache.org>
Troubles with the list: <mailto:tomcat-user-owner@jakarta.apache.org>


Mime
View raw message