Apache 2.0.53 .msi

in2deep · Post by **in2deep** » Sun Feb 27, 2005 9:04 am

I saw that Apache 2.0.53 was now available as an MSI installer, so downloaded it. I've held off running it. It is a lot smaller then say 2.0.52, or 2.0.50 and I've not seen any reason why this should be the case.

Has anyone gone 2.0.52 -> 2.0.53 using MSI?

cyberskye · Post by **cyberskye** » Sun Feb 27, 2005 4:36 pm

It's because it is packaged as MSI. It reduces the size of required download by leveraging libraries already installed on your machine - no need to include shared stuff in teh download package.

Skye

"
MSI Binary Distribution Packages
The Apache HTTP Project is working to minimize your download times. The Apache HTTP Server is distributed as an MSI package. All Windows ME, 2000 and XP users have integrated MSI support as part of their Windows OS. Users of Windows NT 4.0, 95 and 98 must download the MSI installer, if it was not already installed by another product's installation.

"
http://apache.bestwebcover.com/httpd/bi ... win32/#msi

in2deep · Post by **in2deep** » Sun Feb 27, 2005 5:00 pm

It is necessary to de-install 2.0.52 before you can install 2.0.53. In the past, the .msi has been a complete system, is that no longer the case? If so, how are we supposed to know? If the de-install requires us to leave parts of the old installation in place, same question, how are we supposed to know what to remove and what to leave?

cyberskye · Post by **cyberskye** » Sun Feb 27, 2005 7:33 pm

in2deep wrote:It is necessary to de-install 2.0.52 before you can install 2.0.53. In the past, the .msi has been a complete system, is that no longer the case? If so, how are we supposed to know? If the de-install requires us to leave parts of the old installation in place, same question, how are we supposed to know what to remove and what to leave?

Not sure I understand references to the past - my understanding is that this is the first .msi build.

I would never run apache on windows except for testing purposes, so I really can't speak from experience. Since my production servers are *nix, they still run 1.33, so that's what's on my test rig.

I'd try one of the apache mailing lists if you need more detail.

in2deep · Post by **in2deep** » Mon Mar 07, 2005 4:00 pm

I've been using the .msi builds for 2 years now, on Windows. What's wrong with running Apache on Windows, I'd rather use Apache then IIS or PWS.

I still had the 2.0.52 installer on disk so I tried the 2.0.53 install and everything seemed to work, so I've left it running.

TonyT · Post by **TonyT** » Tue Mar 08, 2005 7:12 am

in2deep wrote:What's wrong with running Apache on Windows, I'd rather use Apache then IIS or PWS..

OK for lan, but not as secure as linux on wan. Pluse is easier to setup and config on linux than on windows.

in2deep · Post by **in2deep** » Tue Mar 08, 2005 9:51 am

Apart from telling it what URL(s) it has to respond to, which directory the URL's files are in, and what e-mail addresses it can use, Apache works straight "out of the box" on Windows.

Sure, if you want to change some of the parameters which default to ultra conservative/secure settings you need to tweak a few, and adding PHP etc, means adding a few lines but all of that is in one file, http.conf, which you can edit with Notepad. I don't see what is so difficult to setup and configur under Windows. As I have heard, the procedure under *nix is exactly the same.

Linux is useless to me.

cyberskye · Post by **cyberskye** » Tue Mar 08, 2005 11:05 am

I would never run a public server on windows, either.

cyberskye · Post by **cyberskye** » Tue Mar 08, 2005 11:06 am

in2deep wrote:Linux is useless to me.

You've probably never been responsible for the security of a site then.

Skye

greEd · Post by **greEd** » Tue Mar 08, 2005 11:32 am

in2deep wrote:As I have heard, the procedure under *nix is exactly the same.

Comparable ... yes
Exactly the same ... no

Out of curiosity why do you say Linux is useless to me? Have you given it a chance to be useful?

in2deep · Post by **in2deep** » Tue Mar 08, 2005 12:17 pm

You've probably never been responsible for the security of a site then.

I run my own site, and have a number of virtual host sites running from my own machine beneath my desk now. In that respect, I am totally responsible for everything on that machine and all the sites it runs.

I get the usual CodeRed and Nimda attacks every day, I get people trying to break in, all the usual hassles of the web in fact. I've never had anyone get anywhere with my system.

Just because I haven't had the great god Torvalds tattoo'd on my backside does not make me an idiot. Loosely veiled suggestions that I am for doing what I do acheive nothing.

If someone can state concrete facts that stand testing why Apache under Windows is a great risk - then bring them on - empty rhetoric simply makes the speaker look blinkered/biased.

Out of curiosity why do you say Linux is useless to me? Have you given it a chance to be useful?

I have never run Linux. About 10 years ago, I was the senior engineer responsible for a Unix system that collected meter readings from remote equipment that dialled in every day, I didn't dislike it, but neither particulaly became enamoured with it. I worked with it daily for about 3 years. It had it's fair share of downtime.

I do not have any customers that would accept a Linux solution. Indeed, when tendering, a common requirement is that the tenderer shall provide a solution which runs under <insert flavour of Windows here>. Offering anything else would be a waste of my time.

Similaly, as I develop exclusively for Windows platforms, time invested in another system is academic, and I already have enough topics in my own field to keep up to date with.

I am not a card carrying MS fan, but I am a realist.

cyberskye · Post by **cyberskye** » Tue Mar 08, 2005 2:41 pm

in2deep wrote:If someone can state concrete facts that stand testing why Apache under Windows is a great risk - then bring them on - empty rhetoric simply makes the speaker look blinkered/biased.

Don't get defensive - I was simply stating that windows is an exploit waiting to happen - regardless of the http server involved. Would you allow your desktop to be accessed from the net directly?

Windows was built from the desktop out to the network. Linux(or unix) was built from the network back to the desktop. Convenience and features outweigh security and stability. Windows architecture - the 'magic' that makes many things easy to configure - is insecure. Who the hell would integrate a browser into the kernel?! Why did a Media Player exploit threaten to 'take complete control of my system"? You can't build a strong house on sand.

I happen to be a BSD (and previously, solaris) fan, but linux is ok - especially on the desktop or as a db server - linux threads.

Then again, what you call ultra-conservative I call standard. Nothing like the FBI showing up to ask you why you are attacking a gov't machine.

BTW - until apache 2.x, it ran MUCH slower on windows than on *nix. MPM helped this out. For that reason (and the need to rewrite most modules), you still see many unix hosts using 1.x.

in2deep · Post by **in2deep** » Tue Mar 08, 2005 3:08 pm

Don't get defensive

I got somewhat defensive because of the implication in...

You've probably never been responsible for the security of a site then.

... I read that as "If you run a production server on Windows you are not being responsible", or more simply that I am stupid. Whatever, it is unimportant.

What I did say though was...

someone can state concrete facts that stand testing

... and you have not done so. You have presented more generalisations.

Can you give me an example which I can test here which will show Apache failing under Windows? None of the little sods that trawl the net looking for weak systems to attack and undermine have managed to do so.

FBI has no jurisdiction here.

*** EDIT ***

I re-read my original post. I can see what caused at least some of the confusion. When I said 2.0.53 was now available as an .msi, it could have been interpreted as you have, i.e. that this was the first .msi version, rather then the actual meaning, which was the 2.0.53 .msi installer was now available, it having been released about a week after the .nix versions. Normally the *nix and Windows versions are released at the same time.

greEd · Post by **greEd** » Tue Mar 08, 2005 3:37 pm

in2deep wrote:I am not a card carrying MS fan, but I am a realist.

Um, so those that prefer BSD or NIX over Windows aren't ?

in2deep · Post by **in2deep** » Tue Mar 08, 2005 3:56 pm

Um, so those that prefer BSD or NIX over Windows aren't ?

If you read the 4 paragraphs I wrote in response to your comment, I think you'll find I explained my reasoníng.

I don't care what you use, or what anyone else uses. I simply state that ME using anything other then Windows is completely unrealistic.

TonyT · Post by **TonyT** » Tue Mar 08, 2005 4:19 pm

I dabble w/ Debian Linux Woody at home on my lan. This machine is not opened up to the wan because (1) my isp says not to do so and (2) it houses my business database which I would not ever have on a wan server.

NO system, be it windows or nix is secure 100%. Granted, breaking into secured systems requires much more know-how than some script kiddie.

My Debian Linux Woody box has:
apache 1.3
mysql 4.0.23 (backported)
php 4
wu-ftpd

I write php code, html, css and other web related junk and earn money at it for a few clients. I began fooling w/ linux because 65% of www web servers running are apache on some form of nix. As I often must acquire hosting for my clients, I wanted to learn the nix drive hierachy as well as how to remotely do basic www admi necessities.

I have found that apache on nix runs faster than apache on windows. Secondly, you can put apache on a nix box that is an old system, such as a 386 w/ 32 mb ram and it will still run faster than apache on a 2GHz P4 with a windows server os. Granted, one would not want to put a high traffic site on such an older system, but by today's standards, a high traffic site means hundreds of thousands of hits/day, not a thousand hits/day.

Windows servers can be easier to config than nix server IF one is accustomed to using a GUI desktop. I *cheat* on my nix box by running Fluxbox window manager, Nedit txt editor and EmelFM file manager. But I do all installs and apt via commandline. I also use PHPmyAdmin to install and setup my databases via my .sql files. Only because I am used to windows and can do things faster via my browser than from a shell. (an I hunt & peck type)

I dig both windows and nix, it would suck to be bound to only one operating system for everything.

greEd · Post by **greEd** » Tue Mar 08, 2005 7:56 pm

TonyT wrote: I dig both windows and nix, it would suck to be bound to only one operating system for everything.

Words of wisdom.

Well said.

cyberskye · Post by **cyberskye** » Wed Mar 09, 2005 12:56 am

You still miss my point - which was that windows is probably not the best choice for a public server - unless you enjoy the challenge of keeping up to date on security. I can tell that there will be no headway here so I will stop now.

Based on your initial quesitons, I assumed you did not have a complete knowledge of apache nor MSI (the latter of which I don't either). Apparently I was incorrect.

Have fun,

Skye

in2deep wrote:I got somewhat defensive because of the implication in...
... I read that as "If you run a production server on Windows you are not being responsible", or more simply that I am stupid. Whatever, it is unimportant.

What I did say though was...... and you have not done so. You have presented more generalisations.

Can you give me an example which I can test here which will show Apache failing under Windows? None of the little sods that trawl the net looking for weak systems to attack and undermine have managed to do so.

FBI has no jurisdiction here.

*** EDIT ***

I re-read my original post. I can see what caused at least some of the confusion. When I said 2.0.53 was now available as an .msi, it could have been interpreted as you have, i.e. that this was the first .msi version, rather then the actual meaning, which was the 2.0.53 .msi installer was now available, it having been released about a week after the .nix versions. Normally the *nix and Windows versions are released at the same time.

in2deep · Post by **in2deep** » Wed Mar 09, 2005 5:55 am

Based on your initial quesitons

My original question was...

Has anyone gone 2.0.52 -> 2.0.53 using MSI?

... the answer apparently being - No.

I had no desire to get into an OS, or security debate. It was TonyT and you that raised these issues.

cyberskye · Post by **cyberskye** » Wed Mar 09, 2005 12:23 pm

I was qualifying my remarks - I have not installed apache on windows. I then explained why. You seemed to get defensive, or at least to further comment on my reasons for not installing apache on windows. Your thread, so wherever you chose to take it is cool.

Whatever works for you is what you should use. I ran a farm of solaris boxes running apache w/Oracle backend for a few years. Converted them over from a windows shop because that part of the gov't decided that windows on public servers was not a good idea.

Did you ever find out why the new msi package is smaller?