[Xitami] Xitami (dis)advantages

[Thomas J. Hruska]

At 07:50 AM 7/1/2003 +0200, Marc Doigny writeth:
>Hello !
>
>Another "missing" feature in Xitami is the lack of ISAPI. This protocol 
>seems to be getting a standard for fast cgi.
>In the normal version of cgi-bin, when a user clicks on a cgi-bin page 
>(pointing to an executable), a complete new environment is created for this 
>executable.
>This can take some time.
>When using ISAPI, when a user request a dynamic page, the server calls the 
>adequate routine in a DLL. This is much faster: no environment to create, 
>and presumably the DLL is already in memory. But since the DLL resides in 
>the same memory space as the server, a simple error in your DLL will pull 
>the server down. When using normal cgi, an error in your executable is 
>detected by the server, and it return an error to the client.
>ISAPI is quite a mixed blessing.

Have you tried the ISAPI Beta add-on for Xitami?  It uses LRWP (can't
remember if it uses LRWP 1.0 or 2.0 - neither version is that great in
either security or performance, IMHO), so if the DLL crashes, only the
connection to Xitami dies instead of the whole server.  The ProtoNova Web
Server has full LRWP 1.0/2.0 support as well and can run the same ISAPI
Beta Add-on module that Xitami has.  So, for all three servers (Xitami,
ProtoNova, and Sambar), ISAPI support exists...can't say anything about
Sambar's support for it, but it probably has "mixed blessings".

However, when it comes to ISAPI for Xitami (or ProtoNova), there is no
"mixed blessing" unless LRWP itself dies (I have yet to hear of this
happening...but not many people use LRWP because it takes some effort to
set up).  (BTW, the core ProtoNova server will keep running even if the
LRWP Remote Module dies).

>You can password-protect directories, but it seems impossible to protect 
>execuables.

Only if you stick your executables in cgi-bin.  Granted NT security stinks,
but if you implement it properly and you don't put executables in cgi-bin
(or any other web server accessible location), you are fine.  Now if you
can't trust the users on your system (assuming a VHosted type of
situation), that's a completely different story and you have more problems
than just protecting a directory.

>Overal, Xitami is a simple and easy to use webserver.
>Sambar is more up-to-date, has more features, but is more difficult to 
>implement.

Agreed, Xitami and ProtoNova are equally simple to set up.
Sambar isn't that tough to set up but tends to have the Apache
"look-and-feel," which I don't care for.

More importantly than ease-of-installation is security.  Instead of asking,
"How easy is this to install?"  The question you should be asking yourself
is, "How long does it take to secure this sucker?"  IIS takes about half a
day (IF, and that's a _BIG_ 'IF', you know what you are doing) or more (up
to 3-4 days) to secure it and apply all of the patches.  Xitami and Sambar
take anywhere from 1 hour to 1 day to secure.  ProtoNova comes secured
out-of-the-box.  Obviously, features like ISAPI are important, but they
shouldn't be the deciding factor as to the server of choice.  If security
and server stability are concerns for you, the following information was
compiled one year ago about various servers:

http://12.210.108.203:83/search.nvm?searchname=Web+Server+Comparisons

Even though I wrote that document, I gave each web server a fair trial and
did my best to be as unbiased as possible in the results.  The only bias
was the order in which I would choose a web server - Xitami still being
second to ProtoNova (for obvious reasons)...IIS is appropriately ranked
just slightly above servers almost no one uses or should use.

The funny thing about that document is that Ashley Brown herself (author of
iWeb) e-mailed me about why the iWeb server was ranked the lowest server in
that list...which says that people actually use that list to choose their
web server based on security, stability, and important features.  I figured
that no one would read it...guess I was wrong there!  The OP and others
will find the aforementioned document intriguing and a good read with a
focus on the right topics of, IMO, security and stability for side-by-side
comparisons of web servers (most web server comparison charts focus solely
on features - this one focuses on how the server works on the inside from a
security and stability standpoint as well as a deep understanding of the
Windows platform - definitely worth checking out!).

Please note that while ProtoNova is my personal server of choice (I wrote
ProtoNova and enjoy maintaining it), I highly respect the Xitami server and
iMatix and everything they have done thus far.  I have a few complaints
that iMatix already knows about, but even then Xitami still runs on port 80
on my machine and I have yet to see it crash under XP.

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/