Why I Hate the Apache Web Server

schon writes "Today's the last day of ApacheCon Europe; There was a hilarious presentation entitled 'Why I Hate the Apache Web Server' for anyone who has expressed frustration with the various inconsistencies and nuances of the Internet's favourite config file. And yes, it includes a comparison to Sendmail."

Whoops

I think the subject was supposed to read, "Why I hate PDF files."

Re:Whoops

Yeah, I think they will find some new reasons to hate Apache in about 3 minutes...

Coral Cache [nyud.net] of the PDF...

Re:Whoops

That's funny; I though it was entitled "Why I love xpdf." I wonder what could have given me such a strange notion...

Re:Whoops

That, or "Why I love kpdf".

Really, the version in KDE >=3.4 is incredible.

News for nerds

News for Nerds

Wow, you ain't fuckin kidding, are ya?

Re:Whoops

Ah, what you want is the PDF Download [mozilla.org] firefox extension.

When you click on a pdf it displays a choice of opening it in a new tab, downloading it , or viewing it as HTML (which i think uses google, but i could be wrong because i never use this option)
It really saved me.

Why I hate PDFs

OK, so this is a PDF file that looks like a Powerpoint presentation and it is about how much he hates Apache. *head explodes*

Here is a html version, [samurajdata.se] I doubt it will stay cached for very long though.

Re:Why I hate PDFs

It's not necessarily dumb. Latex-Beamer [sourceforge.net] can produce, IMO, the nicest "PPT-like" presentations I've seen.

Those PDF's again... aaargh

Could the on-duty-editor-at-the-moment PLEASE add small note after the links IF TFA is in fact A PDF file. Please? That is NOT too much to ask, I hope. Sorely hope.

And no, I didn't RTFA, which was in fact TFPDF.

Re:Those PDF's again... aaargh

I suspect most people here are able to position the cursor over the article link and look in the status bar, note the .pdf at the end of the URL, and know that this is a PDF.

Assuming they are able to do it is one thing. Expecting them to do it every time they follow a link is another thing entirely.

Re:Those PDF's again... aaargh

Well, until they feel like adding a PDF warning, you should get the PDF Download [mozilla.org] extension for firefox. It's small, simple, and prevents PDF ambushes from raping your system's resources.

Re:Those PDF's again... aaargh

Put this in your userContent.css:

a[href$=".pdf"]:after {
font-size: smaller;
content: " [pdf]";
}

I also find the following useful:

:link[target="_blank"]:after, :visited[target="_blank"]:after,
:link[target="_new"]:after, :visited[target="_new"]:after
{
font-size: smaller;
content: " [new]";
}

a[href^="javascript:"]:after
{
font-size: smaller;
content: " [shite]";
}

Re:Those PDF's again... aaargh

But... Why would you have your browser opening the file directly without asking you, if you don't like that behaviour?

It's not like it's a HTML page with a lot of process consuming javascript, java-that-requires-a-lot-of-loading-of-the-java-en gine or the like. It's a totally different content type. You have every way of choosing what to do with it.

Instead you choose to be annoyed. I don't get it.

Re:Those PDF's again... aaargh

For anybody willing to make comments on the content instead of the form, here it is :

Why I Hate The Apache Web Server
Lessons learned from IRC - Rich Bowen
Note: Opinions expressed are those of our users, as expressed on IRC. The goal of this talk is to make people aware of things which those "outside" see as problems, but which we tend to be so used to that we don't see at all. If I get carried away, feel free to throw fruit.

Why do I hate thee? Let me count the reasons.
- Fragile
- Confusing
- Missing stuff that EVERYONE asks for

Fragile
- Breaks easily. Small changes have big results

Options +Indexes Includes MultiViews
Options Indexes Includes Multiviews

The first of these forbids Indexes. The second one permits them. Huh?

Disclaimer
"But that's not supported syntax!"
Then it should throw an error and break, not do something utterly unexpected. Unfortunately, several major Linux distros ship with this broken-but-almost-looks-right configuration, or variants thereof

Example 2
Vhosts ... wow, don't get me started

# My IP address is 192.168.1.200
NameVirtualHost *:80
<VirtualHost 192.168.1.200:80>
...
</VirtualHost>

That vhost is silently ignored. Yeah. That's intuitive.

Discussion
"But the docs say not to do that!" Yes, I know. I wrote that line in the docs. It's still really irritating.

Another ...

Require Valid-user

Unlike every other Apache config setting, "Require" is case sensitive, so that's not valid valid_user would be nice too. Oh, and "Require User" and "Require Group" don't work either.

Missing (asked daily on IRC)
- Can I set a variable and use it later?
- Can I have an if/else syntax?
- Can I please reload my configuration file without restarting my server?
- How do I make ServerTokens return "Bob's Handy Dandy HTTP Server"? (Yes, this is silly, but it would sure shut a lot of people up finally.)

What else? mod_imap: how many of you have actually used that module? How many of you who are not committers know what it does? Why is it on by default? Come on folks. Netscape added client-side image maps in 1995!

And while we're on the topic mod_cern_meta: Who even knows what this module does? For the record, yes, I do. But I doubt any of you have ever used it.

CONFUSING
NumServers ServerLimit ThreadLimit ThreadsPerChild StartThreads StartServers MaxSpareThreads MinSpareServers MaxSpareServers MinSpareThreads MaxClients MaxThreadsPerChild MaxRequestsPerChild MaxRequestsPerThread ThreadStackSize
Oh sweet God make it stop

What's that directive called?
RLimitMem, RLimitCPU, RLimitNProc? I have to look these up every time. Of course, since they don't seem to do what the docs say, maybe that's not a bad thing.

Am I running out of time yet?
- Why do I have to set up two separate vhosts for http://example.com/ [example.com] and https://example.com/ [example.com] when they're the same website?
- Why are dynamic vhosts so darned hard?
- Why doesn't the default configuration file match the "security tips" document?

mod_rewrite
I probably don't need to say anything more than just "mod_rewrite". But I will: "Voodoo" and "... flexibility of sendmail". The docs practically scream "GO AWAY!"

RewriteMap
Nice, but have you ever found an actual useful example? Oh, and the example script for generating db map files doesn't actually work. (Note: Paul fixed this 2 weeks ago. See httxt2dbd)

How about this?
If I want these two aliases to work, I have to:

Alias /foo/bar

Some more

OK, let's see it:

First, we have this [apache.org].

And a quote from the default config file:

# Specify a default charset for all pages sent out. This is
# always a good idea and opens the door for future internationalisation
# of your web site, should you ever want it. Specifying it as
# a default does little harm; as the standard dictates that a page
# is in iso-8859-1 (latin1) unless specified otherwise i.e. you
# are merely stating the obvious. There are also some security
# reasons in browsers, related to javascript and URL parsing
# which encourage you to always set a default char set.

OK. So I'll define as follows:

AddDefaultCharset UTF-8

Then, we have this [w3.org].

OK, so I have some legacy documents, so I'll just define as follows in <HEAD>:

<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

And let's try it out... WTF?? It does not work! My browser thinks it is UTF-8.

Oh wait, it actually works, if I'll define this instead of that above:

<META http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

Brilliant! So if the AddDefaultCharset is defined in httpd.conf, the Content-Type encoding of the actual document must be defined in lowercase, or it'll be ingnored! Now, where the f*** this is documented??! Examples at w3.org specifically uses uppercase. Apache permits uppercase in httpd.conf.

Apache messed it up again.

A 666KB PDF...

Coincidence? I think not!

You might hate Apache but....

atleast a decent Apache install can keep on chugging along even when faced with a slashdotting.

Re:You might hate Apache but....

My main complaint about Apache is that it makes it difficult to divide up users' dynamic content.

If one user wants mod_perl, one wants php, and one wants mod_ruby, you pretty much have to have different webservers running, which means an administrative hassle and separate IPs.

There are a couple solutions I can think of:
(1) Change unix user permissions after it's selected a vhost, but before running any code or accessing files. Not just for CGIs, either, but modules.
(2) Make it easier to run seperate webservers as if they are one. Basically take the administrative hassle out of running multiple webservers.

Right now ISPs basically just offer PHP and use safe mode. But that doesn't help other languages, and it's basically a php hack.

It would also be nice if problems with one vhost didn't prevent the entire server from reloading the config. It should give a nasty error maybe, but the webserver shouldn't shut down the working vhosts, at worst it should leave it as it was before the reload.

Maybe, maybe not

I've seen IIS sites handle a /.ing fine, I've seen Apache dragged to the dirt. Why? Well /.ing kills sites one of two ways:

1) Bandwidth. Whatever if being offered is large enough that the line it's on becomes highly over saturated and thus requests are processed very slowly, if at all.

2) CPU load due to dynamic content. Sites that use databases, or scripts to create their pages or something get overwhelemed because they don't have enough CPU to support all the requests.

The webserver itself isn't the problem. Either Apache or IIS can easily saturate a 100mb link with static content, even on a fairly old server.

When I worked for the school paper and we were linked, it was no problem at all. The line was 10mb, and the content was fairly small (say 300-500k total) and all static. Despite being a P2 300 the server didn't even break a sweat, load average was below 1. When the department I now work at was receantly linked for a comet simulator, it killed out webserver, despite the content being about 2k and it being a fiarly fast SPARC machine. The reason was each request required computation, so our load average was about 100.

Apache being able to survive a /.ing isn't at all impressive, it's expected. Any webserver worth it's shit should be able to had out massive amounts of data with little resource usage. It's other processing like PERL scripts, DB requests, SSL, etc that kill it, or simply overtaxing the available bandwidth.

Bandwidth is actually fairly common, many servers are run on small lines. I have a couple servers in my closet on my 768k up line. That is plenty for normal usage, people find the sites quite zippy. However Slashdot would easily overwhelm that bandwidth.

Re:is this the internet ?

Don't be silly. PDF files are very useful to distribute printable materials, such as books, spec sheets, PR and corporate bullshit (ugh), brochures, etc... Remember that PDF is essentially Postscript wrapped in an Adobe straightjacket.

What does piss me off is:

- People who use PDFs to make read-only documents
- People who use PDFs where html or text is adequat and sufficient.

I don't see why they require me to lauch that hateful Acrobat Reader when a browser does a better job.

Comic Sans is.....

NOT A FONT. ok? Repeat after me, Comic Sans Is Not a Font! In 1995 Microsoft released the font Comic Sans originally designed for comic book style talk bubbles containing informational help text. Since that time the typeface has been used in countless contexts from restaurant signage to college exams to medical information. These widespread abuses of printed type threaten to erode the very foundations upon which centuries of typographic history are built. While we recognize the font may be appropriate in a few specific instances, our position is that the only effective means of ending this epidemic of abuse is to completely ban Comic Sans. http://bancomicsans.com/home.html [bancomicsans.com]

Christ, stop complaining about the PDF

It's not the PDF format that sucks, it's Acrobat Reader. Use Preview or XPDF [foolabs.com].

Complaining about PDFs is like complaining about HTTP cause you don't like IIS.

Re:Christ, stop complaining about the PDF

I rescind my earlier statement. That's a really bad PDF. If PDFs were a food, that PDF would be shit-stewed haggis.

Re:Christ, stop complaining about the PDF

Hey! Don't knock the haggis! Instead, knock something that really *is* shit stewed, like Jack in the Box [jackinthebox.com]. They've had 12 E. coli outbreaks that I can remember in 10 years, and that's only counting locations near me...

Pony

Nice touch with the pony bit.

"Not yours."

Hilarious?

If the presentation was Hilarious, I assume that in future Apache configuration will be easier.
Otherwise I'd define it "sadly realistic"...

How to fund Apache improvements

I worked at Sun and tried to fund Apache improvements to make it smoother for my team's webmasters. No luck.

Apache is great but it could be *significantly* easier for beginning webmasters. And for companies to fund changes.

The 2G file limit...

Sitting in #apache on freenode is actually fun sometimes. You'll actually see these common things bought up by many people every day. The PDF actually touches on only a few of the "problems" that the conf file has.

However, its the 2G file limit that makes me laugh. Sure, there's LFS (Configure 1.3 with CFLAGS="-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64", enabled by default in 2.0.53 (and higher) and in 2.1), but to be really honest, there are far better ways to send large files. HTTP isn't one of them. There's FTP and there's also torrents; Both of which have the advantage of being designed for files rather than 'hypertext', which by nature is normally text...

NeoThermic

Re:The 2G file limit...

HTTP doesn't really have much to do with hypertext. A small percentage of the bits transferred via HTTP are text/html (think images, flash and java, and of course PDFs). In many ways, HTTP is a better file download protocol than FTP:

• doesn't need a second port for transfers (so no firewall "fun")
• byte ranges allow a client to only request part of the file (great for file completions)
• easier to do per site, per directory, or per file authentication (since authentication is per request, not per "session")

Re:The 2G file limit...

PASSV does NOT fix this. Passive still uses second ports it just changes the direction of the connection. On all firewalls you have to load extra stuff to properly allow the connection to work or fully open all outbound traffic. On IP Tables there is an ftp_contrack module to load, on PIX there is a fixup protocol to load. The fact is FTP is the most broken protocol there is. There is no reason that everything cannot be handled over a single port and the security issues involving race conditions, bounce scans, clear text sign on and transfer, are unacceptable. The ONLY thing going for it is tradition.