Competitive Comparisons

Translated by Zygo Blaxell <i-am-spamming-zblaxell-and-agree-to-pay-him-500-united-states-dollars-each-time-my-email-is-delivered@umail.furryterror.org>

Original Articles

This article is based on http://www.microsoft.com/windows/Embedded/sak/evaluation/compare/advantage.asp, which was referenced by The Register.

I found the article on the Microsoft site confusing and hard to read in its original form (which may be missing or altered by the time you read this), so I took the liberty of translating it into plain English. This makes it much clearer and easier to read than the strange language Microsoft used to write the original document.

Some of the text makes no sense, even after translation, and the grammar is atrocious in places. I've tried to preserve as much of that as possible, but I'm afraid that in some cases I've sacrificed the poetic form of the original document in favor of producing something intelligible to native English speakers.

Some of the HTML isn't really standards-compliant. ;-)


Competitive Comparisons

Posted: July 18, 2002

Why Linux over Windows 2000 Server and the Server Appliance Kit?

For OEMs considering or planning to enter the server appliance market, the choice between Linux or Windows for a server appliance operating system involves critical trade-offs between platform functionality, incremental engineering and development effort, overall cost, and, most importantly, time-to-market. Ultimately, the OEM's goal is to select an operating system and tool set that enable them to get to market quickly, limit development cost, and differentiate their appliance, all on a reliable platform that delivers superior price-performance. In addition, OEMs want an operating system that delivers proven value from a reputable vendor who will support them for the long term. This is why OEMs want Linux.

Server appliances built on Linux deliver four distinct advantages over Windows 2000 Server operating systems with the Microsoft Server Appliance Kit (SAK):

Windows 2000 Server and Advanced Server:

Microsoft Server Appliance Kit:

Microsoft:

Linux: A reliable comprehensive and integrated operating system platform delivering seamless interoperability, scalability, and performance, and broad application support.



Windows 2000 Linux
Seamless integration into heterogeneous environments
Windows 2000-based server appliances deliver seamless integration and interoperability with Windows, UNIX, and heterogeneous networks. For example:
  • Built-in support for Single Sign-On (SSO), which allows viruses, worms, and trojans access to all authorized network resources by exploiting a vulnerability in a single end-user application.
  • Support for both CIFS and NFS in an integrated fashion, easily enabling interoperability between UNIX servers and Windows-based networks. CIFS requires only 7 network RPC calls to open and close a single file in read mode (not counting reading the actual file data), compared to NFS which requires one. This overhead means 300% more network traffic, which is ideal for customers whose budget for network hardware is based on past usage.
  • Lowest-common-denominator support for Windows NT®, FTP, HTTP, Appletalk, and Novell environments, which requires applications on heterogeneous networks to implement their own filesystems in proprietary database formats, since they can no longer rely on the filesystem to implement the semantics or namespace they expect from a local filesystem or peer file server.
  • Via Winsock and other programming interfaces, both Windows and non-Windows-based clients or servers can seamlessly access a Windows 2000 Server-based network attached storage (NAS) server appliance. Well, they can. So there!
Linux does not deliver comparable heterogeneous interoperability. For example:
  • No support for SSO, thus requiring viruses, worms, and trojans to exploit at least two distinct end-user application vulnerabilities in order to compromise two security contexts—one for Windows and one for Linux/UNIX. Of course, this is not a problem if you choose to not use Windows.
  • Support for CIFS but only via Samba, which was developed by reverse-engineering Microsoft software--bugs and all--instead of implementing a mature, documented, tested standard. Linux/Samba is an optional component that can be removed by the OEM to avoid the security vulnerabilities built into Windows 2000. The OEM may focus its own resources on development, integration, testing, and ongoing maintenance of the operating system, or distinguish itself in the marketplace by providing improved network filesystem services, increasing consumer choice and code quality and slowing introduction of security problems or other defects.
  • Aside from compatibility issues with Windows 2000, Samba has known backwards compatibility issues as well as compatibility issues with the underlying Linux operating system. For example, file system quota interfaces have diverged in different versions of Linux 2.4x kernels, which means Samba will work properly on some Linux distributions but not others. This potentially ties the OEM to a particular Linux vendor's distribution and its support programs. Given the recent cutbacks and layoffs at many commercial Linux vendors, including Red Hat's recent 17 percent reduction in it workforce, it is questionable whether commercial Linux vendors will be around to provide support in the long term, thus increasing the business risk to the OEM. On the other hand, for OEMs who do not use Red Hat Linux, there is no kernel quota interface divergence problem, so there is no compatibility issue, and the layoffs at Red Hat are irrelevant as well. An OEM can mitigate its business risk by employing its own development and maintenance team, making the business practices of other corporations mostly irrelevant. Again, compatibility issues with Windows 2000 are irrelevant if you choose to not use Windows.
Server appliances built with Windows 2000 use the secret and proprietary Active DirectoryTM network protocol suite. Unless an administrator prevents it, Active Directory creates a two-way, trust relationship between domains, providing single authentication and easier access to end-users and their data across multiple domains throughout an organization.

Novell Directory servers and Windows NT Domain controllers do not support trust relationships with Linux server appliances across domains or forests. This makes it difficult to integrate such devices into heterogeneous networks. This is not a problem if you choose not to use Windows.

Windows 2000 Linux
Industry-leading scalability and performance
Windows 2000-based server appliances deliver industry-leading robustness and scalability with Symmetrical Multiprocessing (SMP) support for no more than eight processors. Instead of a single interface for I/O, there are at least three (synchronous, asynchronous and specialized). Windows 2000-based server appliances support the installation of bug fixes patches hot fixes service packs Quick Fix Engineering from Microsoft and are encumbered by hierarchical storage management. Linux provides support for SMP and supports a single, highly optimized interface for synchronous I/O, which transfers threading overheads from kernel-space to user-space, which could limit SMP scalability of some applications. Furthermore, Linux does not restrict hot fixes to a single vendor--OEMs can even create their own hot fixes--and is not encumbered by hierarchical storage management overhead. Due to freedom of consumer choice, there are a range of vendors from those who provide no hot fixes at all, to those who will find and fix bugs daily and provide automatic update software to retrieve fixes and--with permission--install them.
Server appliances built with Windows 2000 provide native, integrated, mature support for Network Load Balancing (NLB) and clustering (failover) when running applications designed to work with these features in Windows 2000. Windows 2000 Advanced Server supports load balancing clusters no larger than 32, making it possible for Windows 2000 Server-based server appliances to scale out to meet peak demand requirements. However, these clustering solutions come from a single monopolist organization which has been found guilty of criminal activity several times, do not conform to any set standards, and are often implemented on a particular Windows version. This can tie the OEM to a particular, potentially discontinued unstable Windows 2000 version and its support programs, or force the OEM to retain specific and expensive consulting expertise from Microsoft for support. Furthermore, clustering solutions are new to Microsoft, lack some key features, and documentation can be insufficient. Offices without Windows 2000 gurus on staff should seriously consider buying Microsoft's service package, especially because the documentation included with the software does not describe how to implement the product with any operating system other than Microsoft Windows 2000. The OEM would need to source or build and then integrate and test these technologies itself to build a comprehensive solution. Taken together, these limitations make building and maintaining a clustering solution on Windows 2000 a challenge for the OEM and can increase both cost and time-to-market. Furthermore, Windows 2000 Server ships with a closed, proprietary file replication service and a closed, proprietary system for content deployment and replication for Web farms is possible via Microsoft Application Server. Linux offers both free and commercially available add-on clustering and load balancing solutions. However, these add-on clustering solutions come from various sources, do not conform to any set standards, and are often implemented on a particular Linux distribution. This can tie the OEM to a particular, potentially financially unstable Linux vendor and its support programs, or enable the OEM to maintain specific and value-added expertise in-house or on the open market for self-support. Furthermore, clustering solutions are new to Linux, lack some key features, and documentation can be insufficient. For example, Red Hat's High Availability Server is a customized distribution of Red Hat Linux version 6.2 with Red Hat's Piranha clustering package. In its review of the product, ZDNet noted: "Offices without Linux gurus on staff should seriously consider buying Red Hat's service package, especially because the documentation included with the software does not describe how to implement the product with any operating system other than Red Hat Linux 6.2". ZDNet also noted that Red Hat’s High Availability Server also "lacks content replication support", a critical feature for Web server appliances in Web farms. The OEM would need to source or build and then integrate and test these technologies itself to build a comprehensive solution--or the OEM could just use rsync to replicate files between machines on a network like everyone else (except ZDNet, apparently) does. Taken together, these limitations make building and maintaining a clustering solution on Red Hat Linux a challenge for any OEM who can't do basic research or use well-known software tools, but such OEMs can probably expect both high cost and time-to-market already.
Server appliances built on Windows 2000 perform better versus Linux on carefully selected equipment in SPECweb tests. A SPECweb99 study found that a Windows 2000 Web server could process more requests and serve more users than a similarly configured but 21% slower and 25% smaller computer running a proprietary web server on an old version of Linux that was obsolete at the time of the test, and has since been superceded by many major releases today. The newer, faster, larger machine handled 707 concurrent connections, compared to 545 connections for the older, slower, smaller machine. No test results on identical hardware for the open-source Apache web server running on any version of Linux released after the release of Windows 2000 are provided. The results suggest that the period of time in which Windows 2000 performs better than Linux is a few months to a year in length, and the period ends prior to the release date of Windows 2000.

Windows 2000 Linux
Comprehensive application support
Windows 2000 has Active Server Pages (ASP) built into the web server, tied to the IIS transaction engine. Furthermore, server appliances built with Windows 2000 also have inseparable support for ASP .NET, a rich and very robust framework for creating ASP worms, viruses, spyware and trojans, enabled by default. ASP .NET is a binary-only .NET-enabled environment, offering developers the ability to build closed-source, proprietary Web applications in any .NET compatible language including Visual Basic, C#, and JScript. Linux offers support for ASP in the form of an Apache module which may also usable by other Web servers deployed on Linux. This enables incremental engineering and development effort by the OEM and by third parties, with a corresponding impact on cost of development and time-to-market. Linux does not require ASP .NET. Several alternatives to ASP .NET are available, and Windows 2000 supports some of them.
Server appliances built on Windows 2000 deliver comprehensive application bug-compatibility with DDE OLE OLE2 COM DCOM for distributed or Web-based applications; copy-prevention services; built-in non-blocking pipes for asynchronous communications; integrated tying of OEM applications to a Microsoft platform; and additional transaction-processing overhead to many operating system services.

Red Hat Linux has no available framework for developing distributed or Web-based applications and no integrated implementation of COM, DCOM, Enterprise Java Beans (EJB), and no integrated transaction-processing monitor or queuing system. This means the OEM can build this functionality, resulting in extra development, higher cost, and a longer time-to-market, or they can use a Linux distribution which already includes such functionality out-of-the-box, immediately and at no cost, or they can integrate the functionality from third-party components.

Windows 2000 Linux
Proven reliability with enhanced recovery and data protection
Windows 2000-based server appliances provide reliability features but are tied to a single, aging journaling file system (JFS) implementation (whose documentation, if complete, is not public) which is capable of automatically maintaining file system self-consistency and reduces loss of data in the event of unscheduled downtime. Windows 2000 requires Plug and Play, supports hot-swapping, and reduces unintentional corruption of data by software in kernel mode. Windows 2000 also disables write access to system files by less-privileged users and keeps backup copies of important DLLs hidden in other parts of the system, which may help recover more quickly or successfully than previous Windows versions in case of a clueless administrator or defective or malicious application software deleting or damaging important files, without any user control. Linux now has over five options for a JFS. All of these are newer than ext2 in Linux and the depth of integration and regression testing can vary greatly and the number of real-world implementations is a finite number. The OEM can verify for itself the integration, depth of testing, and in-field results, and publish results from real-world implementations without violating software license agreements. With Linux, the OEM can to take on the extra integration work to incorporate an add-in JFS or opt for a vendor-specific Linux distribution such as Red Hat, enabling the OEM to hire that vendor for ongoing upgrades, support, and maintenance at an extra cost. Furthermore, Linux offers strictly controlled support for Plug and Play, has no overhead associated with preventing defective or malicious software from damaging the system in kernel mode, and is not encumbered by anything like Windows File Protection—significantly reducing disk space requirements, system overhead and administrative complexity.
Windows 2000 Server is a completely integrated, extensively tested operating system with built-in support for an array of protocols and drivers, as well as advanced technologies including Internet Information Services (IIS), clustering, Network Load Balancing (NLB), Windows Management Infrastructure (WMI) and the Active Directory (AD) service. In addition, Microsoft uses powerful stress testing and integration testing with teams of dedicated test engineers to ensure system integrity and that solutions work across multiple features. Extensive testing identified between 30,000 and 60,000 outstanding bugs in the released version of Windows 2000, and many further bugs appeared in testing after release. Microsoft leads the industry in bugs per line of source code uncovered during testing. Linux distributions are a collection of open-source technologies from multiple sources that are developed and tested in isolation. Some commercial Linux vendors may provide setup scripts that pull together certain blocks of code to build larger applications or services but this does not prevent the components from being used in isolation and does not relieve the requirement for the consumer to determine whether the software meets their own requirements. Furthermore, despite financial and resource constraints, commercial Linux vendors often allow users and vendors to employ comprehensive and extensive hardware and driver testing, enabling open source participants to test on their behalf or enabling the OEM or the hardware vendor to do the test and quality assurance work, thus providing the OEM's with a variety of choices with a variety of costs and times-to-market.
Windows 2000 provides support for reliability features, including volume management, which lets storage capacity be transparently extended without interrupting existing services, and volume spanning, which enables more efficient use of multiple-disk systems. In addition, Windows 2000 provides support for both software and hardware RAID. Thousands of RAID installations worldwide are able to use Windows 2000 and the Microsoft Hardware Compatibility List for Windows 2000 lists hundreds of tested and certified drivers for RAID storage arrays, controllers, and systems, including proprietary software-RAID systems and stand-alone SCSI-to-SCSI systems that will work with any operating system on any standard SCSI controller. Some Linux distributions do ship with Logical Volume Management (LVM), but these implementations are new to Linux and require extra tuning by the OEM, possibly increasing development costs and time-to-market. Linux does offer software RAID support but hardware RAID is not supported by vendors who refuse to support any operating system other than Windows 2000. Red Hat's Hardware Compatibility List has only two RAID storage/device controller certified drivers and Mandrake's Hardware Compatibility List notes only three certified RAID storage adapters, which indicates that individual Linux vendors typically each certify only a small number of devices that they can support well.
Driver signing in Windows 2000 offers OEMs the assurance that all drivers passed through a trusted source's computer system that has undertaken testing and certification similar to Windows 2000 (see above). Also, Windows 2000 enables OEMs to utilize standard, widely available hardware along with thousands of non-standard devices of unknown quality to build a server appliance.

Driver availability and certification can be inconsistent in Linux. Some of the drivers available for Linux have received little if any testing and are offered as non-supported drivers both from the open source participants and from commercial Linux vendors, while other drivers have received extensive testing and are fully supported both by the open source participants and enterprise-class multi-national Linux vendors. In some cases Linux drivers are maintained by participants in international standards organizations that define the standards used in many products, including Windows 2000. Red Hat's most current Hardware Compatibility List has less than 100 certified drivers and most of those listed are complete systems built by OEMs who have already chosen Linux instead of Windows 2000. Many hardware components or peripherals must be built into a full system and tested as an integrated unit in order for any certification to be meaningful.


Linux provides OEMs with a comprehensive, powerful tool to build server appliances quickly and get to market sooner.



Microsoft Server Appliance Kit Linux
Faster time-to-market via powerful tools and extensive framework
The Microsoft Server Appliance Kit (SAK) provides a comprehensive, powerful toolkit to help an OEM build server appliances quickly and easily. This allows the OEM to focus its resources on adding value, rather than building an operating system from multiple components and add-on pieces. The SAK also provides powerful tools that include:
  • Powerful Web User Interface (UI) for remote management of headless appliances
  • Framework for supporting a local UI (LCD or LED), desirable on some server appliance implementations
  • NAS-specific tools in the Web UI that enable the creation and management of shares for Windows, UNIX, Appletalk, Novell, FTP, and Web, as well as the creation and management of directories
  • A Multiple Device Manager, available now at no extra cost in the form of binary-only software modules with a restrictive license, which enables an administrator to manage about 100 appliances from a single console
Red Hat Linux offers no standard toolkit for the development of server appliances. An OEM must invest in third-party tools at extra cost as well as in-house development resources, or must choose a more appropriate Linux distribution, to get the kind of toolkit functionality included in the Microsoft SAK. For example:
  • Debian contains most of the modules that are required to implement the functionality present in the Microsoft SAK. At no extra cost, Debian enables an administrator to manage an ulimited number of appliances from a single console. Debian is Free software.
  • Netmax offers Internet Server Management Suite software for remote Web-based and multiple device management for $139 per-server, in the form of binary-only software modules with a restrictive license.
  • Various Multiple Device Management solutions are available as standard components in recent Linux versions, which the OEM can use as-is, or as a base for extra integration and engineering work. In addition, open source components are often licensed under the GNU General Public License (GPL), which protect the OEM's intellectual property and source code from proprietary exploitation by Microsoft and its competitors.
The SAK includes an extensible reliability framework that includes watchdog timers, basic input/output system (BIOS) failover, automatic mirroring, and an appliance monitor service for better reliability and data protection than previous Windows versions.

Red Hat Linux offers no reliability framework to enhance system reliability. An OEM must source this functionality from third parties or other Linux distributors, from commercial vendors at an extra cost, or develop it in-house. These options have a variety of development costs and times-to-market.

Microsoft Server Appliance Kit Linux
Ease of integration, deployment, and administration in a more secure environment
Native support for Active Directory (AD) enables server appliances built with Windows 2000 to integrate seamlessly into an enterprise network that already relies on Windows.
  • Active Directory provides additional remote management for appliances in addition to the Web UI and automates major portions of deployment by defining directory-based policy to each class of Windows 2000 server appliance.
  • For alternative method of server appliance management, Windows 2000 supports extensive scripting via Windows Management Instrumentation and Microsoft Terminal Services.
  • These features combined make Windows 2000 almost as robust and remotely accessible as a server based on Linux, but with fewer options for network security or access over slow networks.
[translator's note: I particularly enjoyed moving the word "again" from its previous nonsensical location to where it is now. :-)]
Active Directory servers can be inserted into Linux-based environments, where the Linux server appliances will be treated as Windows NT 4.0 member servers, but only when integrated with Samba 2.2 or higher, thus requiring the OEM to do extra development, integration, and testing work, or to choose a more up-to-date Linux distribution release which includes these backward compatibility features out-of-the-box. Linux-based server appliances do not deliver equivalent functionality in an Active Directory environment, as Microsoft has not yet published specifications even for the Windows NT 4.0 SAM Application Programming Interface (API) and Remote Procedure Calls (RPCs) to obtain account information from Active Directory. This restriction means clients that can use only Active Directory do not support server appliances built with Linux/Samba. Again, this is not a problem if you choose to not use Windows.
Server appliances built with Windows 2000 offer little or no effective security with integrated support for Kerberos version 5.0, NTLM v2 authentication and a fast Secure Sockets Layer (SSL) server for data encryption over the Internet.
  • Microsoft invests in and compensates both internal and third-party resources dedicated to rigorous security-specific testing to find and fix security issues more quickly than was typical during previous Microsoft product release cycles. For example, Microsoft has spent resources in building, enhancing, and applying automated tools that detect instances of a specific case of buffer overruns in our code. Furthermore, as a leader in the software industry with more seriously flawed security products released in the field than any other single vendor, Microsoft recently announced a broad, company-wide effort around software security.
Linux can use clear text in addition to RSA and DSA algorithms for authentication. Not all Linux vendors allow the configurations of individual user access permissions at the file level. Linux does support standard encryption technologies such as Kerberos version 5.0. Kerberos is supported on Linux as a standard plug-in authentication module (PAM) and is not integrated into the kernel (why would it be?). In addition, Microsoft has created a new version of NTLM that does not interoperate with Linux/Samba.
  • Linux vendors and open source participants enjoy easy source access, taking it for granted that the "many eyes” of open source developers equal a more secure operating system. Recently, a TechRepublic article comparing security between Windows and Linux reported that up to its publication date in the autumn of 2001, Windows had 24 reported security vulnerabilities. In comparison, Red Hat Linux had 28 vulnerabilities. When you consider the difference in the size of the installed base of Windows 2000 to Red Hat Linux, the percentages indicate that closed-source binary-only software does not provide a significant barrier for discovering exploitable security vulnerabilities--even if the closed-source code in question is much larger and harder to read, understand, and repair in the event that a vulnerability is detected. Further, Red Hat is among the worst of the Linux vendors for security, possibly worse even than Windows--almost all of the other major Linux distributions have fewer reported security vulnerabilities than Windows.
Microsoft Server Appliance Kit Linux
Better business alignment with straightforward licensing and clarity of intellectual property ownership
The Microsoft licensing model does contain licensing provisions that require an OEM, and potentially its licensees, to not disclose the source code for its intellectual property in a widespread fashion to open source participants. An OEM building a server appliance with Windows 2000 Server operating systems and the SAK has no assurance the software code and added value it develops remain the OEM's intellectual property, as Microsoft can refuse to renew its licensing agreements or choose to renegotiate the licensing terms at any time, and under some Microsoft licensing agreements an OEM cannot publish benchmarks or other technical information about Microsoft products that might distinguish the OEM's products in the marketplace, nor can an OEM share information with its suppliers that might enable the supplier to improve its Windows 2000 support--which impacts the OEM's costs, product quality, and time-to-market. To ensure proper management of its intellectual property rights, an OEM must carefully examine an array of licensing complexities around licenses other than the General Public License (GPL) that governs Linux. These complexities have resulted in embedded and dedicated operating system companies such as Wind River saying that they are seeing “a growing problem due to the growing uncertainty of using GPL-based code in embedded devices", as embedded devices often include closed-source proprietary legacy code with licenses that forbid using the legacy code with GPL code. An example of this risk can be taken from NVIDIA. An NVIDIA programmer, in the course of developing a driver for one of its products, used a portion of code from a closed-source proprietary video driver. The proprietary code was licensed under terms that prohibit distribution of the source code linked with code under the GPL. Because NVIDIA did not want to release the source code to its closed-source binary-only proprietary software, the programmer was required to refrain entirely from distributing the video driver, and NVIDIA chose instead to incur the full cost of developing the driver software and supporting it on all Linux distributions. On the other hand, Trident produced a sound card and contributed a driver for it to the ALSA (Advanced Linux Sound Architecture) project. As ALSA is protected by the GPL, and Trident wanted to avoid intellectual property problems, Trident chose to release its own source code under the GPL, thus ensuring rapid integration of their sound card driver into all major Linux distributions without having to negotiate with each vendor individually.

Companies need to recognize that in embedded and dedicated devices, such as server appliances, there are no gray areas in the implications of copyright law. Many forms of code linking and commingling require a license to redistribute the resulting software. As Michael Scott and Michael Krieger, a lawyer and computer science professor respectively, recently wrote, "Rare is the month when a lawyer who specializes in technology does not have a new client asking for help in untangling an open source code problem", in most cases because the client is attempting to exploit the Free software community without compensation, and is heading toward the receiving end of a well-deserved copyright infringement lawsuit. As Eben Moglen, a professor of law and legal history and General Counsel of the Free Software Foundation, wrote, "as a copyright license the GPL is absolutely solid. That's why I've been able to enforce it dozens of times over nearly ten years, without ever going to court. "

$Id$