AOLServer Open Sourced 87
Quite a number of people have written in with the news that AOLServer has been open-sourced under a GPLish looking license. You can grab the source or the documentation.
The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.
Re:ha... ha... ha. (Score:1)
What exactly is AOLserver? (Score:1)
It's dead, Jim (Score:1)
It's worse that, Jim, they're fuckwits (Score:1)
I wouldn't use software from people this clueless.
Re:It's worse that, Jim, they're fuckwits (Score:1)
ICMP_FRAG_NEEDED is *vital* for correct functioning of a TCP/IP stack. Without it, many people will simply not be able to communicate with the host. I certainly can't.
Re:It's worse that, Jim, they're fuckwits (Score:1)
I'm just amazed the number of people out there who think they know enough about TCP/IP to set up firewalls and networks, when they're clearly clueless.
Re:It's worse that, Jim, they're fuckwits (Score:1)
Perhaps you should learn something about TCP/IP before you start shooting your mouth off.
License is MPL... (Score:2)
Oh boy... (Score:1)
AIM/TiK (Score:1)
servlets (Score:1)
On the other hand, smart guys like William Crawford routinely turn up on Philip's discussion boards, so someone else may have already started doing this. I don't know (or care) how servlets worked in the old nsdynamo implementation, but Apache-Jserv is a very nice tool, as it makes load-balancing and distributed execution trivial. Jakarta/Apache-Jserv 1.2 plus AOLserver would be very pleasant to work with for platform-agnostic geeks... there are many things to recommend Java (that evil, slow, strongly-typed, bad-for-the-web language from Sun Proprietary Products, Inc and Alan Baratz... "it's just a reference implementation, we can't be held responsible!").
;-)
Re:Dammit... (Score:2)
One: this one never got into the press.
Two: I'm afraid it's quite true. It was true then, and it's true now. If you have an old copy of AOL 2.6 I believe I still have the patch lying around; the patch is useless now (though I'd imagine it would still run, but what's the point?) but I'll show you if you like.
Three: You're right, a client-based security model is incorrect, wrong, and downright clueless. But remember who we're talking about here.
If he really knew what he was talking about, he'd have been able to exploit any security hole --which he admits he was not able to do.
This was years ago, before I knew how to program (much less hack Mac program code using nothing but ResEdit). Just because I know how a program works doesn't mean I can write a program to exploit security holes, much less hack another program to do it. Especially when I don't know how to program, which I didn't back then.
Look, I know what I saw; I used this program for a while, in fact. And I don't appreciate being called clueless for bringing up an old AOL hack which likely invokes nostalgia in more than one Slashdotter.
Besides, what does it have to do with AOLserver at all?
Directly, nothing. But consider the following: one, the server's name is confusingly worded, such that people often think it's the server for AOL's content. Two, people have been clamoring for AOL to Open-Source their stuff. Three, AOL can't do this, and there's actually a damn good reason for it, namely bad software design (which I suppose isn't a good reason, but it's a valid one nonetheless).
Re:Dammit... (Score:2)
Perhaps in an older version of the client software that no longer ran anymore, this would be true.
Just one problem: all versions of the AOL software still run. I believe I still have the oldest AOL frontend (version 1.0 for MacOS; it should be noted that AOL was originally Mac-only unless you count Q-Link which was C64-only). Last time I ran it, it worked fine (and allowed you to enter fake credit card numbers as long as they were theoretically valid, yet another security hole).
That's just it. Perhaps in the 4.0 version, some of these security holes were closed up. But AOL prides itself on its backward-compatibility, and all of the security holes present in the older versions are still valid. There's a price to pay for the exploits: you miss out on the features of the new software. But they all still run fine.
Dammit... (Score:3)
Then again, AOL can't Open-Source its stuff; if it did it would die withim days. No, this is not anti-Open-Source FUD: let me explain. You see, most (if not all) of AOL's security features are implemented solely in the client. This means that if you figure out how to access AOL via a terminal (it IS possible, but exceedingly difficult; I've never managed it myself) you essentially have admin access, minus the pretty icons and such, no matter what screen name you use. You still can't get other people's passwords, but who cares; other than that it's more or less like having root access to AOL (if such a thing existed).
In other words, if you Open-Source the client, it's a trivial matter to remove all of the readblocks in the client, recompile, and have an "instant admin" client. And you know all of the AOL lamers would have a field day with that.
The Mac (or former Mac users) here who used to be on AOL might remember a program called AOL4Free (made by a guy calling himself Happy Hardcore). This nifty little hack undid one of these locks in the client... the one which told the AOL server to bill the user (this was back in the days before AOL went flat-rate). The way it did this, however, tended to overload the server with a certain kind of packet. When the program got popular, the server eventually ground to a chronic halt; although AOL doesn't like people to know about it this was the real reason AOL was so slow until their server upgrade of a few years back; Mac users were getting free time and flooding the server as a side effect (I don't think a Windoze equivalent was ever made).
The program eventually started undoing other locks, allowing the user access to admin-only areas (such as the fabled "Center of the Earth" chatroom, which at the time had double the capacity of normal chatrooms). The guides eventually had to move out of that chatroom, and went to one called "Wonderland"; Hardcore cracked that one too, and I don't even know where the guides hang out now.
So you see, in AOL's case, Open-Sourcing the client really does mean death. But they have only themselves to blame for not designing their software right in the first place.
AOLServer was bought from another company (Score:1)
--
http://www.wholepop.com/ [wholepop.com]
Whole Pop Magazine Online - Pop Culture
Re: (Score:1)
It's Open Source (Score:3)
This is the same AOL that some unauthorized character at Sun told us was thinking of giving up the Mozilla license. We already knew that report was bogus, but this is just more evidence.
Thanks
Bruce
Re:OT: Borland developer survey (Score:1)
http://ww5.inprise.com/scripts/disurvey.exe/gen
or, you can just click Here. [inprise.com]
--Rob
Comics:
Sluggy.com [sluggy.com] - It rocks my nads.
And conincidentally... (Score:1)
ha... ha... ha. (Score:2)
new license review (Score:4)
My disection follows:
AOL is using the Mozilla license with some amendments following, having never read the Mozilla license before I did notice some problems with it itself. I knew the MPL wasn't completely perfect, but it is a very well written license that closely follows what I consider a good open source/free software license standard.
Enough with the psychobabble, and onto the legalbabble.
Everything looked okay until I arrived at Section 2.2 Contributer Grant. Section 2.2.a gives the contributer exactly the same rights the "Initial Developer" (in this case, AOL) has. However, Section 2.2.c denies these rights and makes both Section 2.2.a and 2.2.b invalid if the contributer does not use the "Covered Code" (all code including original code and modified code) commercially. It is quite obvious that hobby programmers will be screwed legally, having inherited absolutely no rights whatsoever in the agreeing to this license. This also means a hobbyist developer isn't allowed to modify or redistribute the code.
Section 3.1 denies the contributer the right to sub-license the code. (Does this mean AOL isn't allowed to make amendments? No. Section 6.3 claims you can create your own license using the MPL but you must show significant differences and use a name not related to Mozilla or Netscape in any way. Would having left sections 6.1 - 6.3 unmodified be deemed inproper modification? These sections contain sentances stating the license is controlled by Netscape/Mozilla and related to them, otherwise they are important parts of the license and should stay the way they are.)
The rest of the MPL seemed ok, now onto AOL's amendments:
Amendment IV basically says AOL has the right to add proprietary code to the AOL/MPL'ed code.
Amendment V is intentionally omitted?!?!?!?
Exhibit A which is an external part of the license implies that the provisions of the AOL/MPL license can be swapped with the provisions of the GPL license... Anyone confused yet?
Sincerely,
Nelson Rush
Re:Version 2.3 rules (Score:1)
Oh wait. AOL bought it.
AOL? (Score:1)
#include "makemoneyfast.h"
#include "spam.h"
#include "lawsuit.h"
void main()
{
while(mailbox_not_full()){
spam(makemoneyfast,50);
}
printf("You've got mail!\n");
if(lawsuit){
printf("We're not responsible, honest!\n");
deleteusers(5000);
printf("Problem fixed!\n");
while(ms_antitrust){
mergewitheverybody();
}
}
--
Re:Version 2.3 rules (Score:1)
First, AOLpress has been dead for almost two years. If you're still using it, you're clueless.
Server-side includes are simply the wrong way to publish web content when you have ADP's, which give you Tcl scripting right in your web page. Once more, if you still cry for SSI's, you're clueless.
Java servlets were not dropped, they were always an optional object. The code for that is merely a cgi-like proxy to the Java Web Server and anyone can write his own version. Once more, you're clueless.
Virtual FTP was nice (it was a feature I championed) but there are other things that do it much better.
If you pine for web-based administration, it's time to get with the program. The control port interface gives you extensive control that you just can't achieve on web pages.
And, of course, the rest of the missing features of 2.3 can be re-implemented by anyone, you know, and you can even make great new features yourself.
AOLserver has always had an extensive C API which let you add shared objects. It's still there, of course. Why not use it to add the features you liked?
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:It's worse that, Jim, they're fuckwits (Score:1)
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:It's worse that, Jim, they're fuckwits (Score:1)
*shakes head in disbelief*
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:Version 2.3 rules (Score:1)
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:Dammit... (Score:2)
How such an obviously wrong posting gets a score of "4: Interesting" is beyond me. Besides, what does it have to do with AOLserver at all?
Kriston J. Rehberg
http://kriston.net/ [kriston.net]
Re:new license review (Score:1)
Not really a conincidence (Score:1)
Apache not GPL'ed (Score:2)
Cool!! It works. (Score:4)
I built it on Debian and it works!
If AOLServer is half as good as Greenspun says [photo.net], it will be serious competition indeed for Apache. With its GPL, people can rip out chunks of Apache wholesale and stick them in aolserver. A mod_perl interface would be my first suggestion.
Re:What exactly is AOLserver? (Score:1)
more details at http://www.aolserver.com
-phazer
Details: (Score:3)
-phazer
benchmarks vs. Apache? (Score:1)
It might be from AOL, but it'd be interesting to see what it is capable of.
Windows equivalent (Score:1)
Aren't you a barrel of laughs... (Score:2)
AOLserver (a www server) has to be fairly decent.
Actually, no. (Score:1)
All of this is described in an entirely above-board way in his books.
Now, I will admit to being a little puzzled at his hardware - by that donation, he upgraded his system from a desktop system that I think was about a SPARC 5 class straight to a four-processor, 4GB RAM, 200GB hard drive space monster You could run a good-sized corporation with that thing. I'm not sure how much it has accomplished - his pages were among the fastest on the net when he was running the old HP server, and - no big shock here - they remain some of the fastest pages on the net now.
Still, I'm sure it's nice to have. I just wonder how HP justified the magnitude of the donation when a much smaller machine would have done everything he'd ever need to do.
Finally, hefty hardware or no, I'd defend Phillip Greenspun to the death - he's a fantastic writer and you certainly can't accuse him of mamby-pamby corpspeak. We need more like him.
D
----
Re:License is MPL... (Score:1)
Re:new license review (Score:2)
You have completely misunderstood the patent grant section. The whole point is to prevent people from contributing stuff they own a patent on and later on saying "gotcha" to everyone using their contribution. If you distribute the code then you've granted rights for people to use it, at least as part of the package they distributed.
2.2c says if they keep their changes internal they haven't granted any patent rights just because it touched MPL code.
2.2d is to keep paranoid lawyers happy. Let's say A violates B's patent in some obscure stuff that B doesn't notice. B then contributes other code in a completely different part of the product. Some lawyers worried (University of California, for one, with lots of patents and lots of programmers that don't know anything about most of them) that under the MozPL 1.0 language B's contribution makes A's violation legal. 2.2d limits grants from B only to stuff B has contributed themselves.
Section 3.1 says code under this license has to stay under this license. You can create a "Larger Work" by adding stuff under a different license, but you can't change the license on what was there when you got it. Free MPL code will never become non-free. (Unlike GPL, however, it can be combined with non-free code which might make a particular binary version impossible to improve or modify.)
6.3 governs the copyright grant for the license itself "which you may only do in order to apply it to code which is not already Covered Code governed by this License". That is, stuff you add to create a "Larger Work", or maybe you just like the license but want to tweak it for your own terms -- Just as AOLServer has nothing to do with Mozilla but liked the basic license and made a few changes.
The amendments that make up the AOLServer license are patterned after the amendments in the Netscape Public License (also a variant of the MozPL). NPL has 5 amendments, thus the strange "Amendment V is intentionally omitted".
Amendment IV is just AOL lawyerly ass-covering, copied from Netscape lawyerly ass-covering in the Netscape PL. The license itself allows you to add proprietary code as long as you don't change the existing source in order to do so. As a practical matter this means even if someone does so the rest of us at least get some hooks to plug in equivalent free functionality if it's cool and useful. Amendment IV allows them to hide the hooks for PRE-EXISTING licensed 3rd party stuff. Oh boy, what a biggie.
Why does the Exhibit A grant of dual-licensing confuse you? Lots of software is dual-licensed -- perl for example. GPL doesn't get along with proprietary code, but the MPL does. But by not being GPL then MPL code can't be used in GPL projects. Dual-licensing allows the code to co-exist in both environments. Contributions probably won't be accepted back into the main tree if they are not also dual-licensed. You're free to fork the codebase GPL-only, but it's not a good idea. For one it'll slow progress on both forks, and two it'll discourage other corporations who are considering going open-source in a GPL-friendly way.
Heh heh. (Score:1)
"In case you couldn't tell, I was being sarcastic"
--Homer Simpson
Re:Version 2.3 rules (Score:1)
And dropped, java servlets, the virtual ftp, aliases
And the autodatabase forms.
Damn, what's left. I guess the high load server.
Now the question becomes does it serve STATIC pages fast with its new FASTPATH module?
Re:What exactly is AOLserver? (Score:1)
His writing is never like a manual. It's always flowing. It's more of a diary, than a manual.
Re:benchmarks vs. Apache? (Score:1)
Re:Version 2.3 rules (Score:1)
As I said, it reads like a removed feature list. (config:13 dropped, vs 6 changed, 3 new; DB all removed) You point out that these things can be done, but new things say removed.
I am clueless about the latest version of AOLserver. I handed off the admin tasks to someone who installed apache, because everyone uses it.
Even though AOLpress/AOLserver combination is dead, lets get real. It showed the real potential of the web. In concept, it was the best of breed. In implementation, well...
And creating SSI equvilents in ADP may be basic, but it need to be shown, and not left up to the potential users. Or you will have no users (as will flaming advocates)
Re:speculation on why AOL ripped out so much stuff (Score:2)
Date: Thu, 24 Jun 1999 22:24:53 -0400
From: Philip Greenspun
Subject: speculation on why AOL ripped out so much stuff
It is fun to speculate on why AOL ripped out so much stuff from 3.0.
Here are my favorites from recent mailing list:
features. I wonder if there are third party licensing concerns or security issues behind these ommisions? Any one of these ommisions would provide a good reason not to move to 3.0 and yet they provide a whole list!
I suspect a lot of code was removed because AOL didn't want it to become Open Source.
I've been working with AOL since December to open-source the thing. Thetruth is much simpler than some of you guys might suppose:
1) they waited for 3.0 to open source the server because they were a bit embarrassed by some of the cruft that had accumulated over four years in Navi/GNN/AOLserver
2) they ripped out a bunch of features because (a) they don't use them on AOL's high-volume sites (like DigitalCity), (b) they complicate maintenance and extension of the server code base, and (c) they think they could be done in modules outside of the server core
This is actually pretty common in the world of complex software. It eventually gets too complex for anyone to understand so people do a leaner meaner rewrite.
Don't cry too hard for your lost feature bloat. Be assured that four years from now AOLserver will be just as bloated with new and even weirder features.
I also know that AOL itself is working on making Tcl 8.1 part of the server. They just couldn't get it done in time and sensibly decided to release an improvement. Jim Davidson, the original NaviServer architect, worked a lot on 3.0. He is a tasteful thoughtful guy and 3.0 is the best Web server for his needs (i.e., heavy and reliable support
for Tcl, databases, ADP; clean and fast static file serving; easyconfiguration).
Philip
First Multithreaded, DB-backed, PUBLISHING SYSTEM (Score:3)
Oh, yea, and the first to use HTTP PUT to create web pages. Using version 2 of AOLpress, the publishing of material to the server was/is transparent. A web server was treated just like a local directory.
Best designed server/web publishing system. It just lost out to money, and bigger development budgets (and a slow browser/publisher). Most of the admin interface was done in TCl, so you could modify it.
Re:It's worse that, Jim, they're fuckwits (Score:1)
I'm scared... (Score:1)
Re:It's worse that, Jim, they're fuckwits (Score:1)
Re:Dammit... (Score:1)
Re:Dammit... (Score:1)
Then there were the alternative versions of AOL with their "hacked" graphics (thanks to simple Graphic editing in ResEdit) but also the ability to get into all the secret Admin areas and Chat rooms.. it's true.
As a quick side note, since eWorld was built upon AOL software it was not too long before all the same things were going on on eWorld, as I was there too...
Email standards (Score:1)
Re:Aren't you a barrel of laughs... (Score:1)
Re:What exactly is AOLserver? (Score:1)
Enthusiastically endorsed by Philip Greenspun (who wrote Philip and Alex's Guide to Web Publishing, reviewed here a few days back), it seems to be pretty darn good. I haven't used it myself, so take all this with a bucket of salt, but Greenspun seems to think it's fast, efficient, plays nicely with databases and TCL, etc. etc. etc. So apparently open sourcing this is quite good news.
I got this from http://photo.net/wtr/thebook/server.html
Re:What exactly is AOLserver? (Score:2)
1) He ditched Perl in favor of a broken thing known as tcl. Perl, the language that is loved and successfully used by so many. When he talks about perl or C, is usually to remind us how much both of them suck and how much Lisp rules over them..
2) On one of his lectures (in California) he mentioned that Apache is not really supported and no one distributes it in binary form. He also mentioned that back in 1993 he could no compile apache.. but come on, compiling linux and gcc back in 1993 was not much fun either. But today, apache and gcc will compile and install on any unix box with simple "./configure;make;make install" from the source directory as long as you have a C compiler, C header files and make.. and there are also lots of places where you can find compiled binaried (ftp.apache.org comes to mind) All linux distributions come with binary apache packages, MacOSX, etc.
3) He ditched vi in favor of emacs. That hurt my feelings
Re:Version 2.3 rules (Score:1)
Jim
Re:Version 2.3 rules (Score:1)
What? Hmm, silly me, would have never though I would have to convert all my exising HTML pages to some TCL (I hate TCL) based stuff. Why not leave in SSIs? I can hardly think of a web server that does not support SSI.
If you pine for web-based administration, it's time to get with the program. The control port interface gives you extensive control that you just can't achieve on web pages.
Aw come on, I've see some nice web admins, besides this is no excuse for removing what was there. Why not give a 'simpleton' web based admin and then let the hackers work with the new and improved TCL based config file for the nitty-gritty config?
And, of course, the rest of the missing features of 2.3 can be re-implemented by anyone
Yeeessss, but why reinvent the wheel? They were already present, tested and working.
I pray 2.3 will be around for a while b/c it is IMPOSSIBLE for me to upgrade to 3.0 without a TON of work. I might as well convert to thttpd or some other threads based web server.
Jim
Re:Version 2.3 rules (Score:1)
- Any reasoning on why these features were removed. Maybe b/c of the whole Netscape thing?
- Valid reasoning why SSI are no longer needed in a web server environment, you just say the are 1994 technology. Blah...whatever.
- Valid reasoning why there is no easy upgrade path, every time I upgrade Apache it is pretty much a no brainer. Any other web server I've ever upgraded needs very little tweaking to upgrade.
- I don't see how removing the web based admin is a 'huge leap' forward in usibility and was only useful back in, say 1994. Whatever...
If that is all you have to say about why these features were removed then just keep quiet
BTW, I can code in TCL and it sucks.
Jim 'who cannot speel'
Version 2.3 rules (Score:3)
We serve over 1.5M hits per day with ease, never taking more than 8% CPU or more than 12M of RAM. Sometimes we'll take 25-35 hits per sec....
Unfortunately no mod_perl/velocigen backend, seems to lean towards TCL.
Jim
Re:Version 2.3 rules (Score:1)
Re:Aren't you a barrel of laughs... (Score:1)
Re:Version 2.3 rules (Score:1)
Re:License is MPL... (Score:2)
-_Quinn
Re:new license review (Score:1)
De-featuring explanation from developers (Score:1)
Re:Cool!! It works. (Score:1)
Re:Dammit... (Score:1)
The exploit did exist, it did have a windows equivalent, its useless now.
I'm sure that once upon a time, a portion of the security was left up to the client software. Nowadays, however, this is not only unlikely, but unconcievable.
HP did not pay me back for mentioning them! (Score:1)
The K460 is a bit oversized for photo.net, but remember that what you see as a static URL (with a
As for America Online, they've not given me anything. They serve 28,000 hits/second with AOLserver and aren't all that interested in whether the rest of the world likes it. It works for them...
Re:Dammit... (Score:1)
That's all that needs to be said.
Maybe, at some point in the past, in a much older version of the client and server software that no longer run anymore, this was true. Maybe.
But as for what exists today, you're just wrong.
---