smashedbug.com, tech music and geek news

812 days, 11 hours, 52 minutes. A personal best.. uptime that is. That is how long one of my FreeBSD server’s stayed online doing what it does best — serving web pages, receiving and sending mail, checking for spam, responding to DNS queries, monitoring networks, protecting the LAN and hosting databases.

Quite impressive. The server would still be online if it wasn’t for a site-wide power outage (scheduled) that lasted over 12 hours.

The server started life in 2002 as a Red Hat file and print server and was migrated to FreeBSD in 2004. In October of 2005 it was moved to its final location and powered on fully for the last time. During the life of this system, it (as I recall) never crashed or otherwise failed to provide service. Not too shabby for some sale items from Fry’s Electronics thrown together in a cheap case.

Sadly, when the server was scheduled for powering up, the motherboard failed. After running for so long (over 5 years of continuous use) I think some of the components on the motherboard simply failed (most likely due to the ambient temperature and cooling of the components while powered down).

All is not sad. As it WAS a FreeBSD machine, I was able to simply pull the hard drive from the old computer, plug it into a newer Dell desktop computer (spare until I can officially replace) and booted up. A few minutes later after adjusting configuration for the new hardware (network interface card assignments) and everything was back online.

Ultimately, once the power was back on, there was perhaps a total of 20 minutes of outage. This is the limit I give myself before I decided to fail over to a reduced functionality server (backup server) and then troubleshoot the issue further (unrack the server, troubleshoot to determine the issue, fine a secondary computer and transplant the hard drive). The new stand-in server was online and operating in full capacity within an hour and fifteen minutes.

Once the new server is acquired and installed, it will be interesting to see if it will beat the 812.5 days of uptime.

I came across an interesting article …. “Open Source Code Contains Security Holes”

The Department of Homeland Security, starting in 2006, audits software for security issues. According to their findings, 1 line in about 1000 contains a security hole. While the title of the article sounds scary, there were some interesting factoids:

• 7,826 security issues were fixed due to the Department of Homeland Security notifying the open source projects (1 defect fixed every 2 hours)
• Core open source projects such as the Linux kernel, Samba (windows file sharing), PHP, etc had far fewer than the average number of security issues. For example, Linux kernel had only .127 issues per 1000 lines of code (ie 1 defect/7,874 lines).
• Due to the code review, many of the projects are actively addressing the security issues found and so far have had a good track record in getting these issues addressed in a very timely fashion.

What did they have to say about closed source security? You can read it for your self — in anycase, these issues are not public knowledge .. doesn’t give these companies much motivation to pour resources into issues no one knows about *yet*.

Bottom line …. Open Source based on this study has on-par or less security bugs than commercial software. More popular projects that are in massive deployment tend to have significantly less security issues than their commerical counterparts (or other less popular Open Source projects) which seems to back the notion that more eyes make all bugs/issues shallow.