Netcraft News

> Are people still using Apache web server in 2020? Yes. In fact, about one-fourth of the "top million busiest sites", 24.6%, are "still using Apache in [December] 2020" [0] -- more than any other web server. More "active sites" also use Apache (25.6%) than any other web server. When it comes to "all sites", however, nginx (33.48%) is the most widely used, followed by Apache (27.07%) and Microsoft (7.94%). -- [0]: https://news.netcraft.com/archives/2020/12/22/december-2020-web-server…

Yes, I'm aware of MITM attacks and I'm also aware that fake certificates can be used to MITM even HTTPS sessions. So I'm not convinced that HTTPS is the solution for that hypothetical attack. Not while untrustworthy certificate authorities are default-enabled on most clients anyway. At best, HTTPS complicates the attack but it doesn't make you immune to it. A hypothetical MITM attacker can just get a fake certificate from a low-security vendor (ex: Comodo), and serve that to get a nice "trusted" version of the fake webpage. If you control the network, you control the certs that are eventually served to the users. https://news.netcraft.com/archives/2014/02/12/fake-ssl-certificates-de… https://en.wikipedia.org/wiki/DigiNotar

I actually love the idea of 90 day (or less) certificates! Once you automate the process of replacing your certificate (which let's encrypt will greatly help with), it won't matter how short the period is. Also, if a key gets compromised, it'll be valid for a shorter time. Give https://letsencrypt.org/2015/11/09/why-90-days.html a read! If you want to get more in-depth about certificate revocation, http://news.netcraft.com/archives/2013/05/13/how-certificate-revocatio… is also a great/depressing read.

The article is down for me, but: From a POV of fairness to StartCom, I agree with you, and initially saw it as a ridiculous sense of entitlement on the part of their (non-paying) customers. However as a third party user of the web I am somewhat persuaded by the simple argument that the certs should be distrusted on the basis that they are no longer trustworthy. Edit: Having thought about it for a minute, a logical consequence of my argument is that all certificates signed by CAs that charge a revocation or reissue fee should be distrusted, which probably makes it not a very reasonable argument. I guess this just leaves us at "Valid SSL certificates are not necessarily trustworthy and we just have to live with that". Edit2: http://news.netcraft.com/archives/2014/04/11/heartbleed-certificate-re…

A poor coder blames his tools (or language). You can make a masterpiece in any programming language. For that matter though I love PHP, been using it for over 10 years. I've used other languages extensively too but for my own projects it usually falls back to good old PHP. I definitely wouldn't say it's one of the poorest languages to have in the toolkit though; http://news.netcraft.com/archives/2013/01/31/php-just-grows-grows.html Most enjoyable for web : php, Most enjoyable for apps : c

Then you're living in a bubble. Apache still has the vast majority of web servers and sites and it doesn't look like it's going to be taken over any time soon: http://news.netcraft.com/archives/2012/02/07/february-2012-web-server-… Not only that, but in Apache 2.4, the Event MPM is no longer experimental, which addresses Nginx's only advantage (performance). I recently moved my site from Apache to Nginx and like both. But you're living in a dream World if you think Apache is anything other than a brilliant web server, and the most widely used and successful web server that has ever existed, by far.

140 million sites didn't make the list. [1] 1: http://news.netcraft.com/

I constantly hear of web services shutting down and I feel guilty for not appreciating them at the time. I'm not going to make that mistake this time. Netcraft has been at it basically as long as I have. I don't read their survey reports regularly but maybe I should. Their archives are awesome. Remember the SCO saga? http://news.netcraft.com/archives/2003/12/15/outages_continue_at_sco.h… Thanks Netcraft! Also, I love their anachronistic logo.

see netcraft: http://news.netcraft.com ~54% apache + 5% nginx + 1% lighttpd.

I can't believe they think a Windows version is pre-requisite to success in penetrating the server market Taking websites as an example : The clear leader amongst web servers used by the million busiest websites is Apache with a 66% share. It has a 47% lead over its closest competitor, Microsoft-IIS, much greater than on the web as a whole. netcraft confirms it - http://news.netcraft.com/archives/2009/03/15/march_2009_web_server_sur…

> In 2006, most webservers were either IIS on Windows Server or, believe it or not, NetBSD. In fact, the vast majority of webservers globally, like 90% or more, ran NetBSD Do you have any sources to back this claim? I've always thought that (perhaps mistakenly) by 2005-ish Linux was already fairly dominant as a web server OS/platform. Not asking because I think you are wrong -- I just would love to read more about this and couldn't find anything more than a web server survey from 2006[1]. The survey doesn't really mention specifics about any of the Unix-like platforms other than "Linux" or "Apache" (which I assume by Linux or Apache they are grouping all non-Windows OS-es together). My interest: I'm a regular Linux user with some FreeBSD experience who finds the BSDs super interesting and their approach very admirable. [1] https://news.netcraft.com/archives/2006/04/06/april_2006_web_server_su…

I didn't ask about NeXT, I asked about NetBSD. Surely if it ran 90% of the web, you can name a single website that was served by it. Like, I honestly can't tell if this is some kind of bizarre troll. People keep asking you for sources for your incredible claims, and you just keep making them without a single reference. Where are you getting this 30M number? This 90% number? Here's another source: Red Hat IPO'd in 1999 on the back of a Linux operating system, per Wikipedia, "achieving—at the time—the eighth-biggest first-day gain in the history of Wall Street". Pretty amazing for something that was "barely a curiosity, a hobby". Here's Netcraft in 2003, claiming a mere 2M sites running FreeBSD and describing it as a blip compared to Linux and Windows. > Although nearly all of the public focus is geared around advocacy of Linux and Windows, there is a third Intel based operating system, which generates a tiny fraction of the publicity surrounding these operating systems, and has a much smaller user and developer community. https://news.netcraft.com/archives/2003/07/12/nearly_2_million_active_… Notably they don't even mention NetBSD. In fact, Netcraft barely ever mentions NetBSD. I get _two_ hits on their entire site for it. Pretty big oversight for something running 90% of the web! Here's a FAQ from 2001 from a commercial BSD company describing FreeBSD as "the most popular open source version of the BSD OS". Weird how, according to you, NetBSD…

> I never suggested removing a language used by millions of people. Let me be more specific: Pruning support for old formats and protocols is a feature, not a bug. You're contradicting yourself here; Hebrew is a language used by millions of people (about ten million, so 99.9% of the world's population does not use it) and also an old format (about 3000 years old). "Pruning" support for old formats makes history inaccessible; "pruning" support for old protocols requires constant effort to keep your servers compatible with whatever is fashionable with today's cascade of attention-deficit teenagers [CADT]. And if we follow your originally stated reasoning, "Continuing to support $x means continuing to defend attack surface that's implemented as $y year-old code, to deliver a feature that in $z the majority of people do not use," we ineluctably arrive at the conclusion that we should remove support for languages used by millions of people. Taken literally, we should remove support for all languages, since no language is used by more than 50% of the world population, but in keeping with the principle of charity, I interpreted your "majority" as "vast majority". I'm not sure where exactly the vast-majority cutoff lies: a feature that 90% of people do not use? That would include all natural languages except English and Chinese. 95%? All languages except those, Hindi, and Spanish. (In particular, it leaves out all those RTL languages that cause so much complication in text…

On the enterprise or business to business side, signals are weaker, and signs of traction are harder to identify. However, Mattermark has found that tracking sales support materials (videos, whitepapers, and other documentation) is a signal and makes it easier to view traffic as an exhaust of the sales process. Through this method, Mattermark listed cloud hosting startup Digital Ocean as its top pick for a pre-Series A company. The company raised a healthy round a few months later, mainly because of its success with developers. This post seems to imply that Mattermark identified Digital Ocean as a promising pre-Series A company before anyone else. This isn't the case. Mattermark's Digital Ocean "call" was published on June 22, 2013. At the time, Digital Ocean's rise was being noted by others based on more meaningful criteria than "sales support materials" (see http://news.netcraft.com/archives/2013/06/13/the-meteoric-rise-of-digi… for example), and as a 2012 TechStars participant, the company was almost certainly on the radar of investors for over a year. For new investors, Mattermark and Dashboard.io aim to be a check on a startup’s performance. Both companies are also experimenting with their notifications system. Based on an investors’ specifications, they may be able to alert customers to a hot opportunity. One of Morrill’s favorite examples is Instagram, a startup that was acquired by Facebook for a cool $1 billion, making its investors…

One of my favorite startups. I signed up for a single server some time ago to try them out and was amazed when I saw the control panel, API and the ecosystem that has already built up around the service. To those of you asking what is so special about DO compared to ExyExtraVps.is running stock WHMCS[1] or whatever over at LEB it is that DO are providing the type of features, flexibility and support that Rackspace, AWS and Azure provide but at prices that are close to what the low-end VPS types offer. If you imagine a Gartner-style quadrant for hosting with price on one axis and then features/support/flexibility on another most providers today sit somewhere along a very straight line - you either have a bunch of features and flexibility and are expensive or you are very rigid and cheap. DO is right up in high features but low price, and it seems so obvious in hindsight (Linode were almost there). I now have Vagrant setup with Digital Ocean as a provider[2] so setting up a box is as easy as running 'vagrant up --provider=digital_ocean' and then waiting a minute. There are tons of other tools already built up around their API and the ecosystem is thriving. I have another script setup ready to fire up additional instances of web apps. I'm moving everything I can and that fits from AWS and recommending DO to clients also where it would fit (staging servers, dev servers, backup servers, etc.) There are still some features they need - like load balancing, multiple IP's etc.…

I love statistics. They can be used to say just about whatever one desires. The goal of the post seems to be to show relevance and traction gains in the market. The charts from netcraft that discuss all domains are pointless for that, because domains are a dime a dozen. What we should pay attention to are the numbers across the busiest sites. First, is a million sites a good measure? Netcraft has identified just over 180 million websites, so the million busiest sites seems a pretty good assessment. To be useful, we need to see how nginx fares in the market of websites where these decisions count. So, the busiest million sites is a good measure for that. Of the four servers identified (Google App Engine is a toy, shouldn't be on this list), nginx is the only one that actually made quantifiable gains in the two months compared. Both Apache and Microsoft/IIS took steps back. In this consideration, nginx sits at 8% share, which is essentially "statistically relevant". But even then, it's only one month of data. A longer term view is more relevant. Back in April (http://news.netcraft.com/archives/2011/04/06/april-2011-web-server-sur… nginx was measured in the same context at 6.5% of these same sites; half a year later, nginx sits at 8%. Here's the summary: nginx is making relevant market share gains in the web server space, and is taking share from both Microsoft/IIS and Apache.

The April 2023 Netcraft survey: https://news.netcraft.com/archives/category/web-server-survey/ nginx is at: 26% Apache is at 20% It doesn't sound like nginx is even close to having this wrapped up; which is a really good thing because I've tried nginx and the config and design sucks. Apache does so many things well.

Agreed, the same risk does exist. But .zip already has malicious use, so the comparison is moot. What's different is that normal users of all platforms talk about .zip files, only slightly-technical MacOS users talk about .app. That attack base and opportunity is much smaller. https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already…

This is the actual report: https://news.netcraft.com/archives/2023/01/27/january-2023-web-server-… The graphics shown on the bird site are labelled “market share of the top million sites” So IMHO the tweet is a bit confusing

Here is a survey [1] from October of 2022 or just the graph [2] as that page has some odd CSS menus for me that block half of the page. This page uses an additional source. [3] [1] - https://news.netcraft.com/archives/category/web-server-survey/ [2] - https://news.netcraft.com/images/2022/10/wss-share.png [3] - https://www.stackscale.com/blog/top-web-servers/

> I can't even think of a closed-source webserver off-hand. Microsoft IIS? Still about 6% of web servers & in 5th place, according to September 2022 stats. Though that's a huge crash from 2018 when it was the #1 largest share of websites (40%) according to Netcraft. https://w3techs.com/technologies/overview/web_server https://news.netcraft.com/archives/2018/08/24/august-2018-web-server-s…

According to [1] "On a typical Monday, we would expect to see a total of around 22,000-30,000 SSL certificates being revoked over the course of the day." i.e. ~8 million per year. [3] meanwhile says "1.8 million certificates are revoked per year" Looking at a random CRL [2] it's 41 bytes per revoked certificate. 8 million records at 41 bytes per record would be 300+ Megabytes. And a cautious CA might keep revoked certificates in their CRL for more than a year. So if an event like heartbleed happened again and uncommonly large numbers of certificates needed to be revoked, the gigabyte range is within the bounds of possibility. [1] https://news.netcraft.com/archives/2014/04/11/heartbleed-certificate-r… [2] http://crl3.digicert.com/Omniroot2025.crl [3] https://www.grc.com/revocation/crlsets.htm

If you look at the graph of web server market share on Netcraft's site, you can see that Apache ramped up really quickly in the late 90s and stayed ahead of IIS until Nginx started making real inroads. https://news.netcraft.com/archives/category/web-server-survey/ The vast majority of these web servers were running on Linux. NetBSD was a very niche OS from about the early 2000s on, and far from common before that. Up until about '97 or so most web servers seemed to be running on NT4 or even Windows 95 (which was in itself a fairly terrible idea but they were simpler times).

Here's the numbers I commonly cite: https://news.netcraft.com/archives/2022/04/27/april-2022-web-server-su… 31% nginx 23% apache 8% Openresty (which I've never heard of, looks like it is an augmented nginx) 5% cloudflare

Apache is at 26%, behind nginx's 36%, according to Netcraft: https://news.netcraft.com/archives/category/web-server-survey/

raises remaining hand Now if someone asks me if I also still use the same laptop as when Apache had >6 times the market share of Nginx (https://news.netcraft.com/archives/category/web-server-survey/), I will need to find more hands.

Netcraft confirms it https://news.netcraft.com/archives/category/web-server-survey

Well, I use FreeBSD on my personal laptop and work at a company which uses FreeBSD for its appliances. That’s true, FreeBSD’s market share is tiny in comparison to Linux, but it seems like there are still a number of companies looking for FreeBSD developers. It’s also reassuring that even though FreeBSD ecosystem gets a lot less attention than Linux, it still enables companies like New York Internet to be one of the most reliable hosting companies out there (https://news.netcraft.com/archives/2020/12/02/most-reliable-hosting-co…

Apache still runs some really big websites that likely have more requests than many of these startups. Ticketmaster has used Apache for almost 15 years as their primary webserver (but they're fronted by layers of varnish / Akamai). They also maxed out dual 10G links with web traffic in 2007 or so when I worked for them. That said, netcraft says Apache still runs almost 25% of the internet, which is no small stake: https://news.netcraft.com/archives/category/web-server-survey/

parent is joking around but I got curious and wanted some data on this and found rather surprisingly that IIS isn’t doing so well these days and seemed to have dropped even more in the last year: https://news.netcraft.com/archives/2020/04/08/april-2020-web-server-su… https://news.netcraft.com/archives/2019/04/22/april-2019-web-server-su…