Hacker News Reader

Comment by chris_wot | Hacker News Reader

And this wouldn't be a problem if they didn't make a wide variety of system directories immutable to anyone (including root) but the installation user.

Apparently this is a very unpopular opinion, so even though I really like Apple and use them on a daily basis, I await the brickbats for daring to offer even the smallest criticism of decisions they made about El Capitan.

Please, feel free to reboot your server to disable this security feature so that you can install security updates for software Apple take a rather long time to supply themselves.

View on HN

Yep, servers (especially headless) are the one case where disabling SIP really can be problematic. But in that case, you should probably just preemptively disable it on all your servers and be done with it. In its current form it doesn't provide all that much security anyway... hopefully there are plans to improve it in the future (or else it seems kind of pointless), but even then disabling it won't leave you with any less security than you had before El Capitan.

Where I fully agree with you is that Apple really needs a better release process. Releasing security fixes should take hours, not weeks. Even low priority ones.

Ok, that's a fair point.

OS X isn't a server OS and hasn't been for a while.

Funny how I just installed OS X Server just today...

You can also install Apache, a mail server, etc etc on Windows 10. Doesn't make Windows 10 a server OS.

No, he installed OS X SERVER

https://www.apple.com/osx/server/

Which is a server product that Apple sells, through the app store, for $20.

It's an operating system that runs server software. How does that not make it a "server OS"?

It runs a VPN service, an update service, it's largely based on OpenBSD, how are you defining what is and isn't this magical "server OS"?

Incidentally, I didn't actually need to purchase that, it just made my life easier. I was quite readily able to install OpenVPN on it via Homebrew and configure the pf rules without their GUI.

The only thing I couldn't do was to install the caching update service. Do you know of an alternative I could have used to update a network full of Macs? No mockery needed, just an answer will do fine - if you know.

Heh, I was actually agreeing with you. To your last question, I have no idea.

Ah. Sorry about that. I need to learn not to read tone in written text (especially a tone that isn't there)! And also get some sleep and get off HN :-)

> it's largely based on OpenBSD

I think you mean FreeBSD.

OSX was based on BSD, not open BSD to the best of my knowledge. They are siblings rather than parent child.

I get rather confused when I try to keep track of UNIX history...

https://github.com/wdas/reposado

> Reposado is a set of tools written in Python that replicate the key functionality of Mac OS X Server's Software Update Service.

Nice! Thanks for the info.

And Windows can operate as a server running all sorts of things like Active Directory, Exchange, etc. - that's because Microsoft bundles the software with it to allow it to do this, but the underlying operating system remains the same.

How is that any different to OS X? And how are you defining what is and isn't a "server operating system"? Perhaps I'm taking you too literally, but I guess I consider an operating system that allows or is designed to act as a server to be such a thing.

Of course, it might not be the best way of running a server, but it's still an operating system running software listening on a port that serves the requests from clients.

I seem to remember when people said Linux wasn't a "server OS", yet it very much was...

> And Windows can operate as a server running all sorts of things like Active Directory, Exchange, etc. - that's because Microsoft bundles the software with it to allow it to do this, but the underlying operating system remains the same.

Actually, it seriously isn't - Windows Server has a hugely changed set of features compared to Windows on the desktop, from the kernel upwards. The software in question is tied heavily into every piece of the OS - there is almost no major component in Windows 10 that is exactly the same in its equivalent server build. This is very different from both OS X and Linux.

OS X is very much not designed to act as a permanently always-on server in a business-critical capacity - what I'd expect from a server OS. The fact that Apple sell a product called "server" doesn't change that, any more than that XAMPP exists for Windows 10.

To put it in a question - would you run your SaaS off of OS X?

Sure, I would. You think a Mac Pro couldn't run Apache, MySQL, and PHP continuously for a year or so? I imagine I'd discover some network tweaks I'd want to make, but I'd be interested to hear what part of that system would prove inadequate.

No, I wouldn't. I think I made that clear already? I'm just saying that I don't understand your definition of a "server OS".

Incidentally, my point about Windows Server is the same you have made - except that the kernel architecture is the same. It still runs pretty much this:

https://en.wikipedia.org/wiki/Architecture_of_Windows_NT#/me...

If I understand correctly, non-Server editions of Windows have an artificial limit of 20 simultaneous incoming network connections. But I'm not sure if it's just an EULA thing, or it's only enforced in specific services (e.g. file/printer sharing, IIS), or if it's implemented at the network layer. If it's the latter, that would surely disqualify it from "server OS" status.

There are only two limitations I know of: by default Microsoft limited the number of half open TCP connections. This limitation was removed in Windows Vista SP1 and Windows Server 2008 SP2, but you need to change it via a registry key:

https://support.microsoft.com/en-us/kb/969710

There are limits on the maximum number of requests in an SMB session, but these are defaults and can be configured by changing the MaxCmds for SMB 2.0 clients and MaxMpxCt on SMB 1.0 clients.

https://msdn.microsoft.com/en-us/library/windows/hardware/dn...

This is very narrow-minded. Lots of people are running OS X severs, for reasons you may not have considered.

Reply on news.ycombinator.com