Hacker News Reader

Comment by aaronbrethorst | Hacker News Reader

Does Microsoft still maintain IIS? I thought it hadn't been meaningfully updated in about 8 years.

Sharepoint, Exchange webmail, and other stuff uses it... that is why it's officially NOT depricated... but man imagine having to keep up an ASP codebase today, it's not unheard of, it's just rough.

Do they still maintain it as in, it gets bug fixes and security patches? Technically yes, bug fixes and security patches are still produced for Windows Server. I wouldn't call it a good level of effort but it exists. They are happy to take your money for such a mediocre level of effort though.

Is it Microsoft happy path? No. Microsoft STRONGLY recommends that if you are running .Net (Core), you run under Kestrel on Linux in a container. Performance under Linux is much better than Windows.

Kestrel is more performant under Windows than Linux, but the container support isn't there

This is incorrect, all benchmarks including those from Microsoft have proven 10%-30% performance increase under Linux.

https://aka.ms/aspnet/benchmarks

Here is Microsoft official ones, Linux beats out Windows in almost every metric.

Do any web servers have meaningful updates? It’s pretty standard stuff. IIS can do quite a bit of the same things. It’s common in my industry. We set up URL rewrites, reverse proxys, asp.net, even node.js or python (flask) based apps using WSGI. Separate app pools for everything all on the same server sometimes. It’s never been a bottleneck because it’s pretty streamlined code. Haven't had any security issues with the web server ever. It’s nice there is a GUI but when you start looking at the configuration (xml based) a lot of the directives are familiar if you’re used to nginx.conf or httpd and with htaccess (web.config) in site directories.

I am always a bit annoyed with having to install URL rewrite module by hand as it is not included in windows server installation checkboxes.

It has newest TLS stuff like TLS 1.3, it has HTTP2/HTTP3 and QUICK implemented. I do think those are meaningful updates, well http2 was 11 years ago but QUICK is more like 3 years ago with HTTP3.

That is isn’t even IIS but mostly SCHANNEL and http.sys.

Correct me if I am wrong but I always thought http.sys is IIS.

I guess if they can do changes to SCHANNEL but not to IIS for TLS stuff that would be good engineering. But it also makes argument mute ... because if Apache and Nginx and Caddy get updates to support new TLS and IIS is not because it is separate, then a question who does it right?

Reply on news.ycombinator.com