[freetds] FreeTDS FUD at odbcrouter.com
freddyz77 at tin.it
Sat Jan 8 05:27:38 EST 2005
Il giorno ven, 07-01-2005 alle 20:26 -0600, Michael Sims ha scritto:
> Sorry if this has been brought up before; I searched the archives and found
> no reference to it.
> I was just wondering if anyone here has seen some of the FUD about FreeTDS
> on the following site:
> I discovered this after this company posted a patch to the PHP internals
> list which adds support for their "ODBC Router" software to PHP.
Note that they can't be impartial. They sell a product to connect
Linux/Mac to many databases (see overview).
> Third-party "wire-level" products depend upon a third-party
> reverse-engineering of the database server's network protocols, meaning they
> can crash your database server. Customers may lose data and experience
> downtime trying to recover when so-called "wire-level" drivers are used
> either intentionally, or as Internet viruses like "SQLSlammer". Actually
> paying someone for a "wire-level" driver may even encourage the spread of
> such viruses since quite often, they are releasing their reverse-engineering
> work out into the "open source" world.
It's true that we have to reverse network protocol. We try to reproduce
100% protocol. We are very far from crashing the server. The example
reported by ODBC Router has been confirmed from Sybase as a server
problem, the problem it's also that version 12.5 don't like FreeTDS
default settings, you can crash server even changing setting and using
proprietary libraries... Do you think that MS or Sybase can tests all
previous version of their libraries with all possible settings to be
sure that all works correctly? Are they sure that version X with
settings Y do not crash the server? And how can a server crash using
just invalid input? If we can crash the server even virus coders can
crash your server so I call it a security bug in your server... Database
server should save your transaction even you unplug power cable so if
server crash it should recover to a safe state with all transaction
succeeded handled. If your server fail to do so I suggest to change your
server, it's broken!!
> Moreover, using an "unauthorized" client like FreeTDS with your proprietary
> database server may be a violation of the Digital Millenium Copyright Act, a
> new federal law prohibiting financial benefit from the unauthorized reverse
> engineering of licensed materials, such as the TDS protocol owned by the
> shareholders of NYSE:SY.
True and false... Sybase (which own TDS that copyright) provide
partially TDS protocol specifications freely. We provide software with
LGPL license so we don't have "financial benefit".
> The page also cites an excerpt from a FreeTDS release note warning against
> problems with Sybase 12.5 as "proof" that using FreeTDS in general is
Yes, you can read it from our README. We do not hidden any bugs (as
usually proprietary software does). This do not prove that FreeTDS is
dangerous in general but that this combination is dangerous.
> I've probably already given these people more attention than they deserve,
> but I just thought it was funny how they decry the open source development
> model while they attempt to profit from it.
> Disclaimer: The opinion expressed above is my own, and does not necessarily
> reflect that of my employer.
Are you also sure that ODBC Router do not contains any extra bug? They
use native libraries that is they introduce an extra level of
indirection and extra software on server. How can they outperform such
better performance? Even FreeTDS use binary format...
More over this make me laugh: "Instead, ODBC ROUTER uses a high-
performance network transport that is the result of three years of
investment."... so instead is TDS a poor performance protocol and did
they replace it with their protocol? So they can convert TDS protocol
using ODBC client on windows server to their protocol using very few
resources (time and cpu) gaining in all that passes even more
performance. I never notice that TDS was that slow...
More information about the FreeTDS