RE: Languages/platforms used for Web apps. Any stats?

["Mark Curphey" <mark () curphey com>]

Large organizations tend to use Java and .NET
Small to Medium Size organizations often tend to use LAMP
(Exceptions exist everywhere in life)
People on discussion lists / BBS tend to be the passionate few
Passionate people tend to work for smaller companies

Therefore I would suggest that the reporting on the number of issues with
PHP is not a good indication of its security posture due to;

A disproportionate amount of bugs reported versus actual implementations
The might be explained by a bias of a type of person talking about things
they use in public (whereas their counterpart typically discusses this less
(less passion maybe ;-)) 

Also if the cost of entry is low, you will see less commitment. Less
commitment will = less security. That is to say if my grand mother can write
a simple PHP app but not "fast CCGI" then chances are she will not be able
to write secure apps in either. One has a chance of making it on the net,
the other not.  

At work I honestly can't remember the last time we reviewed a PHP app for a
client. This maybe because we mainly deal with Fortune 1000 / gov (larger
orgs) but for us it would be less that 0.5 percent.

That said if you take a look at some of the fundamental language issues as
AJV suggested I would hypothesis PHP has a lot to work with. Also if you
look at ASP.NET you would struggle to disagree that MS have not done a good
job of making security easy (especially in ASP.NET 2.0) for the drag and
drop brigade.  




-----Original Message-----
From: prep () prep synonet com [mailto:prep () prep synonet com] 
Sent: Saturday, June 25, 2005 4:26 AM
To: livshits () cs stanford edu
Cc: webappsec () securityfocus com
Subject: Re: Languages/platforms used for Web apps. Any stats?

The best source I know of is Netcraft,
http://www.netcraft.net

They do regular update on who is running what for servers and on a lesser
basis, apps as well.

-- 
Paul Repacholi                               1 Crescent Rd.,
+61 (08) 9257-1001                           Kalamunda.
                                             West Australia 6076
comp.os.vms,- The Older, Grumpier Slashdot Raw, Cooked or Well-done, it's
all half baked.
EPIC, The Architecture of the future, always has been, always will be.