On Fri, 2005-06-24 at 12:45 -0700, Benjamin Livshits wrote:
Are there any good studies of what fraction of Web apps are written in
Java/J2EE vs C#/.NET vs PHP, etc.
Many vulnerabilities reported on SecurityFocus.com daily involve PHP
programs. I was wondering if that's a reflection of the fact that many Web
apps out there are written in PHP. Or is it that vulnerabilities in
proprietary apps that is written in Java or C# simply doesn't make it to
SecurityFocus.com?
I'm a newbie to this particular mailing list, and I haven't religiously
followed the SecurityFocus.com alerts. At first glance at this list:
http://www.securityfocus.com/vulnerabilities
...it doesn't appear that PHP is overrepresented, but that's not a
thoroughly scientific assessment.
Nevertheless, I'm not going to let lack of data get in the way of a good
theory. Why, it wouldn't be groundless speculation if there were
grounds. ;-)
My guess is, if you're correct that PHP is highly represented, is that
PHP applications are more widely used. I certainly know that the bulk
of web applications I've used recently (GForge, MediaWiki, WordPress)
have been PHP-based. For me, the fact that my ASP (Dreamhost) makes it
really, really simple to set up PHP apps helps as well. Most Linux
distros also come with PHP enabled by default, so I'm sure my ASP isn't
unique in that regard. Java/C# apps are much harder to set up on the
cheap.
I started constructing a theory about how PHP developers are on average
probably less experienced due to low barrier of entry. However, I
called "B.S." on myself before I got the thing fully written up.
Rob
--
Rob Lanphier
Spectaclar.org - documenting open source permissions management
