WebApp Sec mailing list archives
Re: Languages/platforms used for Web apps. Any stats?
From: Rob Lanphier <robla () robla net>
Date: Sat, 25 Jun 2005 00:46:08 -0700
On Fri, 2005-06-24 at 12:45 -0700, Benjamin Livshits wrote:
Are there any good studies of what fraction of Web apps are written in Java/J2EE vs C#/.NET vs PHP, etc. Many vulnerabilities reported on SecurityFocus.com daily involve PHP programs. I was wondering if that's a reflection of the fact that many Web apps out there are written in PHP. Or is it that vulnerabilities in proprietary apps that is written in Java or C# simply doesn't make it to SecurityFocus.com?
I'm a newbie to this particular mailing list, and I haven't religiously followed the SecurityFocus.com alerts. At first glance at this list: http://www.securityfocus.com/vulnerabilities ...it doesn't appear that PHP is overrepresented, but that's not a thoroughly scientific assessment. Nevertheless, I'm not going to let lack of data get in the way of a good theory. Why, it wouldn't be groundless speculation if there were grounds. ;-) My guess is, if you're correct that PHP is highly represented, is that PHP applications are more widely used. I certainly know that the bulk of web applications I've used recently (GForge, MediaWiki, WordPress) have been PHP-based. For me, the fact that my ASP (Dreamhost) makes it really, really simple to set up PHP apps helps as well. Most Linux distros also come with PHP enabled by default, so I'm sure my ASP isn't unique in that regard. Java/C# apps are much harder to set up on the cheap. I started constructing a theory about how PHP developers are on average probably less experienced due to low barrier of entry. However, I called "B.S." on myself before I got the thing fully written up. Rob -- Rob Lanphier Spectaclar.org - documenting open source permissions management
Current thread:
- Languages/platforms used for Web apps. Any stats? Benjamin Livshits (Jun 24)
- RE: Languages/platforms used for Web apps. Any stats? Matt Szubrycht (Jun 24)
- Re: Languages/platforms used for Web apps. Any stats? Mark Susol Ultimate Creative Media (Jun 25)
- Re: Languages/platforms used for Web apps. Any stats? Steve McCullough (Jun 26)
- Re: Languages/platforms used for Web apps. Any stats? Jesse G. Lands (Jun 26)
- Re: Languages/platforms used for Web apps. Any stats? Mamading Ceesay (Jun 26)
- Re: Languages/platforms used for Web apps. Any stats? Mark Susol Ultimate Creative Media (Jun 25)
- RE: Languages/platforms used for Web apps. Any stats? Matt Szubrycht (Jun 24)
- Re: Languages/platforms used for Web apps. Any stats? Andrew van der Stock (Jun 24)
- Re: Languages/platforms used for Web apps. Any stats? focus (Jun 24)
- Re: Languages/platforms used for Web apps. Any stats? Steve McCullough (Jun 26)
- Re: Languages/platforms used for Web apps. Any stats? Rob Lanphier (Jun 25)
- Re: Languages/platforms used for Web apps. Any stats? Gary Warner (Jun 25)
- Re: Languages/platforms used for Web apps. Any stats? prep (Jun 25)
- RE: Languages/platforms used for Web apps. Any stats? Mark Curphey (Jun 25)
- RE: Languages/platforms used for Web apps. Any stats? Steve Slater (Jun 25)
- Re: Languages/platforms used for Web apps. Any stats? Adam Shostack (Jun 25)
- Re: Languages/platforms used for Web apps. Any stats? Ben Sytko (Jun 25)
- RE: Languages/platforms used for Web apps. Any stats? Mark Curphey (Jun 25)
- RE: Languages/platforms used for Web apps. Any stats? Mark Curphey (Jun 25)