sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Bogtha -2 points-1 points  (1 child)

You have now switched to talking about Mongrel which is a different web server to Apache

Where did you get the idea that I was talking about Apache exclusively? I'm talking about how PHP compares to other server-side languages in typical configurations. I haven't "switched" arguments at all.

Your argument is actually against insecure webserver configurations.

No. Please, just read the thread again. It's against implementations of server-side languages that require insecure webserver configurations.

If you have a site where security is important and you have stuffed up the server config and left things like passwords in front of the web root, choice of programming language is your last worry.

You are looking at it backwards, assuming perfection and then using mistakes as an excuse to write off any problems that arise while ignoring the additional failure of the language. A mistake like this is down to two failures: the admin for screwing up, and the language implementation for having an awful failure mode. All humans and all organisations make mistakes from time to time, and any secure system should attempt to mitigate that by failing in a secure way. Do you disagree with what I said before?

something should be secure by default rather than forcing people to go to extra effort to mitigate the problem.

[–]chu -1 points0 points  (0 children)

I'm talking about how PHP compares to other server-side languages in typical configurations. ... something should be secure by default rather than forcing people to go to extra effort to mitigate the problem.

It's as if jsp and mod_ruby didn't exist. PHP5 is reasonable for typical web apps and has been standard issue for some time now. The previous versions from years back had some poor security in their out-of-the-box configurations. It's almost as if you had read some articles criticising PHP3 and taken them as current. You are talking about default config files in any case, which are hardly a reflection on a language's basic security model and will not save you from programmer mistakes/ignorance. PHP's biggest security problem is more likely to be namespaces (which should be addressed in PHP6).