On 12/14/05, Konstantin Ryabitsev <icon(a)fedoraproject.org> wrote:
On Wed, 2005-14-12 at 13:05 -0800, Greg Knaddison wrote:
> It also has a track record of high profile use (The Onion,
> Deanspace/Civicspace) where security audits must play some role.
I'm honestly beginning to think that people responsible for every "high
profile" installation of PHP just assumed that other high profile users
must have researched all these things before making a decision. I'm
seriously beginning to suspect that it all just went horribly wrong in
the beginning and people just continue to nod and smile in order to keep
their jobs. ;)
I'm not trolling, just pointing out that "high profile" does not really
carry as much weight as it might seem. It's all down to political
decisions, and those are rarely made based on merit.
I can certainly agree that there are switching costs and that
sometimes people end up doing something they know isn't good just
because it's what they and everybody else is already doing.
However, one of the main arguments against Drupal was security
problems, supposedly inherent to PHP based software. My claim is that
when OSS is used in high profile scenarios it gets tested thoroughly
against attempted attacks. How much fun would it have been to deface
DeanSpace and put his scream video up there? Defacing the onion would
be a little weird because how would anyone know it wasn't just their
best joke ever :)
But I'm here to try to answer questions - if you have decided to use
something else or decided definitively that it won't be PHP based,
just let me know and I can go back to not paying attention.
Greg