On 12/14/05, Konstantin Ryabitsev <icon@xxxxxxxxxxxxxxxxx> wrote: > On Wed, 2005-14-12 at 13:05 -0800, Greg Knaddison wrote: > > It also has a track record of high profile use (The Onion, > > Deanspace/Civicspace) where security audits must play some role. > > I'm honestly beginning to think that people responsible for every "high > profile" installation of PHP just assumed that other high profile users > must have researched all these things before making a decision. I'm > seriously beginning to suspect that it all just went horribly wrong in > the beginning and people just continue to nod and smile in order to keep > their jobs. ;) > > I'm not trolling, just pointing out that "high profile" does not really > carry as much weight as it might seem. It's all down to political > decisions, and those are rarely made based on merit. > I can certainly agree that there are switching costs and that sometimes people end up doing something they know isn't good just because it's what they and everybody else is already doing. However, one of the main arguments against Drupal was security problems, supposedly inherent to PHP based software. My claim is that when OSS is used in high profile scenarios it gets tested thoroughly against attempted attacks. How much fun would it have been to deface DeanSpace and put his scream video up there? Defacing the onion would be a little weird because how would anyone know it wasn't just their best joke ever :) But I'm here to try to answer questions - if you have decided to use something else or decided definitively that it won't be PHP based, just let me know and I can go back to not paying attention. Greg
