Re: non-PHP webmail

[Seth Mattinen <sethm@rollernet.us>]

Jim Popovitch wrote:
> On Sun, 2007-07-29 at 15:44 +0800, Thomas Goirand wrote:
> > Jim Popovitch wrote:
> > > Whats a good, non-PHP based, client webmail application for about 50
> > > user accounts?
> > >
> > > Thx,
> > >
> > > -Jim P.
> > What's wrong with PHP?
>
> Based on server logs, PHP still seems to be a very highly targeted
> attack vector.  Considering that it's impossible for me to have
> up-to-date information on every possible security hole out there, it
> only seems prudent to avoid utilizing software that others consider such
> a highly valued target.  This isn't security by obscurity, it's security
> by common sense.

PHP's problems are typically caused by horrible programming practice - 
such as using variables from user input and assuming PHP will make the 
input safe. Based on server logs, Windows still seems to be a very 
highly targeted attack vector too. So why make a comment about PHP like 
that?

Sorry to interject this, but that comment smacks of ignorance to me.

~Seth