Need a Web Host

ORIGINAL: mosessepher
Hi ya, I'm in need of a web host for my wife's business site. I'm sure a lot of you must have a few you can recommend. We don't need anything too fancy, just PHP and Perl really. Any suggestions would be greatly appreciated.

if you are going PHP don't get shared hosting if you can help it. PHP by far outnumbers any other single product vulnerabilities on bugtraq (mailing list for security vulnerabilities). in fact it's probably between 1/3 and 1/2 of the vulnerabilities listed in the last year or so.

with shared hosting, if anyone sharing your server has a vulnerable app (and they surely will, and they surely will not update it while vacationing since their company isn't big enough to get a dedicated solution or host it themselves) then everyone on the server is owned. will your hosting company tell you? maybe. or they might just reimage the server and restore from last night's backup, which may not include the current day's transactions or changes. or someone puts some fun pictures up on your site not appropriate for children, etc., the day after your website flyers go out.

anyway you get the idea. .NET and JSP apps tend to be sandboxed better and have much fewer vulnerabilities, but i get the idea that you or someone you konw is a PHP coder (like me, although i can do .NET as well).

ORIGINAL: Joe Bravo
I emailed the admin guy at the host site and he seemed to not have any idea what happened or how. Whether he was lying to me as Jack suggested, I don't know.

he could also be clueless as well. it takes a lot of time and effort to stay on top of security and that's typically the first corner cut in any size operation. having worked at a small company and now a big one, i can tell you that it's very tough to sell security to management, let alone get it done properly. the small company didn't want to spend anything (thank God for open source) and the big company thinks they can just plug in some expensive device which will magically solve their problems, as long as it has that five-letter "c" word on it....

/rant and threadjack over... =)

ORIGINAL: mosessepher
Hi ya Jack. I don't program PHP or Perl. I just borrow code from books or websites that have it available if it will meet my needs. I didn't know that about the vulnerabilities. Thanks for sharing.

no problem.

not to be all scary or anything but if you are going to put a business on the web, it would be worth your while to know some of the risks involved and ways you can minimize those risks. i would recommend you to this site: http://www.owasp.org. it may be a bit overwhelming but it has a good overview of web security.

back when i was a college senior a couple years ago, i got bored one day during a business class. i was on the school's internal timecard site, and i noticed something odd in the URL. in 15 minutes i figured out how to give myself administrative access through a flaw in the site's design. that's not for me to boast and say i'm a hacker, just to show you that even professional coders can make mistakes that bored college students can easily exploit on a whim and a bit of curiosity.