Peter.Vatistas:
Mysql doesn't run slower with more memory -- more memory allows for better query caching and better indexing caches.
It is a known issue and they should have a fix soon. At least that is what the promised me, I have two servers waiting for it.
Peter.Vatistas:
Apache 2.0 and 2.2 are able to run in threading but PHP isn't thread ready so that might be the issue -- last Vulnerability in apache was a while back and but nothing compared to IIS.
The last reported Vulnerability for Apache was on March 13 and it was a code error that was inherited.
Peter.Vatistas:
"Don't use PHP, it is a security risk especially if you are recording personal information and accounts." Well Mike, this is with any programming lang if you don't use encryption or even ssl - come on would you trust doing online banking if your bank didn't offer SSL system.
I know the trick to “cracking” ssl. I do not do online banking.
Peter.Vatistas:
A recent search in the CERT Vulnerability Database yielded 28 hits for IIS vulnerabilities and 25 separate announcements of Apache vulnerabilities. That's as close as you get to a horse race in the information security world but it looks to me that Apache had less...
It could be my bias from working at MITRE, but CERT is not the best and most efficient database. There are only 17 individual vulnerabilities for Apache 2.2 and only 7 for IIS 6.0. CERT like Security Focus sometimes doubles-up its reports or includes vulnerabilities that were found in older versions but reported during the new visions lifecycle and sometime includes reports from other applications, so you need to pick apart each report.
Peter.Vatistas:
This whole thing can go on forever, IIS and Apache both have their flaws and I won't fight that. What I will fight is people who claim that Apache/PHP/MySQL is an inferior product and is full of flaws. The bottom line is you choose what you know. Apache and IIS are easily hacked if you don't know how to secure them. On the other hand, they're both very secure if you do know how to secure them.
That’s your choice; I worry about security of systems all the time. I do not hack a system based on if it is running IIS or Apache or Domino, I hack a system based on the goal. The server version just defines the tool kit and some servers are easier than others.
And I Totally agree, it all comes down to how well the server is secured. So lock down those boxes.