Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have the option to develop a software either based on

Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, secured ...) or

PHP (which runs then only in the webbrowser or in a local xampp instance but seems also more unstable, insecure, slower ...)

Wich is the better option for the (main) application regarding maintainability, security (we work with some data like email addresses in the application), stability and speed.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

In a fight between a polar bear and a white shark, who will win ? Guess what, if this is a pool fight, the shark will munch through the bear in less than two minutes (this site makes unsubstantiated claims to the contrary, but there are strong clues that a shark eating a polar bear really happened). Now put them both on a land, and I will put my money on the bear (here is a video with a huge walrus in the same position, and it is not pretty).

This little analogy is meant to express that it depends on the situation.

If you develop your software in Java with Java code running in the client (as an applet or with Java WebStart), then most of the computing will be done on the client, which is great to make responsive interfaces and lighten the CPU burden on your servers, but also tends to require that the client is somehow trusted. This is the same issue as multi-player games: the more you delegate to the client machines, the more you give them the ability to cheat. Also, Java on the client system requires Java support to be installed, which is not hard but not a given either.

You can also make a Web site where everything happens on the server. You can do that with various languages and frameworks, including Java (that's where Tomcat becomes relevant) and PHP. That the server uses Java does not imply that the client must have Java installed (if you think otherwise then think again). It then becomes a question of "what programming language is better ?" and we know that such questions cannot be really answered. The only generic assertion that can be made is that the most secure language is that which the developer masters most. Writing a secure application requires that the developer knows all the small details of the tools he is using, because security comes from thinking about what happens in unusual conditions. Security, like maintainability and also speed, really depends on what your developers know.

share|improve this answer
    
but exploits of Java and PHP compared, Java wins / seems much safer (we just want to use currently the client version of Java / JavaSE). So Java in general is much secure? –  Daniel Ruf Dec 30 '12 at 16:20
    
I'm not sure I believe that assertion. Java has had more security bugs in its framework, whereas PHP just tends to be used by bad / newbie developers. Every language is insecure if you make bad development decisions. So I'd say PHP is more secure if you know how to code in it. An alternative is ASP.NET, which is probably one of the better choices in terms of out-of-the-box security, since it has a full suite of anti-CSRF / anti-XSS libs built in, and has a proper pre-built credential managing system that uses PBKDF2. –  Polynomial Dec 30 '12 at 16:27
    
A lot of security issues with Java are related to the isolation layer for applets: that's running hostile code and yet keep it contained. The PHP equivalent would be to let the attacker upload his own PHP-enabled pages into your Web site. Counting "security bugs" is then quite unfair (and unscientific) since Java tries to do more. –  Thomas Pornin Dec 30 '12 at 16:29
    
The java application is not intended to run as an applet or in a browser, just on the client directly eg via a jar and starting it via command line or an exe wrapper but the application could host its own tomcat instance (which is not recommended) or could sync with the mobile app (which will maybe use phonegap as solution) –  Daniel Ruf Dec 30 '12 at 16:37
    
+1 for the bear vs shark analogy xD –  miniBill Dec 30 '12 at 20:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.