Mass Infection of IIS/ASP Sites • Hacker News Board

Re: Mass Infection of IIS/ASP Sites

#11

Post by thrdOriginal » Wed, Jun 09, 2010, 6:34 PM UTC

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

Is this a real question or a silly jab at Microsoft? I think you're underestimating the number of existing businesses who have .NET at their core, in which case the question is what justifies moving off of .NET? In my experience .NET can be - while not as hip - a very solid framework.

Re: Mass Infection of IIS/ASP Sites

#12

Post by teilo » Wed, Jun 09, 2010, 6:35 PM UTC

chrisbolt wrote: post #9

bshep wrote: post #5

Earlier quoted context omitted.

More like: "Management Drank the MS Kool-Aid" If your boss says you must use IIS then not much you can do.

If management drinks the MS Kool-Aid, they're probably hiring people who drink the MS Kool-Aid.

That's not necessarily true. Microsoft lobbyists specifically target middle and upper management, and using arguments from authority, convince them that they must stay on Windows/IIS because it has better ROI.

Re: Mass Infection of IIS/ASP Sites

#13

Post by RyanMcGreal » Wed, Jun 09, 2010, 6:37 PM UTC

tptacek wrote: post #8

rbanffy wrote: post #7

Earlier quoted context omitted.

By using SPs you more or less double the effort to port your application away from whatever database you are using. Better to use an ORM.

You mean, except for the part where ORM-based applications are usually still injectable.

Don't ORMs use parameterized queries by default?

Re: Mass Infection of IIS/ASP Sites

#14

Post by pkulak » Wed, Jun 09, 2010, 6:37 PM UTC

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

You use IIS because you want to use ASP. You can't replace ASP with Nginx, it's an entire development stack, not just a webserver. And I actually like ASP. It's fast, easy to develop with, easy to deploy and there's great library support.

Re: Mass Infection of IIS/ASP Sites

#15

Post by johns » Wed, Jun 09, 2010, 6:38 PM UTC

tptacek wrote: post #8

rbanffy wrote: post #7

Earlier quoted context omitted.

By using SPs you more or less double the effort to port your application away from whatever database you are using. Better to use an ORM.

You mean, except for the part where ORM-based applications are usually still injectable.

Same can be said for sprocs. Any popular ORM will have proper handling for parameters. In both cases you can't rely on the tool, you have to know what you're doing.

Re: Mass Infection of IIS/ASP Sites

#16

Post by rbanffy » Wed, Jun 09, 2010, 6:38 PM UTC

tptacek wrote: post #8

rbanffy wrote: post #7

Earlier quoted context omitted.

By using SPs you more or less double the effort to port your application away from whatever database you are using. Better to use an ORM.

You mean, except for the part where ORM-based applications are usually still injectable.

It all depends on how you abuse your ORM. There must be some ORMs where you can do it, but, gladly, I believe I am not using any of them.

Re: Mass Infection of IIS/ASP Sites

#17

Post by [deleted] » Wed, Jun 09, 2010, 6:38 PM UTC

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

[deleted]

Re: Mass Infection of IIS/ASP Sites

#18

Post by tptacek » Wed, Jun 09, 2010, 6:40 PM UTC

johns wrote: post #15

tptacek wrote: post #8

Earlier quoted context omitted.

You mean, except for the part where ORM-based applications are usually still injectable.

Same can be said for sprocs. Any popular ORM will have proper handling for parameters. In both cases you can't rely on the tool, you have to know what you're doing.

It's true that stored procedures can be injectable, but it's extremely rare, and you can find the 0.1% of them that might be with a simple grep regex, unlike ORMs.

Re: Mass Infection of IIS/ASP Sites

#19

Post by archon » Wed, Jun 09, 2010, 6:41 PM UTC

chrisbolt wrote: post #9

bshep wrote: post #5

Earlier quoted context omitted.

More like: "Management Drank the MS Kool-Aid" If your boss says you must use IIS then not much you can do.

If management drinks the MS Kool-Aid, they're probably hiring people who drink the MS Kool-Aid.

It's probably more accurate to say that they're hiring people who are willing to use MS tech to pull a salary, regardless of their personal preferences.

Re: Mass Infection of IIS/ASP Sites

#20

Post by tptacek » Wed, Jun 09, 2010, 6:41 PM UTC

RyanMcGreal wrote: post #13

tptacek wrote: post #8

Earlier quoted context omitted.

You mean, except for the part where ORM-based applications are usually still injectable.

Don't ORMs use parameterized queries by default?

Yes, but they don't parameterize the sort order on every sortable table, or the limits used in pagination, or the custom join expressions ORM developers inevitably write.