wireghoul

Spoofing active TCP connections is extremely unlikely, either they are coming from these IP addresses (botnet f.ex) or you have a misconfiguration issue that allows attackers to trick the webserver (X-forwarded-for header f.ex)

So you're comparing Java nd PHP yet none of that is relevant... kk

@slebetman not at all see plus.google.com/+JustinSchuh/posts/CNEgtJWYTb5 and wickhill.com/blog/main-category/… and blog.osvdb.org/category/vulnerability-statistics for some more information on why this is a fallacy.

@voo vulnerability counting is a terrible metric to compare how secure things are.

Ugh, now please don't ask why default credentials or buffer overflows are still around..