Nginx, an open source web server that's relatively new on the market, has been attracting some interest lately, having performed really well in some benchmarks over the past years.
In choosing server software for publicly accessible business applications, I've been wondering whether it would be irresponsible from a security standpoint, to go with server software that might be lacking in ubiquity, such as Nginx.
On the other end of the spectrum, there's Apache with its years of public scrutiny, numerous vulnerabilities that have been fixed and a security team.
Here are my thoughts on the advantages of my two candidate servers that differ hugely in market share, communities and general development environments.
Ubiquity. It seems to me that the mix of not being too easy a target and being a small player has helped some software products become less likely to be victims of targeted attacks. A good example of this would be Apple's Mac OS X platforms that has seen relatively few attempts compared to Window in the recent past.
Netcraft server market share figures for June 2009 suggest the comptetitors are running at 4% and 50% of the market for Nginx and Apache, respectively.
Smaller codebase, fewer errors. This is just a hypothesis; I haven't viewed either codebase, but assuming a similar code to error ratio, a smaller codebase might lead to less exploits.
Codebase size, according to Ohloh, is 635:75, the larger one being Apache. I'm not sure whether this includes modules, but given the enormous size delta, it probably does. (That would, of course, lead to a very incorrect conclusion since if security is your focus, you will only be running modules you need.)
- Security team. The Apache Software Foundation seems to have quite an advanced security infrastructure.
- Experience. The Apache HTTP Server projects has seen numerous exploits through the years, and no doubt have they established policies of how best to deal with problems quickly.
- Ubiquity. This can just as easily be a pro as it could be a con. It means more eyes on the code, but it says nothing of the good eyes to bad eyes ratio.
Maturity. As I mentioned earlier, the project has gone through numerous exploits and a lot of public scrutiny.
This might lead to a slightly lower risk of zero-day exploits because gaping problems are probably less likely to be missed. It might also mean that new exploits would be less critical.
A quick search did not reveal whether Apache had been subject to a security audit.
- Documentation. Attack vectors can be created by misconfiguration. This would seem less likely with Apache, as it offers an enormous amount of publications (books and articles alike) of how to secure a server.
- Number of security modules. From browsing both servers' sites, I have the feeling that Apache outnumbers Nginx in security-enhancing modules by a large margin.
Ubiquity seems to be the double-edged sword. Whether ubiquity is generally good or bad might not be a linear relationship (and probably includes other factors, like whether you're extremely vulnerable to exploits). I highly doubt there's research on ubiquity effects on security vulnerabilities, although I admittedly tried searching.
I probably wouldn't be wondering about this if we were speaking of a social application, a news site or media serving on a server separated from the business application. For an application that deals with payment, personal information and credit card numbers, my current information is leaning towards Apache.
As I'm not a security expert, and my thoughts weren't gathered scientifically and may therefore not be too conclusive, I'd appreciate any input on what factors should influence a decision like this. If nothing else, this remains for the consideration of others in the same position.