Morning Jofm5,
Alright, let's first clear up my stance on security :
I don't care what platform you are running, I don't care whether your developers have coded in Ruby, PHP, .NET, Java or C++.
Nothing beats a propper battery by a suitably experienced pentest team. Given your average development project, a good team will pick up a number of things you or your ops team missed !
Now, back to your questions/points :
I'm surprised that you say a J2EE platform is browser specific. I don't seem to have any problem conducting online banking on a Mac or PC, using whatever browser .... the apps I've used behave and looks the same.
Ref. MS development ..... how much work does it take to harden a MS environment vs a *nix/*nux one ? It requires a lot of work during setup and a lot of work to keep it all patched up ! Sure MS are taking steps to address this in newer OSs etc., but there's still a long way to go .... still a lot of legacy code and dependencies lurking behind the fancy new GUI......
Also, I'm no .NET guru, but I do believe .NET provides an easier ability to run unmanaged code by calling OS APIs. In Java you can only call sytem resources and native code when using trusted signed code. Futher authentication tends to be more flexible in J2EE.
J2EE probably still remains far more widespread than .NET and Java JVM has been around a lot longer and hence benefits from extra maturity.
"Early" .NET adopters are having their fair share of teething troubles, some quite serious and high profile (LSE
) .... there are still many things I would have a lot of sleepness nights on if I signed-off a MS stack based solution.
Both architectures have their strengths and weaknesses ..... but its the severity and risks associated with the potential and inherent weaknesses of .NET and its associated infrastructure that worry me at the present time.
Finally, coming back to Cron's original post ....
By the sounds of things, both .NET and J2EE would be overkill for him (plus too much of a learning curve). A higher level scripting language such as ColdFusion or PHP would probably suit his immediate needs much better.