Hurricane Electric is the most reliable hosting company site for November 2007, closely followed by Seeweb, 3FN, Canada Web Hosting and Rackspace.

Hurricane Electric is November's most reliable hosting company and specializes in colocation, dedicated servers, direct internet connections and web hosting on its own network, which uses multiple OC192s, OC48s and gigabit ethernet.

Seeweb is an Italian company, which offers both shared and dedicated hosting and has moved up from third place last month. 3FN makes a third place appearance, also offering dedicated servers and shared hosting, while Canada Web Hosting takes forth place, offering managed hosting solutions on both Linux and Windows. Rackspace makes its fifth appearance within the top ten this year, with its best performance being seen in the consecutive months of April and May, where it took first place.

November is the first month this year where DataPipe has been absent from the top ten. Datapipe was the most reliable hosting company last month, but in November saw a request failure rate of 0.25%.

Four of November's top ten hosters run Linux, including Hurricane Electric, while three run FreeBSD. Two of the hosters run Windows Server 2003, while www.green.ch uses the F5 BIG-IP device.

In the November 2007 survey we received responses from 149,784,002 sites. This is an increase of increase of 7.0M sites since last month, and represents growth of over 40 million sites since the start of the year.

Much of the growth in sites this year has come from the increasing number of blogging sites, in particular at Live Spaces, Blogger and MySpace. Instead this month, the growth mainly comes from traditional hosting providers, with large numbers of new domains at GI Partners and InterServer.

This reverses the trend in web server market share seen in recent months. Apache has seen its share seriously eroded by the blog providers (MySpace and Live Spaces use rival Microsoft IIS) during this year, but this month its share increases by 1%, taking it back to over 50% market share.

The number of active sites (which excludes parked and other templated sites) increases by a more modest 0.7 million this month. Apache also regains some ground here, rising to 47% market share and moving back to around a 10% lead over IIS.

DataPipe and Rackspace are the most reliable hosting company sites for October 2007, followed closely by Seeweb.

DataPipe is October's most reliable hosting company, adding to its earlier achievements of a first place back in March and second place in both June and July. More notably, DataPipe is the only hosting company to have made it into the top ten every month so far this year. October also saw DataPipe being presented with the Job Creation Award for Excellence by the New Jersey Business & Industry Association for contributing to the state's economic growth by creating new jobs.

Rackspace specialises in managed hosting and is well known for its promise of Fanatical Support. This is Rackspace's fourth appearance within the top ten this year, with its best performance being seen in the consecutive months of April and May, where it took first place. Seeweb is an Italian company, which offers both shared and dedicated hosting and also appeared in third place in September.

Four of October's top ten hosters run Linux, while three - including DataPipe - run FreeBSD. Two of the hosters run Windows Server 2003.

Tiscali Italia, Rackspace and Seeweb are the most reliable hosting company sites for September 2007, followed closely by Pair Networks, Go Daddy and Affinity.

Tiscali is a European telecommunications company based in Italy and markets its offerings predominantly in Italy, the UK, Germany, the Czech Republic and the Netherlands. Tiscali's core business is providing internet access and has 2 million ADSL users in the UK and Italy. Tiscali has appeared within the top ten most reliable hosting companies four times this year. Conversely, Rackspace specialises in managed hosting and is well known for its promise of Fanatical Support. This is Rackspace's third appearance within the top ten this year, notably making first place for two consecutive months in April and May. Seeweb is an Italian company, which offers both shared and dedicated hosting and last appeared within the top ten in April.

Datapipe is the only hosting company to have made it into the top ten every month so far this year. Datapipe was the most reliable hosting company in March and also took second place in June and July.

In the October 2007 survey we received responses from 142,805,398 sites, an increase of 7.6 million sites since last month. This continues the strong gains seen last month, a rate of over 5% monthly growth, with MySpace, Microsoft Live.com, and Google's Blogger each gained over 1 million sites this month. Benefitting from the gains at MySpace and Microsoft Live, Microsoft-IIS now hosts over 50 million sites.

Apache loses 2.8% share this month, partly through the strong growth at the major blogging systems, and partly due to 2.5 million domains on Apache expiring at trouble-free.net. Apache has around a 10% market share advantage over IIS now, which is the smallest gap between the two since IIS was launched in 1996.

On the active sites measure which excludes templated sites, Apache gains 1 million sites this month, though this is eclipsed by growth of nearer 3 million for Microsoft-IIS.

The BBC News website has been suffering outages today while its hosting location fluctuated between BBC Internet Services and the Akamai web application acceleration and performance management service.

For many users this afternoon, the front page of the BBC News site has been slow to respond, often displaying error messages such as "No suitable nodes are available to serve your request" and "an error occurred while processing this directive". Other users found that requests to news.bbc.co.uk caused the server to continually redirect their request back to news.bbc.co.uk, causing an infinite redirection loop which would have added to the load on the servers.

Today's performance problems coincide with apparent moves to and from the Akamai content distribution network. Prior to today, the news.bbc.co.uk site had been self-hosted by BBC Internet Services in Docklands, London.

For some periods today, the BBC News website had resolved to IP addresses belonging to Akamai, while other times it had either been pointed back to BBC Internet Services at Docklands, or did not resolve at all, thus leaving the site completely inaccessible.

Akamai transparently mirrors content stored on web servers and users then access the content from these instead of the origin server. By automatically picking a mirror server that is near to the user, performance is generally increased while decreasing the load on the origin server.

Update: Steve Herrmann, editor of the BBC News website, has published a blog article about the site problems.

Google has fixed a vulnerability in their Gmail web based email service which would have allowed internet attackers to steal mail messages from users without being noticed.

The attack works by forcing a logged-in user to add a mail filter to their Gmail account, thereby allowing their mail to be forwarded to an external mail address controlled by the attacker. Because the Gmail service did not adequately verify the origin of such requests, it was possible for attackers to create their own web pages that used JavaScript to automatically make such requests on behalf of their victims. In essence, a Gmail user would visit one of these pages and have their account compromised without necessarily realising anything is awry. Only close inspection of the Filters tab in the Gmail Settings menu would reveal what had happened.

Proof of concept exploits used JavaScript to make a silent POST request to the Gmail service and add the attacker’s filter. With the results of the request hidden in an iframe, it is highly unlikely that a victim will have noticed that their Gmail account would have been compromised, particularly while they are browsing a completely different website. While this attack scenario would only be successful if the victim was logged in, many Gmail users remain constantly logged in throughout the day, thus increasing the likelihood of a successful attack.

The technique used by this exploit is known as CSRF (Cross-site Request Forgery) and is becoming an increasingly common method to attack web applications. If a web application is vulnerable to CSRF, it will allow unauthorised attackers to carry out arbitrary actions in the context of an authorised, logged in user of the application. Not only does this make a hacker’s life easier, but it also helps them to cover up their tracks, as malicious actions will appear to be carried out, unwittingly, by authorised users of the system.

Compromised webmail accounts are regarded as a valuable commodity by hackers, as they often contain information that would allow an attacker to gain unauthorised access to other systems, such as internet banking, and to harvest credit card details from online stores used by the victim. Because the attacker is now effectively in control of their victim’s email, they could also attack other accounts belonging to the victim by following “forgotten password” links and obtaining the relevant passwords via email.

Cross-site Request Forgery vulnerabilities are often difficult to identify using automated tools and typically require testing by security aware developers.

Dedicated hosting company Layered Technologies is advising customers to reset account logins after an incident Monday night in which hackers were able to access a client support database. Layered Tech said it doesn't believe that any customer credit card numbers were compromised, but is nonetheless advising customers to change the login credentials on all their servers and underlying services created in the past two years, including webmail, SSH access, MySQL databases and cPanel reseller control panels.

"The Layered Technologies support database was a target of malicious activity on the evening of 9/17/2007 that may have involved the illegal downloading of information such as names, addresses, phone numbers, email addresses and server login details for 5 to 6,000 of our clients," company president Todd Abrams wrote to customers. "Layered Technologies responded immediately to this specific incident by conducting a comprehensive security audit of internal processes and procedures."

INetU Inc., New York Internet and Acens are the most reliable hosting company sites for August 2007, followed closely by Easynet,iPowerWeb and GoDaddy.com.

This month's leaders include two managed hosting providers who have made frequent appearances in our ranking of the most reliable performers. New York Internet, a colocation and managed services provider in Manhattan, topped the charts for the third time this year. NYI previously was most reliable in January and May of 2007. INetU, a managed hosting provider in Allentown, Pa., was second in the July survey and has appeared in the top 10 many times, including a run of seven straight months in 2004. This is the first appearance on the reliable hoster list for Spanish hosting company Acens. In January private equity firm Nazca Capital bought a major stake in Acens, which had revenue of $18.8 million in 2006.

Close behind the top three are American discount specialists iPowerWeb and Go Daddy, who offer shared hosting accounts starting at $4 to $6 per month. Go Daddy is also the world's largest domain registrar.

Three of the ten most reliable hosts run their web sites on FreeBSD, three on Windows and two on Linux.