In the April 2010 survey we received responses from 205,368,103 sites — a slight fall in the number of sites found.

Three of the five major web servers lost hostnames compared to last month. The two servers to gain sites in the April survey are Microsoft, with over half a million more sites than in March, and nginx with just over 300k new sites. For nginx this reverses the trend of the last three months, when it lost sites due to stale WordPress blogs being expired from the survey.

The survey results this month also show how Chile's internet infrastructure has been affected by the earthquakes which hit the country at the end of February and beginning of March. The two major earthquakes had magnitudes of 8.8 and 6.9 respectively and it is estimated that they took out up to 60% of networks. Despite the scale of the disaster, the number of hostnames seen in Chile this month fell by only 12%.

An unresolved security flaw in Java Web Start could be putting millions of Windows users at risk. The bug – discovered by Tavis Ormandy – allows arbitrary options to be passed to the Java virtual machine via the javaws command line application. This gives an attacker the opportunity to execute malign JAR files on the victim's computer.

Tavis informed Sun (now owned by Oracle) about this problem, but states they did not consider the vulnerability to be important enough to break their quarterly patch cycle. Given how easily the flaw was discovered, Tavis disagreed and published his advice to temporarily disable the affected control until it gets fixed.

All versions since Java SE 6 Update 10 for Windows are believed to be vulnerable. Working exploits for this vulnerability are now in the public domain, so it is important to apply one of the workarounds suggested by Tavis:

• Internet Explorer users can be protected by temporarily setting the killbit on CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA.
• Mozilla Firefox and other NPAPI based browser users can be protected using File System ACLs to prevent access to npdeploytk.dll. These ACLs can also be managed via GPO.

Full details can be found in Ormandy's post to the Full Disclosure mailing list.

Netcraft's Web Server Survey shows that Java Web Start is very seldom used by websites, so there is perhaps little to be lost by disabling JNLP support completely. Only 0.002% of the active sites in the April 2010 survey used JNLP technology on their homepages, whereas 0.26% of homepages contained traditional Java Applets.

Although Java usage is growing amongst mobile devices, and continues to remain strong as a server-side technology, it appears to have lost the battle for interactive client-side desktop browser technology. The combined share of JNLP and Applets pales into insignificance when compared with Adobe Flash, which is now found on more than 15% of all homepages.

Memset had the most reliable hosting company site in March, responding to all but three of Netcraft's requests.

Memset provides dedicated physical and virtual servers, all-inclusive managed hosting and cloud-computing services from their two data centres near Reading, UK. Memset uses Apache on Linux to run their own website.

The second most reliable hosting company site in March was DataPipe, responding to all but four of Netcraft's requests.

DataPipe provides custom managed hosting solutions for businesses with complex Internet facing infrastructures with over 1,000 customers in seven data centres across the United States, Europe and China. DataPipe use Apache on FreeBSD to run their own website.

Six of the top ten in March were identified as running Linux and three as running FreeBSD. The operating system used by one of the top ten could not be identified.

Netcraft measures and makes available the response times of around forty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage.

Further information on the measurement process and current measurements are available.