website

[advan]

Hello! We'd like to start a website that's similar to this and I just wanted to ask for some advice/insight about it. Though we're researching, I thought of asking you guys since you're practically experts in this field and could maybe help our research direction.

The site would be for a very very specific local market and no online financial transactions involved. In a nutshell, it's basically a project bid venue with members getting their own profile/gallery page and with internal member communication. Target of 200-300 members.

My questions:
1. What programming language would you recommend the site use? (most secure?)
2. We prefer programming from scratch to make it as secure as possible. We're outsourcing this --is there a way to know if we're getting good codes or if it's just ripped off the net? I know there are existing codes ready for modification, but isn't it better to have original ones?
3. Is it infinitely more difficult to host the site ourselves than to have it hosted elsewhere? Is it worth it? We estimate evaluation of 5 years' run.
4. If we're having it hosted by a 3rd party, is there a way to secure/"encrypt?" the data? (i.e.they can't access member info/mischievously "tamper" whatever's happening? lol, sorry for the paranoia, but though I see the merit in 3rd party hosting, I'm just paranoid of protecting the site's reputation.)
5. Once the beta is up, is there such a service that tests for security vulnerabilities (and technical bugs as well)?
6. Also, does $1500 for the programming sound right? (the bids we got for this project were extreme highs and lows, oddly)

Thanks in advance!

[JPnyc]

I would sayno, it's not better. Something like that is relatively complex, and you're better off having prefabricated software developed by a team over a period of time, than something whipped together by one guy in a much shorter period of time.

There's no way to know if you're getting quality work if you're not a programmer yourself. The only way you could have a clue is when bugs start popping up. Me, in your situation I would go with something prefabricated.

[advan]

Hi, JPnyc. Thanks for the tip. Actually I get two reactions about that-- aside from the security concern from my side, some programmers say they find it more troublesome to work with pre-fabricated coding and would prefer from scratch. Then others say, why work over something that's already done, why not just integrate. Will consider both. Thanks. Btw, how complex is this kind of system? Say, a fresh grad can do this, or a very senior programmer is needed?


Hope others can help with the remaining questions, thanks!

[JPnyc]

I would say it depends where they graduated from and how high their GPA was. I don't know that any language is any more secure than any other, but most of these sites nowadays that get hacked are written in PHP. Java is a viable option as is ASP, ASP.net, C. sharp, and a few others. PHP is the most popular these days, which may be why more time is spent trying to hack into it.

But again, I think you'll find fewer problems and bugs if you go with some prefab solution. We put up something like this ourselves recently, and that's what we did. You can see it by clicking the image in my signature.

[jerryctx]

3. Is it infinitely more difficult to host the site ourselves than to have it hosted elsewhere? Is it worth it? We estimate evaluation of 5 years' run.

What are the performance requirements?

• 24x7 uptime with no outage longer then an hour? Then you need a backup system and expert support on site or, at least, on call at all times (three shifts per day, seven days a week and don't forget vacations and sick time). For really critical applications you should have a disaster recovery plan (perhaps an agreement with another host to run your app if your building burns down and vice versa). And, of course, some sort of monitor to alert you when the system is offline.

Your requirements are probably much less but you still need expert support available on short notice, someone to run backups and maintenance, preferably someone who can assist the programmer with researching problems.

I vote for hiring an established host. .

[JPnyc]

yeah, I agree with Jerry on this also. Hosting a site yourself is a royal pain. Not only that, you're going to need pretty good upload speed to handle any kind of traffic. I wouldn't even consider it. I use professional hosting services for my two sites.

[advan]

Hello! Sorry for not replying sooner. Router problem left me internet-less for a few days.

Thanks for the advice on the self-hosting question. Yes, we will be going for 3rd party hosting with a dedicated server. I think for a startup, anything to help us focus our energy on marketing and operations and on nothing else is urgent. I don't think we can deal with technical burden for now.

[JPnyc]

dedicated hosting packages are expensive though. Shared hosting is probably a better start up option, unless you really don't want to be bothered with moving the site later on.

[advan]

Thanks very much for the tips.

BTW, this is other one is a personal website project, different from the abovementioned site-- sorry if this question seems silly, but I am really lacking in technical aspect of building websites.

Does having your website "subhosted" (I'm not sure what exactly you call it) say on wordpress or typepad, meaning url is www.website.wordpress.com (or using their CMS but hosted elsewhere), provide any more security than if you do your own codes and have it hosted elsewhere? I mean, does using these CMS have a connection to and effect some level of security vs hacking?

[advan]

JPnyc, I forgot to ask-- is transferring from shared to dedicated terribly troublesome and has a wide margin for problems?

[JPnyc]

That depends on your knowledge of server administration. With most dedicated hosting packages, you are the server admin/webmaster/everything else. In other words they don't manage anything for you, you just purchase their server and bandwidth, or rather lease it.

I was faced with a similar situation a few months ago. My own personal sports forum had grown out of all proportion and completely outgrown two hosting packages. The thing was constantly down because we were hitting their server too hard. I don't know what type of traffic you're expecting, but there are more robust shared hosting packages out there with certain hosts that might meet your needs. I get around 20,000 page views per day, and I still use shared hosting. I'm currently with realWebhost.com. It costs more than say go daddy, whom I had previously, but it handles our traffic without blinking.