We use PHP 'safe mode' to keep our shared hosting customers out of each other's files.

Is there any corresponding security setting for JSP hosting via Orion/Resin/Tomcat?

Different way to ask same question - when providing JSP hosting on a shared server, how difficult is it to prevent customer A from writing JSP code to read customer B's files? Or your Apache configs, etc?


As an aside, anyone hear any recent estimates of how many websites are running JSP right now?

From what we have seen JSP is not doing very well.
In the JAVA world Servlets is doing well.
You could get some info on JSP security here...
http://softwaredev.earthweb.com/java/article/0,,12082_883381,00.html

php on the other hand is really getting very popular.... :)


Have a great day :)

Regards
amar

P.S. Please note that the above is just a personal view. I have seen many java addicts and feel that JSP is cool... My views were just on the market that I have seen... :)

Theoretically, you can do it using security policies/java sendbox. And it will be very secure.
Yet, I don't think anyone actually worked out details on how to setup the policy for shared hosting.