Microsoft's IIS nudged out Apache for the lead in overall satisfaction among those using each product exclusively--with IIS averaging 8 and Apache averaging 7.8.

For commerce-specific applications, we found a market so incredibly fractured that only a handful of products received duplicate citations among the CSPs we surveyed. Four named Microsoft's IIS (including the Commerce Edition); three used ShopSite (store/catalog software) from OpenMarket; three preferred Mercantec; two used the KoolKat shopping cart; and two cited the Minivend free shopping cart. At least 11 CSPs said they have their own custom software for commerce.

Such diversity and custom software reflects a young market in which some vendors limit access to code because they compete with CSP customers.

With such a spread, it's difficult to tell how well products performed without identifying the specific CSPs using them. What we can say is that only two products received a score of 5 or below on our 10-point satisfaction scale.

As for server applications, given the commodity-type services provided by CSPs catering to small business, it comes as no surprise that Perl in combination with CGI is the most popular language. More unexpected is that we found the same number of CSPs using Active Server Pages as Java--eight for each. Slightly fewer said they use C++.

CSPs that cater to large businesses support higher-level infrastructures, including Microsoft's COM and CORBA/JavaBeans. About half the CSPs targeting midsized businesses used Java alongside lower-level languages and scripts; none noted support for Microsoft's Active Server Pages, which is used more extensively by CSPs catering to smaller businesses.

A half-dozen CSPs catering to smaller businesses indicated support for higher-level languages such as Java or frameworks such as COM and CORBA.

HTML was pervasive on the client side. Only five CSPs deployed Java on the client and only three used Javascript. The heavy reliance on HTML probably reflects merchants' desire to reach a broad cross-section of clients. Today's browsers, based on multiple Java Development Kit versions, can severely inhibit any uniform approach across the Internet. Firewalls may also block active content, such as Java and ActiveX. Microsoft's Active Server Pages was used by four CSPs. One of the most adventurous companies on the client was Sage Networks, which counts small businesses as its predominant client base. Sage deploys HTML, ASP, Java, JDBC, Microsoft Frontpage extensions, and Cold Fusion on the client.

It's SSL, Not SET
Security, too, has shown up as a critical component of CSP architectures, although several providers declined to provide detailed information. PGP and SSL are far and away the leading standards in use by the CSPs. Of 36 responses, only seven CSPs didn't support SSL; only one of the companies primarily serving medium to large merchants fell into this category. About a dozen companies also support PGP.

Oddly, 15 CSPs said they don't support encryption, even though seven of them use SSL--which probably means that some didn't realize SSL includes encryption. Only one company primarily serving midsized to large businesses failed to support at least 64-bit encryption. Three (Bitwise, BX.Com and Radka) noted usage, where legally possible, of 128-bit encryption.

The Secure Electronic Transactions (SET) standard, widely promoted by the credit-card industry, had but one supporter, although about a half-dozen showed up in our larger Guide to CSPs. Even those working to foster SET say it has significant performance problems.