If you were doing hosting, you'd go broke
The default security is to protect the system from the developers, like in a hosting environment. Though if I were doing hosting, I'd have a separate jvm for each vhost.
A jvm takes up a lot of RAM. A single server can serve a lot of vhosts. If you don't share the jvm, then you'll run out of RAM with a lot fewer vhosts than someone who does.
Sure, sharing is less secure. It also reduces your costs a lot, allowing you to charge less. Since virtual hosting is a commodity, prices are very competitive and corners like this get cut.
Incidentally the same factor goes a long ways towards explaining why it is easier to get a cheap hosting service to give you PHP than mod_perl. When you have mod_perl you wind up with such open access that you can't prevent one user from interfering with another, so you have to separate them more. PHP is limited enough that you can fairly safely load it into a shared server. So everyone provides PHP, but to get mod_perl you pretty much need to own your own server.
Cheers,
Ben
I have come to believe that idealism without discipline is a quick road to disaster, while discipline without idealism is pointless. -- Aaron Ward (my brother)
