I am of the same opinion. Having trialled both extensively, we stuck with asp.net MVC and SQL server. Expensive but well engineered.
It's not called patch Tuesday for nothing.
http://forums.asp.net/1233.aspx http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s... etc
Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.
For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.
The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway.
Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
Not a record. There are some seriously big apps behind closed doors. Its a different world to the public facing web.
I've no doubt Google looks at that and thinks it's almost trivially small (Chromium alone is 6.5 million lines [2]).
There's big apps in private, but very few companies are at that scale.
Facebook is a really simple project compared to most of these sort of things.