Forgot your password?
typodupeerror
Java Security

Why You Can't Dump Java (Even Though You Want To) 402

Posted by Soulskill
from the i-think-the-EPA-frowns-on-that dept.
snydeq writes "Since so many recent exploits have used Java as their attack vector, you might conclude Java should be shown the exit, but the reality is that Java is not the problem, writes Security Advisor's Roger Grimes. 'Sure, I could opt not to use those Java-enabled services or install Java and uninstall when I'm finished. But the core problem isn't necessarily Java's exploitability; nearly all software is exploitable. It's unpatched Java. Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of. Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty. They almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.'"
This discussion has been archived. No new comments can be posted.

Why You Can't Dump Java (Even Though You Want To)

Comments Filter:
  • Accountability (Score:4, Insightful)

    by amginenigma (1495491) on Tuesday May 08, 2012 @08:23PM (#39936213)
    Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.
    • Re:Accountability (Score:5, Insightful)

      by icebike (68054) * on Tuesday May 08, 2012 @09:21PM (#39936795)

      Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.

      The criminal justice system, and the police are scaled just big enough to keep people from murdering each other and running off with with other people's property on any grand scale. It was never intended that this level of policing should be 100% fool proof. Even in those countries where there is totalitarian control, petty crime is rampant and tolerated simply because you can't lock up everybody.

      I doubt you or the author of TFA would want to live in a society so tightly monitored that it was impossible to commit ID theft or internet crime (he seems to equate the two).

      There was an opportunity, and actually some proposals for a non anonymous internet once upon a time. Also for absolutely verifiable Email senders. That path wasn't chosen, and would likely have been impossible anyway, with the side effect of turning a lot of petty internet activity into internet crimes, merely because you posted without a license, or made a name up.

      • Re:Accountability (Score:4, Insightful)

        by CajunArson (465943) on Tuesday May 08, 2012 @10:24PM (#39937191) Journal

        The Internet is not and never was designed to be "anonymous" despite the popular myths online. People confuse "anonymity" with the fact that the Internet does not provide any good mechanisms to verify who you are actually dealing with (SSL certificates are a semi-useful additional layer designed to fix that issue).

        Go back to the earliest days of the Internet and the WWW and you'll see that it was actually the opposite of anonymity. It was a bunch of physicists who wanted people to actually read their papers and give them grants ;-)

      • Re:Accountability (Score:5, Informative)

        by Grishnakh (216268) on Tuesday May 08, 2012 @11:02PM (#39937415)

        The whole idea of accountability is utterly stupid as long as you have a single data network that spans multiple countries. If someone in Nigeria sends you a virus or does something else illegal, WTF are you going to do about it? Nothing. There's absolutely no way you're going to make people entirely accountable for their actions as long as there's multiple governments, and worse different laws in different places. The only rational thing to do is to protect yourself.

  • less risk? (Score:3, Interesting)

    by Anonymous Coward on Tuesday May 08, 2012 @08:23PM (#39936225)

    but we can still remove java and have less risk right ?

    • Re:less risk? (Score:5, Insightful)

      by Tough Love (215404) on Tuesday May 08, 2012 @09:18PM (#39936765)

      but we can still remove java and have less risk right ?

      Indeed. I will have to disagree with "security advisor Roger Grimes" and point out that complexity breeds bugs; bugs breed security holes; Java's JIT and supporting libraries are just way too complex for their own good. This problem is made way more severe by Java's closed development model.

      Java can be made secure, just not any time soon, not until Oracle gets a clue and opens up the development process.

    • Re:less risk? (Score:5, Informative)

      by errandum (2014454) on Tuesday May 08, 2012 @09:25PM (#39936827)

      You can also not use windows and opt for linux. But is it worth it? For some, yes, I'd say that for most people it isn't.

      Java runs some cool software that most have no idea it actually is Java (it can copy the look and feel of your OS). The only way to mostly fix java is to have chrome like updates. Silent, forced on you but safe.

  • by Anonymous Coward on Tuesday May 08, 2012 @08:24PM (#39936241)

    He may be right, but he's also totally unrealistic. Nothing you ever do will stop the "underlying problem". But we can fix security holes, and pressure companies to release more secure code.

    No point hoping for what is "right", or "best". Aim for something realistic instead.

    • by jhoegl (638955) on Tuesday May 08, 2012 @08:56PM (#39936583)
      seems more like he is building a case for rules to govern the internet, justifying "big brother" tactics, and random stealing of servers from server racks by the FBI.
    • by ChunderDownunder (709234) on Tuesday May 08, 2012 @09:00PM (#39936609)

      'We' can't do anything to fix security holes in "Java", unfortunately.

      Only core virtual machine and class libraries have been released under the GPL + Classpath Exception. The installer, auto updater, javafx, java web start, browser plugin are proprietary Oracle.

      OpenJDK might be free but Java (TM) isn't. My bet, [citation needed], is that many of these Java security holes occur in unreleased code.

      • by icebike (68054) * on Tuesday May 08, 2012 @09:37PM (#39936905)

        You are right of course.

        Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. With a few thousand more eyes on that source code its quite possible it could be much more secure than it is now, especially since Grimes himself points out it was originally designed with security in mind. But as long as vendors and bloggers can claim that popular platforms fall to attack simply because they are popular, we will never see much pressure for improvement.

        Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed.

        The idea that we will ship code, vetted by nobody in particular, for execution on some remote machine, and then expect a software sandbox to contain that code successfully, forever, with zero maintenance is just begging for trouble. To do so without publicly vetting the platform in all of its details is foolish.

        • Re: (Score:3, Funny)

          by Anonymous Coward

          "Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed."

              Or employ the Goldfinger option. Drop a Nuke on Oracle, and another on on Microsoft just for giggles, and thus make all your alternate code much more valuable.

        • by Shoten (260439) on Tuesday May 08, 2012 @10:24PM (#39937189)

          You are right of course.

          Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. .

          Here, you hit the nail on the head...but it isn't about open- versus closed-source. It's about the real problem...patching. Most exploitation involves Flash, Java or Adobe Reader vulnerabilities largely because these don't get patched as easily. Microsoft became the gold standard in patch deployment over the past several years, and as a result the time in which a Microsoft-based vulnerability can be counted on to produce botted host after botted host from a compromised website is far shorter. On the other hand, Java and Adobe both tend to lag a bit in their patching, and their systems rely upon a reboot to even look for the latest version. When Microsoft pushes a patch, within 24-36 hours I usually have it installed. I don't know how long it takes between when the latest Java engine is out and when I happen to reboot and, once my machine comes back up...ah, look! A new Java version!

          Criminals will always exist, and they will go after the easier targets. Vulnerabilities will always exist. The key is to patch the vulnerabilities quickly enough and frequently enough that criminals look for lower-hanging fruit.

          • by DarwinSurvivor (1752106) on Tuesday May 08, 2012 @10:47PM (#39937325)

            Microsoft became the gold standard in patch deployment over the past several years

            I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again. Until then all the Linux users will just shake their heads at your ignorance.

            • by DigiShaman (671371) on Tuesday May 08, 2012 @11:50PM (#39937665) Homepage

              Excuse me! If MS ever pulled a stunt like that, it would be published on Slashdot with thousands of readers keel hauling Microsoft for pulling a reckless stunt like that! Microsoft has no business nor responsibility for patching a 3rd party application that may break existing functionality. Not even Apple does this in their walled garden. At least not to my knowledge as a MacBook user myself.

              I wouldn't mind if Microsoft provided warnings and notifications to users to seek out their respective 3rd party vendor for updates. But to actually hold Microsoft accountable for updating someone elses applications is ludicrous! No wonder shit breaks under Linux when an update rolls along. In fact aside from a hardware failure, 99% of the Linux horror stories involves updates breaking shit. That update policy sucks ass!

              • by cbope (130292)

                You obviously do not understand the *nix updating process. In a vast majority of cases, it's not the OS vendor patching other software. The patches/updates are created and submitted by the owners (or more likely, maintainers) of the software that needs patching/updating. The patches/updates are pushed to the various distribution servers and are pulled in using a common updater process depending on the OS in question such as yum, apt, etc.

                Yes, from time to time something breaks but that is pretty rare in my

              • by jcupitt65 (68879) on Wednesday May 09, 2012 @04:08AM (#39938791)

                MS wouldn't be patching 3rd party software (you're right, that'd be crazy). MS would provide a general framework for maintaining installed software which 3rd party vendors could hook into.

                Instead of every package implementing its own updater with its own background service and configuration system, they'd be one updater that everyone used which presented updates to the user in a central place. Instead of 10 badly implemented updaters, you'd have one good one.

                This is what all linux distributions do and it works pretty well. I expect the win8 app store will do something like this.

            • by Shoten (260439)

              They can. It's called Systems Management Server. And it works. The reason Microsoft doesn't do it for free is because then they have to deal with all the headaches of any oddness of the software or installer. Oh, and they would also be paying for the integration and deployment costs too. This is not what businesses do for free.

            • by arth1 (260657)

              I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again.

              Um, it can, and it does. It often tries to install old outdated nVidia drivers on my systems...

              The problem with Windows Update is that there is no sane or timely way for producers of other software to get a patch in. And when they do, by the time the patch becomes available through Windows Update, it's already going to be several versions behind.

    • by sjames (1099)

      Really, both are necessary. If you leave your front door wide open while you go on vacation, you'll be robbed. If you put in a steel door and door frame, bars, etc but the police just smile and wave to the nice man with the cutting torch, you will be robbed.

      "The authorities" seem to be pretty good at persecuting^wprosecuting 13 year old "uber hackers" but somehow can't seem to see the urgency in chasing after the less dangerous to society entities such as the Russian Mafia.

      • by Grishnakh (216268)

        There's a few differences. First, it's fully possible to make a "door" on your computer that really is extremely difficult to open, sort of like a steel door made with a special kind of steel that requires 100 years with a cutting torch to open. This can be done by writing very secure code.

        Secondly, the police can't do anything about criminals located in other countries. What are the police going to do about a Nigerian or Russian hacker trying to break your system? Nothing. Laws are only effective insi

        • by sjames (1099) on Wednesday May 09, 2012 @01:15AM (#39938023) Homepage

          Again, we've been known to bend over backwards to get our laws imposed on people in other countries when the FBI's lords and masters (the *AA) want them to. Perhaps they should use some of that to go after actual criminals rather than autistic UFO nuts and Megaupload.

          Most of the Nigerian scams could be handled by insisting that U.S. banks clear checks once and for all with foreign banks (as in no take backs) before they claim that a check has cleared. That won't help people who are determined to be ripped off, but it will help a lot of people. "Identity theft" could be killed dead by making banks take responsibility when they hand wads of cash over to strangers and letting credit agencies know that if they continue repeating gossip and hearsay as if it was somehow verified information, they WILL be on the hook for libel.

  • The other problem (Score:5, Insightful)

    by MrEricSir (398214) on Tuesday May 08, 2012 @08:26PM (#39936247) Homepage

    Security is one problem -- the other being that you'll get sued for using it. Just ask Microsoft and Google.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      Nobody got sued for using Java. Microsoft got sued because they called something that wasn't Java Java. Google got sued because they used the elements of Java, but not Java itself.

      • Re: (Score:3, Informative)

        by binarylarry (1338699)

        Google got sued because they made a lot of money selling a Java platform to consumers.

        Which Oracle/Sun failed horribly for years at doing. (Java ME anyone?)

        Fuck Oracle!

        • To be fair, Google also didn't get much money selling it. They got nearly all the money from searches.

          On nearly all cases, Android is free. The only exceptions are when it comes bundled with a Google product.

  • by rgbrenner (317308) on Tuesday May 08, 2012 @08:28PM (#39936269)

    Java isn't insecure, criminals just aren't being punished.

    That applies to EVERY piece of software. Why should Java get a free pass?

    • by mark-t (151149)
      Why not? Or rather, why pick on Java when every other piece of software has its own problems? The primary problem isn't the software... it never has been. The major attack vector for such malware has always been users who are not practicing diligence in being informed about what packages their computer is really running, when and where to get the latest security updates on software that they require, and whether or not some other programs should ever even be there.
      • by rgbrenner (317308)

        Users not installing patches has been an issue for as long as I can remember. That is why we have Windows Update, Mac Software Update, RHN, etc.

        So it's a problem with an obvious solution: add an auto-update feature to the JRE and enable it by default on desktops.

        Refusing to implement a time-tested solution does not allow them to wash their hands of the problem.

        • by Sarten-X (1102295) on Tuesday May 08, 2012 @09:07PM (#39936663) Homepage

          You mean the "java update" icon in the taskbar? The one that wants to update every few months?

          Yeah, I ignore it, too... It seems every update is a few hundred megabytes, and I don't really want to pay attention to it long enough to tell it to install, then come back to follow up on it. Between all of the "time-tested" self-updaters for Windows, Adobe, Apple, Google, and a dozen more I could track down if I cared to, I'm sick of the whole self-updating thing. Why the hell don't we use RSS (or equivalent) for this yet, and be able to group all the updates together in a single interface, with a single "update now" button?

          I guess that'll still be a Linux-only thing for another decade or so...

          • by PCM2 (4486) on Tuesday May 08, 2012 @09:26PM (#39936833) Homepage

            Yeah, I think the bigger problem is that the updates are weird. It's been a while since I've had Java installed on my main machines, but the way I remember it, you'd end up with a long list of updates in your Programs and Settings panel, even when they all have the same major version number. Like... you could keep Java 1.6.19 even when you uninstalled Java 1.6.12. And they don't seem to be patches, either... like, each one adds another 350MB subdirectory to some folder in your system disk, and they all just sit there like turds.

            Then there was the time Oracle tried to bundle a McAfee "security scan" [infoworld.com] in the Java updates. That really inspired confidence. "Hey, I know -- let's interrupt this vital security procedure to push crapware from our marketing partners."

            No, I think Roger Grimes is wrong -- folks can and will uninstall Java. I've been avoiding it just fine, and those bespoke Java applications that we're told all these Fortune 500 companies are sitting on will eventually be replaced with Web applications.

            (None of this is to say Java doesn't have a strong future in the datacenter, though.)

          • OS X has the App Store, which is moving heavily in that direction...
            • Re: (Score:2, Insightful)

              by Anonymous Coward

              In Apple's case, they had a perfectly good update mechanism, they just never released the patch.

          • FYI: The Oracle/OpenJDK JRE is around 14 MB. There is no real excuse for not keeping it up to date, especially when Java Update prompts you to update when there are remote-exploits on your platform. All you have to do for Java is click "Ok" once and let the damn thing update - how hard could that be?
          • Re: (Score:2, Offtopic)

            by mlts (1038732) *

            Don't forget the toolbar that usually wants to come for the ride, so one has to be very careful when clicking on the Java update icon, or else one's Web browser may have a little companion with it...

            Yes, it is removable, but a security update shouldn't come with crapware.

            I wish Oracle would start looking for the future. Java is a gem, but eventually it will be passed up for existing solutions (C#, Flash, HTML5 on the client end, ASP on the server end) unless Oracle does something.

            For example, Java updates o

      • by GIL_Dude (850471) on Tuesday May 08, 2012 @08:59PM (#39936605) Homepage
        Well, in the enterprise space you have a huge catch-22. I deal with this at work all the time. Since Oracle / Sun Java doesn't actually do patches (they just do full versions that introduce new features, break existing code, and deprecate other features), you can't deploy it. You have this trade off of known security vulnerabilities vs. enterprise software that won't work with the new versions. You have banks that require you to run Java versions that are a year old in order to move money. You have vendors whose code won't work with the current version of Java - ever (since they take longer to get their code working on new versions that it takes Oracle to release the next new version). We try as hard as we can to get app owners to test - but every last time we ship a new Java versions apps come out of the woodwork with emergency requests to "stop the push". You can't win. Bust people's critical apps and you lose. Allow machines to get owned by insecure versions of Java? Yeah, you lose there too. Oracle needs to figure out how to do security patches that just fix the vulnerabilities and don't introduce (and remove) features. Until they can do that - yes, it is their fault.
      • by Tharsman (1364603)

        I pick the same way on all third party run-time environments. Flash, Silverlight, Java, heck the browsers get a bit of slack because:

        1) They get updated very often
        2) I would be a Luddite if I don't have at lest one installed.

        I don't need third party run-times. Java is not on my system anymore. Nor is Flash. Thanks to the wonders of standardization (sarcasm), every time a website requires flash I launch it on my phone to get a standard HTML version that does not.

    • by Tharsman (1364603)

      This article was brought to you by your friendly neighbor Oracle!

  • soo.. (Score:4, Insightful)

    by Anonymous Coward on Tuesday May 08, 2012 @08:30PM (#39936285)

    We should legislate away our technical problems?
    No thanks. It's been shown time and time again that not only doesn't it work, but it tends to make the technical problems worse.

    If everyone thinks "i can just sue them later" them attention to security will drop even farther.

    There are very good security systems out there that very few people and organizations bother to implement or continue.

  • by wbr1 (2538558) on Tuesday May 08, 2012 @08:30PM (#39936293)
    We punish drug dealers and users... they keep on pushing and using.
    We punish robbers and gangsters... stores get robbed and people gangbanged every day.
    We punish rapists and other sex offenders...new ones crop up.
    We punish murderers and and wife beaters... people still get killed and wives beaten every day.

    Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.
    And somehow Grimes thinks that punishing crackers (not hackers.. I am proudly one of those), is going to make a difference. Even if you did manage to snuff it out in one place (highly unlikely), the internet is worldwide and you will have places with less lax laws or corrupt officials where those of a criminal bent can launch whatever they choose.
    Most crime (not all)is cause by real or perceived poverty or other social disparity. Spending billions to incarcerate the underprivileged does nothing but further this disparity and create -more- crime.
    Try looking at the world with empathy instead of greed and anger and try to lift people up. You may be surprised what a difference it makes.
    • Well, it's not necesarily about deterrence. It's about accountability and keeping a criminal from doing the same thing again. That shouldn't be that hard to figure out.

      • by wbr1 (2538558) on Tuesday May 08, 2012 @09:16PM (#39936741)
        It doesn't work at that either though. Many criminals would like a better life and a better chance, and don't want to make the same mistakes again. Not all, of course there are exceptions. But you take a man, put him in prison for 5 or 10 or 15 years at the prime of his life, give him some opportunities to learn, but most are bogus, and most of what is learned is -more- criminal mentality, and more hatred of -the system-. Then you put him out on the street with strict rules, little money, most of his family and friend have probably deserted him (if he had much to begin with) during his time in prison so he has little if any healthy support systems in place. No add to the fact that everywhere he turns he cannot get a job. If he owes court fines he may not even be able to get a drivers license until he can pay part of his fees, further limiting his chance of employment. Is it any wonder if he goes back to robbing stores or dealing drugs? It is what he knew and all he has left.
        And even if you made him a ward of the state forever, now the state has weakened whatever family he had, and made it more likely for others in his family to follow the same path. And there will ALWAYS be more criminals to replace him.
        So no, it is not about deterrence. It is not about accountability even. In the United States it is about making victims feel better, and about making money for the government. Bringing in tax dollars through fear.
        • by C3ntaur (642283)

          In the United States it is about making victims feel better, and about making money for the privatized prison industry.

          FTFY

    • by dkleinsc (563838)

      Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.

      What is a strong deterrent, though, is a high risk of getting caught. For instance, if you put your criminal justice resources into hiring police, training them to be more effective at tracking down crimes, and building trust with the citizens (so they'll be more likely to volunteer information), that gives you a lot better results than putting your money into keeping people in prison longer for having a bag of weed.

    • there are people who grow up in grinding poverty who would never do anything unethical

      then there are assholes like this:

      http://en.wikipedia.org/wiki/Leopold_and_Loeb [wikipedia.org]

      very intelligent, very rich, and they decided to kill a 14 year old just for the hell of it. why? because evil is real in this world, and it exists independent of poverty, neither as cause nor effect, and independent of stupidity, neither as cause nor effect

      class != morality != intelligence

      there are poor people who are good

      there are dumb people

      • by wbr1 (2538558)
        The examples you claim are exceptions to the rule. I agree that you can mix and match those categories. You can find evil rich people (just look at the heads of the banks and most of congress).
        But by and large, walk into any prison in America and take a census. You will find that at a minimum 70%-80% grew up in poor, broken homes with dysfunctional families.
        If this country spent as much effort and resources in helping to fix families, in making sure children had proper role models, in truly ending pove
        • "You will find that at a minimum 70%-80% grew up in poor, broken homes with dysfunctional families."

          There's another possible reason for that. They're the ones who can't afford spiffy lawyers.

        • ever hear the phrase "those with the best intentions can do the most damage?"

          i don't know about this very common meme about the usa having such a large prison population: i think if you go to some poor country rife with petty corruption, you'd find most poor people in favor of increasing the prison population

          the greatest perpetrator of poverty is criminality. behavior, not socioeconomics. so you stop poverty most effectively by cracking down on criminal behavior. this can occur independently and at the same

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Actually, most crime is the result of opportunity, not poverty. It's not so much class psychology or class deprivation (in the Western world real deprivation is uncommon), but that lower income people tend to live in communities where crime is easier because of 1) underfunded enforcement and 2) cheaper targets. Crime is an evolutionary strategy, and there's no reason to think that the genes aren't evenly spread throughout the society, especially considering how the lower and upper classes mix so readily thr

  • Title:

    Why Elephants Are Large

    Story:

    An Elephant's trunk is very flexible. Even more amazing are the flexible snakes in the grass. Click this link to learn all about why bird's eggs are shaped the way they are.

  • by Toe, The (545098) on Tuesday May 08, 2012 @08:35PM (#39936361)

    Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty.

    Beloved, this is not being true! I have sure-fire way to stop crimes and makes you not being victims of many internet crimes ever. Alls I needs is your passwords to your accounts, and I makes them very secures. Especially yours banks passwords accounts numbers, I very much promising. I extra interested if you been scammed before. I help most much.

    To show I most sincere, I also give you free 500 Viagra pills extra-effective man-stick for your every account you wants me protect! Your woman moan against your amazing he umbrella many time.

  • by c0lo (1497653) on Tuesday May 08, 2012 @08:35PM (#39936365)

    They (cyber criminals) almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.

    Hang on... what about the accountability of the software producer? Oh, yeah, the DISCLAIMER in the copyright/license legalese... it passes the responsibility to deal with the effects to the users. So why are the users complaining?

    Before you jump on my throat: I reckon the "social cost" of going after hackers would be higher than the cost of the "war on drugs" (even if only because a running software is intangible and the attack vectors are easier to anonymize).
    Even more, the "cost of discovering/deterring/preventing the cyber criminals" will be supported from taxes, even if the bug allowing the exploited is caused by the software producer... feels like a great incentive to reduce the cost of quality assurance stages in a software project, by externalizing them to the society... that's what corporations are excellent at, ain't it?

    • by Sir_Sri (199544)

      Well maybe the issue is more about making it obvious to the user that they need to install updates, making that process as unobtrusive as possible, and providing incentives to companies to do this well. God forbid, maybe even government regulations (although I don't think we're at that stage yet) on how these things have to behave, so that my java updates, my adobe updates my windows updates, my firefox/chrome/ie updates all come in roughly the same style and roughly the same way and with an ease of unders

  • by linatux (63153) on Tuesday May 08, 2012 @08:37PM (#39936393)

    I'm sure Java would be kept a lot more up to date if version 'x' could still run software built when version 'n' was current.

  • by Anonymous Coward

    The Java Update notification shows up in the tray (on Windows Vista and XP), you click on it and get an error message to the effect of Java couldn't be downloaded or installed. What I have to do is logout and log back in as the Admin. Now, it would be nice if there were some program in the Programs list were I could click on it and just do an update, or easily bring up the java console - like Windows Update is easy to find and run. With Java, I have to search the web or better yet, bring up a page with a ja

  • by Hentes (2461350) on Tuesday May 08, 2012 @08:46PM (#39936487)

    The big security problem with Java software is that you can't differentiate between them since they all run on the jvm. For example, you can't block net access from a Java program in a firewall, because you would have to block the whole jvm.

  • by optimism (2183618) on Tuesday May 08, 2012 @08:47PM (#39936505)

    Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes.

    I'd like to see a reliable reference for this.

    Would also like to know the impact of "zero month" exploits. Much more relevant, since Java's auto-updater pings once a month.

    Personally I only use Java for a handful of local applications, and I always disable the auto-updater attack vector.

  • Now, it's been a while since I looked into this so don't bite my head off if my information is not current, but last I checked Java had problems with DEP and ASLR and did not opt into them (on Windows). Even if a flaw is not 0-day, it's much easier to attack without DEP and ASLR, so in my opinion that's another reason to heap a high level of scorn upon it. Found this from June 2010: http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf [secunia.com] - not sure if anything has changed with java but I know some of the other
  • I haven't had Java installed on my desktop machines in years, and don't seem to be missing out on anything. Some of the less important OpenOffice functions didn't work, but that was about it.

    • I have Java installed on my systems, but have the Java plugin disabled in the web browsers I regularly use. I came across exactly one site that required a Java applet to run in the last year or so: a system to book appointments at the local government office. Maybe it's different in the enterprise; the last big company I worked for had some kind of SAP front-end as a Java applet. But for home use Java is no longer necessary on a daily basis.

    • Depends what you are doing and what machine you are running. On Macs and Linux machines Java is slightly more prevalent, on Windows not so much. For example there are excellent Java applications (not applets) such as Visual Paradigm (a UML/system modelling tool) that are best-of-breed IMHO (nb: I hate the Windows native Enterprise Architect). So yeah, there are plenty of Java Applications out there (I've built some of them and they've been fine for users).
    • by Nimey (114278)

      I help manage a BlueCat Adonis and this requires a Java application (not an applet) to run. Our Cisco AnyConnect VPN uses Java to install the client unless you're using Internet Explorer, which uses ActiveX.

      At home I will sometimes use the DBGL front-end for DOSBox, which is Java-based.

      Other than the Cisco thing, I can't think of the last time I had to run Java in a browser.

  • But the core problem isn't necessarily Java's exploitability; nearly all software is exploitable. It's unpatched Java. Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of. Instead, we allow almost all cyber

  • The problem isn't applying patches. The problems occur when applying the patch causes a mission critical application, or a very critical application to the end user to stop working. The end result is the IT department ends up fielding a ton of phone calls from irate users, and / or getting blamed for the patch, even if they have nothing to do with it.

    It is no wonder IT departments are always behind on getting patches rolled out. They need / want to test them.

    And if an individual or department have some sort

  • I dump java all the time. Try kill -3 `pidof java`

    • Do you have any religious aversion to the 'killall' command?

      Also, what is the difference between SIGTERM and SIGQUIT?

  • by PPH (736903) on Tuesday May 08, 2012 @09:04PM (#39936635)

    Because we can't do anything. We're helpless (never mind keeping up to date on Java patches). It's all hopeless. We need authority to trace the criminals and possibly take preemptive measures to shut them down and seize their servers.

    And then all you do is chase down people sharing Lady Gaga MP3s. Yeah, right.

  • As much as it sucks to have a vendor pushing patches without explicit dialogs/permission, I would argue that the global damage from lack of patches far outweighs the downsides at this point.

    This is one area Chrome gets right. Java (along with Firefox, Windows, et al) should automatically download and apply all security patches without prompting or notifying the user in any way unless you go in and manually disable it.

    I've seen people see the Windows Update dialog and immediately click cancel. They just see

  • At least in my web browsers. Can't say I've noticed that anything useful has been affected. Heck, I'm not sure I've seen any affect at all.

    Besides, understanding what the real root cause of these Java exploits is has very little bearing on whether I can dump Java. I can choose to dump it regardless of its relative security. On the web, client-side Java tends to make Flash look light and nimble - so I said no thanks to Java some time ago.

  • But that isn't going to happen as long as we have $600K of Oracle ERP software running in the company.

    • But that isn't going to happen as long as we have $600K of Oracle ERP software running in the company.

      dooooood.... don't you know it instantly loses the better half of its value the moment you drive it off the lot? Oracle software is like an oversized RV, or a boat, even a really nice expensive boat. It doesn't matter that it cost $2.4 million to build it, the day you bought it for that, it was really only worth half that, and after its been in the water, its often worth negative fortunes.

  • One of the reasons that I can't dump java is because I still use a bunch of software written in java like, say, apps on Android. And don't forget that there are pieces of software like LibreOffice [documentfoundation.org] that still have legacy dependencies on java. Sure, LO is working on rewriting those pieces, but it won't happen overnight.

    Even if Oracle loses regarding copyright and patents on the Java language, the Java APIs, etc.., they have shown that they regard the Java language as a business bargaining chip and not as an u

  • ...because you need it to run Minecraft. Or am I missing something?
  • Unfortunately a lot of us have to keep old versions of java around and apps are free to ask for old versions and get them. Java for being "portable" is far far from it every java app only seems to works on a specific range of java versions. You know those fun apps networking kit seems to love. Work with a few different vendors and different version of there firmware and quickly you need a half dozen outdated versions installed.

  • by Wrath0fb0b (302444) on Tuesday May 08, 2012 @10:23PM (#39937183)

    Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of.

    And so the appropriate thing is to see why in the heck we don't have all software always patched up to date. And the reason for that in Java is that it's bloody stupid updater takes 5 minutes and 10 clicks. Change it to be like Chrome -- background auto-update itself silently* with zero user input (or one click) -- and you'll have 99% of the installs up to date without issue.

    To be clear, for the control-freak BOFHs, enterprisey people and hobbyists that actually enjoy computer maintenance, there should be a checkbox in options that says "Disable All Automatic Updating until I uncheck this box". If the user checks it, turn on the webcam and require them to raise their right hand and swear "I AM RESPONSIBLE FOR KEEPING THIS SOFTWARE UPDATED, ANY ILL THAT BEFALLS ME FROM NOT PATCHING IS MY OWN DAMNED FAULT AND I DESERVE IT". Make sure that preference persist between installs.

    IOW, I'm not saying everyone has to do automatic silent updating, I'm saying that it should be the default setting unless the user expresses a desire to maintain it updated himself and is appraised of the risk of doing so. Let the user decide, but provide a better default behavior that's appropriate for most users.

  • by TheSkepticalOptimist (898384) on Friday May 11, 2012 @06:37AM (#39964709)

    I pulled Java off of all my systems because of the incessant nagging of updates and the fact is would add 16 versions to the computer rather then updating a single version. I found that anything using Java on a desktop was not useful or missed anyways.

    I've also gotten rid of Adobe (service) products for the same reason, ridiculously annoying install nagging and update process and yet another security hole with not much benefit. Silverlight too.

    The only reason for a website to use Java technology these days is because "the fossil" a company hired 20 years ago refuses to learn something new.
    The only reason for a website to use Flash is because they got a bunch of graphic designers who will crap their pants if they see an actual line of code.
    The only reason for a website to use Silverlight is because Microsoft wanted fossils and graphic designers to use their platform instead.

    As for updating, FTW would companies please adopt Google's model in Chrome of constant BACKGROUND updating rather then nagging "You have an update!" popup's or explicitly requiring to manually update. I love the fact that the software I am running is known to be current, relevant, stable, and secure without having to do anything but simply use the product.

    The best way for a company or technology to become irrelevant is to constantly announce your failures and expect people to invest time and effort to fix them.

Our informal mission is to improve the love life of operators worldwide. -- Peter Behrendt, president of Exabyte

Working...