Another Java Exploit For Sale 150
tsamsoniw writes "Mere days after Oracle rolled out a fix for the latest Java zero-day vulnerabilities, an admin for an Underweb hacker forum put code for a purportedly new Java exploit up for sale for $5,000. Though unconfirmed, it's certainly plausible that the latest Java patch didn't do the job, based on an analysis by the OpenJDK community. Maybe it's high time for Oracle to fix Java to better protect both its enterprise customers and the millions of home users it picked up when it acquired Sun."
Oracle owns Java now? (Score:2, Funny)
When the fuck did this happen?
Re: (Score:2)
Re: (Score:2)
Sadly I remember stagnation and security issues too when Sun still owned it too.
Re:Oracle owns Java now? (Score:5, Funny)
You mean the redundancy issues?
Comment removed (Score:5, Interesting)
Re: (Score:3, Funny)
Aww. Did a creeper explode your house?
Re: (Score:2)
Re: (Score:3)
The Right Thing (TM) (Score:3, Insightful)
So then do like Google and pay the guy for the bug.
Re: (Score:3)
Exactly.
Java isn't inherently unsafer than any other software or platform. The reason why so many exploits are being discovered is that Java is currently at the focus of the criminal malware underground. Being so widely deployed makes it a natural target, just as most viruses and trojans target Windows because it's the most widely distributed operating system. Nevertheless all these security issues are causing a lot of bad press to the Java brand. What Oracle needs to do is to reward findings of security ho
Re: (Score:2)
That would escalate quickly.
Kill it with FIRE (Score:5, Insightful)
Oracle needs to give up on browser plugins. I realize there are some mission critical business apps and a few cases where it is needed just like IE 6. We need to start pressuring the vendors to stop distributing it like we did with obsolete browsers.
With javascript and HTML 5 and CSS 3 there is no reason to keep such 20th century technology on the modern web. Consumer sites no longer even use it anymore.
With IE 6 and IE 7 gone by 2014 our eyes should focus on Java as the next technology that threatens the security of our networks that needs to bye bye. We need to do our part as IT professionals and inform PHB it is bad security just like IE 6 and demand app vendors to drop it.
Re: (Score:1)
What about www.runescape.com and www.minecraft.com ?
oracle should just fix it properly.
they need to spend whatever it takes to fix it once and for all.
Re: (Score:1, Informative)
They should die. There is no reason to do that sort of thing in a browser instead of a standalone client.
Re: (Score:1)
Use minetest, it's C++ and scales better.
X feature missing? Add it, it's open source with lua scripting.
Re:Kill it with FIRE (Score:5, Insightful)
"fix it once and for all."
Please name some softwares that have been fixed, once and for all. I'm not aware of any. It seems that everything is evolving as threats evolve. You could start with the kernels. Microsoft seems to change theirs, Linux changes theirs, etc.
You might join the chorus, and complain that Oracle evolves to slowly, or that it is incapable of evolving fast enough to remain relevant, but there is no chance in hell that it can be fixed once and for all.
Re: (Score:2)
qmail. I understand the author offered a security bounty [cr.yp.to] that's never been paid out.
Re: (Score:2)
qmail. I understand the author offered a security bounty [cr.yp.to] that's never been paid out.
Doesn't mean it's invulnerable.
Re: (Score:2)
True dat. The fact that the security bounty remains unclaimed simply means that approximately no one uses it, so it's worthless as an attack space.
Hell, by that metric, Amiga OS has been the shining paragon of network and OS security.
Re: (Score:1)
Can we kill the whole DynamicHTMLWebApp thing instead, and return the web to being about lean mean content delivery?
Separate software in Java or whatever to deliver, well, apps. Not the half-caste "browser app" thing.
Re: (Score:1)
It's too late for that. There are multiple industries built around that functionality, and with HTML5 it's only going to get worse. The only way the web will only return to the days of text-and-maybe-images is if something incredibly drastic happens to make people view the current web and a new, "clean" web as two distinct entities.
Personally, I think the only chance for it to happen is right after extraplanetary living becomes reasonable, we we have to communicate with the Earth through pencil-thin laser
Re: (Score:2)
Re: (Score:2)
lol no. Just wait for all this cloud crap bubble to burst and people realize that nowadays "in the cloud" means "is online".
And after that people might realize that "apps" are nonsense too as local data is far more secure than havin data online.
And the lack of the ability to process data locally instead of "somewhere in the cloud" aka. online will lead people to want normal local programs to do that stuff.
And with the efforts dome by governments to regulate the internet and lack of usage/interest in online
You are fricking mad! (Score:5, Insightful)
Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.
Re: (Score:1)
Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.
Can you really think you can't compare them? If one is so brilliant and the other so terrible I would think that assuming you know what you're talking about you could rattle off a list quite easily. Are you really struggling that much with debugging Javascript? Why are you having so much difficulty with it? Or with comprehending dynamically-typed languages? It's not that complex.
Re: (Score:3)
Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.
That was certainly the intent of Applets back in the day when the web was young and exciting, but it's certainly not the reality that I've seen in the industry in the past 15 years. What I have seen has been a trainwreck of end user frustration, incompatibiity and security holes you could drive a truck through. (Not quite as bad as ActiveX, but close.)
Re: (Score:1)
At least ActiveX has signed controls as of IE 6 SP1 which the browser will refuse to run anything unsigned.
With java it executes full privileges from any source! This means an infected ad server can host it via a link and it runs automatically with no user interaction! Most users of WindowsXP run as administrator too which means full privileges.
In essence it is too powerful as JVM is whole OS really that can do it. TO the user it is non native looking, slow, and does not integrate with Windows so it is an o
Re: (Score:2)
At least ActiveX has signed controls as of IE 6 SP1 which the browser will refuse to run anything unsigned.
Unsigned applets run in a sandbox with limited privileges since java 1.3 at least. That's from year 2000. With the last version you can disable applet execution and set a security level for unsigned applets.
I agree that perhaps the default should be to disable applets.
Re: (Score:2, Insightful)
All I ever see is people who constantly complain without helping with whatever they complain about. I've been in the industry now (more or less) for about the same amount of time, and every year, all I ever see is worsening cultural aspects of things ranging from every-inflating egos and deteriorating internet etiquette to constantly-atrophying documentation and increasingly-untested software. You see it on here from time-to-time when those posts pop up on occasion concerning some guy who's miffed over some
Re: (Score:2)
shame then that there are no security holes in html5 (as it does little) compared to the "modern" language that is full of them.
Re: (Score:3)
half witted rendering engine
I have one of those eeepc netbooks, and the first thing I discovered is that most of the desktop UI toolkits are completely witless rendering engines that would happily draw a dialog box larger than the screen with no way to scroll the rest of it into view.
So true. I had a tester complain that a dialog I added to an Eclipse UI plugin did not fit on the screen when running VMware at 640x480. While that may be a reasonable compromise for testing it never really occurred to me that anyone might try to use an IDE on a cheap netbook. I guess we'll see.
Re:Kill it with FIRE (Score:5, Insightful)
And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out
The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.
The real issue here isn't about browser plugins but it is the terrible management of Java by Oracle. There is nothing that inherently should make Java more unsafe than a generic web browser, the problem is unlike most web browsers, Oracle has time and time again proven to be unable or unwilling to fix gaping holes in their programs. Even when they do create a fix they still try to bundle in crapware such as the "Ask" toolbar and switch my default search engine to Ask. A slimeball tactic that should be reserved for those making keygens and the like.
There is nothing that makes Java any more insecure than JavaScript except for Oracle. Rather than simply dropping a useful element of the web, we should pressure Oracle to do what a software firm should do: fix the bugs!
Re: (Score:1, Interesting)
Except that there are still a good chunk of websites that still use Java. For example, Minecraft and RuneScape to name two.
Both applications that should be completely client side
And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out .exe file extensions but will let you run in-browser applications just fine.
So the Java browser plugin deserves to exist because... otherwise kiddies can't get around Sonicwall? Really?
Furthermore, that's a terrible argument because an institution that can prevent non-whitelisted applications from launching can also trivially block whatever website hosts the .jar for the program you want to run. And if they do, it's their damn equipment anyway, stop screwing around on it.
The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.
This is completely true, but people have pretty much gi
Re:Kill it with FIRE (Score:4, Informative)
So how many people run Minecraft in the browser ? I thought most run it outside of the browser, right ?
Re: (Score:1)
Except that there are still a good chunk of websites that still use Java. For example, Minecraft and RuneScape to name two.
And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out .exe file extensions but will let you run in-browser applications just fine.
The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.
The real issue here isn't about browser plugins but it is the terrible management of Java by Oracle. There is nothing that inherently should make Java more unsafe than a generic web browser, the problem is unlike most web browsers, Oracle has time and time again proven to be unable or unwilling to fix gaping holes in their programs. Even when they do create a fix they still try to bundle in crapware such as the "Ask" toolbar and switch my default search engine to Ask. A slimeball tactic that should be reserved for those making keygens and the like.
There is nothing that makes Java any more insecure than JavaScript except for Oracle. Rather than simply dropping a useful element of the web, we should pressure Oracle to do what a software firm should do: fix the bugs!
I can replace java with IE 6 too. We can then spend time optimizing for IE 6 and doubling your costs 200% right and making adding hacks for Netscape 4.7? My argument is it is time to move on. Yes not everyone has the state of the art Chrome browser with the latest OS on an iCORE7. However the web is not like 1997 except for www.craigslist.com and it is time to move on. Where do you draw the line with support but also moving foward and making something pretty and functional?
Java does not belong on the brows
Actually, the opposite (Score:4, Insightful)
Java applets are billion times more appropriate for running an application in a browser than a combination of
- markup language created to structure text,
- stylesheet language created to format it,
- and some alien abomination to make it all 'dynamic'.
I do see value in web apps, it is for example extremely useful to have access to Google Drive with it's text editor, regardless of where i am... But I cannot disregard that it has just a big pile of ugly hacks underneath to make it what it is. At least Java has been created exactly for writing applications and it does the job better than whole "HTML5, CSS3" stack.
The Web turned horribly, horribly wrong way.
Re:Actually, the opposite (Score:5, Insightful)
You are looking at it as a developer. Not a user nor IT support professional.
Java is:
-butt ugly
-take 30 seconds to a minute to load
-can't run on mobile platforms
- fonts and widgets are not native and look weird. Are LCD fonts in yet? Ubuntu and debian have the old school non font hinting which is a horrible eye sore
- Security risk
- Not every computer has it and those that do have different versions
- No one uses it that much
Users hate it and think they are ugly and look like something from the 1980s while Flash is all pretty and fancy and loads instantly. People do not want applications in browsers. They use applets for that on their phones or tablet operating systems hence why Windows 8 was made whether you hate it or not. The browser is for simple logic and a gui platform.
You may feel the web is horribly wrong but I.T. loves it via the cloud and salesforce.com apps. No need to install software on 5,000 computers anymore.
Re: (Score:1)
Guess you never used it as most of the things you say are plain simple false.
Re: (Score:2)
This load-time is for the first applet in a browsing-session, not each one; and "30 seconds to a minute" is an outer figure, on a reasonably modern system it will be less. I've seen Flash-based games that took a long time to initialize, as well.
Actually, you can have native widgets, with th
Re: (Score:2)
I have yet to see an HTML5 exploit that can root your machine.
JRE on the other hand....
^^^ This one factor outweighs basically everything else.
Re: (Score:3)
It is only a matter of time. They keep trying to shovel more and more shit into HTML, CSS and javascript and the tipping point is not far off.
And oh by the way I have yet to see HTML5 prevent drive by's since the same fucked up code that allowed it to happen in the 1st place is still in there. Why that code has not been ripped out with extreme prejudice is beyond me.
Re: (Score:1)
I have yet to see an HTML5 exploit that can root your machine.
JRE on the other hand....
^^^ This one factor outweighs basically everything else.
Just wait for it to become more popular and they will come. Exploiters aim for the highest user base it can hit and HTML5 is not there yet.
Re:Kill it with FIRE (Score:5, Insightful)
While I don't disagree with you completely, I think it's sad that JavaScript and HTML have "beaten" Java applets as the standard way to build network applications. Sun really dropped the ball in terms of the UX for desktop Java, and Oracle's security mismanagement has put the final nail in the coffin of Java on the desktop. But despite all of its flaws, the Java platform provides a much nicer programming model compared to "modern" web technologies.
HTML was originally designed as a way to display static, hyperlinked documents, and JavaScript was originally just a toy scripting language to do simple things like form validation. They've both evolved to support the creation of rich client interfaces, but creating rich clients using HTML5/JavaScript is not pretty. There's a web server, which spits out dynamically generated client code. Embedded in that client code is a mix of content, markup, JavaScript source code and maybe even inline stylesheets. It runs in one of a number of possible virtual machines (or "web browsers") which are all slightly incompatible, not to mention slow compared to a JIT bytecode interpreter (ironically, one of the early complains about Java applets was performance). Standardizing it all is a nightmare that takes years of political infighting and compromising on things like video formats. And you have to learn at least 3 different languages to even do anything!
It would've great if, instead of HTML/JavaScript evolving up into a full-blown rich client platform, Java just "devolved" a little bit so that it provided a stricter sandbox for applets. None of this "signed code" bullshit - everyone just clicks through on that, leading to all sorts of security problems. Just restrict all applets under same sandbox (like JavaScript does). Give it a more native UX (e.g. through SWT instead of AWT/Swing) and an App Store, and it would be great!
There's nothing really inherently wrong with the Java platform, and nothing inherent in its design that makes it less secure than JavaScript. The only problem is Oracle's lack of support, and some small implementation flaws. HTML5/JavaScript on the other hand is just a giant hack. But a standard one.
Re: (Score:1)
Java is a classic case of great engineering mixed with bad management. Many evolutionary things got killed throughout history where a competitor comes in.
Sun blew it well before Oracle's acquisition. Not having a native fat binary compiler is one. Before someone jumps at me for making at all soooo non platform compliant I have to say how many are willing to open cmd prompt and type java x? You need a very expensive $$$$$ compiler to have a .exe where the code is written in java. This gave the perception jav
Re: (Score:2)
Why do you need an expensive compiler to create an .exe file which runs Java? All you need to do is compile this program or similar in any C compiler:
int main(void) { system("java com.example.App"); }
Yes, Java bytecodes need to be compiled every time they are loaded, but with a JIT interpreter it's not so bad. Compare that to JavaScript which has to be compiled from source every time! And the JVM does not take any longer to start up than a modern web browser.
You're right about host OS integration, and yes,
Re: (Score:2)
it's significantly easier to parse javascript source, determine its validity and generate machine code from it than it is just to verify java bytecode.
for example: prove that the stack looks the same for every different way a basic block can be entered.
Re: (Score:1)
it's significantly easier to parse javascript source, determine its validity and generate machine code from it than it is just to verify java bytecode.
for example: prove that the stack looks the same for every different way a basic block can be entered.
Huh? Did you ever take a compiler class? Verifying java bytecode is really not that hard...
Re: (Score:2)
well we didn't cover java bytecode verification in my compiler classes because java didn't exist then, but I worked on the java team at one of my past jobs, i wrote a java debugger for them, and i worked closely with the team that wrote the VM.
I assume you're referring to the bytecode verification as outlined here: http://www.w3.org/Conferences/WWW4/Papers/197/40.html#1 [w3.org]
I don't think that's simpler than compiling javascript from source.
Re: (Score:2)
it's significantly easier to parse javascript source, determine its validity and generate machine code from it
Hahahahahaha. Considering that it is quite common now for DOM elements (other than <script>) to contain javascript source, often encoded in ParseInteger with an arbitrarily-chosen base value, then passed to eval(), you clearly don't understand what "javascript source" is these days.
It all comes down to the ability to run arbitrary untrusted code downloaded from the Internet, thinking that some sort of "sandbox" will protect you. Don't.
--Joe
Re: (Score:1)
If you run some unix, you can create a standalone "executable" from java classes:
https://coderwall.com/p/ssuaxa [coderwall.com]
This still needs a JVM, but then your proposal does as well...
Re: (Score:1)
again an unqualified post. You obviously never used java.
anyway do you have any numbers to prove your arguments or are you just a troll/fanboy?
Also ruining mac expirience is just an excuse to say: if done right it could show users mor than apple wanted users to see.
Re: (Score:2)
It was Microsoft that killed Java. The last thing they wanted in the late 90's was for Java Applets to become a popular and powerful feature of the Web. So they corrupted and sabatogued the rollout of Java on Windows.
It's really weird that now, more than a decade later, people are trying to lay the death blow for Microsoft. Just plain weird. And especially sad to see it happen on Slashdot. Are you all Redmondites? (more than a few of you are, it's obvious)
Re: (Score:1)
Not anti MS at all.
Java is a better language and is a real platform while javascript is well javascript. I feel people do not like apps in browsers and want a browser. Javascript can manipulate elements on a page. Not with java. It was bolted on a felt foreign. I got modded down to 0 already for this, but I will say it again. Developers love java but its users hate it.
Flash is all pretty and fast. Java is slloow to load up and butt ugly and the fonts are not even opentype for LCD screens. Eclipse uses a spe
Re: (Score:1)
> Flash is all pretty and fast.
obvious troll is obvious.
Java is *NOT* Write Once Run Everywhere (Score:2)
For any but the most trivial apps it's write once and run anywhere that you have Java 1.2.3.4.5. Not Java 1.2.3.4.4 or Java 1.2.3.4.6, but only Java 1.2.3.4.5. That's why you see so many machines with Java versions with known exploits. Because so many apps won't run with with newer versions of Java.
Can you imagine the howls of outrage if every 2nd "Microsoft Patch Tuesday", Access or Word or Excel stopped working? And you had to keep the security patch off your machine if you wanted all your expensive soft
Re: (Score:2)
That seem more a problem with the applications than with Java. Can you mention real examples?
Re: (Score:2)
Make an official Java(TM) / Corporate GunkWare(TM) browser that works with whatever stupid crap companies want to use. Problem solved.
No, no, NO (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
and throw your android device away? Buy an eyephone or a winbloatphone 1337 today! /troll
"...interact...in complex and subtle ways..." (Score:3)
And that is the fundamental bug.
It's all about teh luv (Score:2)
Google and others have bug hunts were people gather together to help find and fix bugs. If Oracle wasn't pissing so many people off they could do the same. I guess it couldn't hurt to try something like what Google is doing with Chrome. chrome bug hunt [cnet.com]
Re: (Score:2)
Is not about knowing about them in advance, Oracle was aware of the previous bug in august [slashdot.org].
Of course, is tempting to acuse Oracle of malice keeping the details of the bug for itself for giving them to government agencies for their next cyberweapons, after all, even Red October used a java bug [theregister.co.uk] for spreading. But Hanlon's Razor applies to Oracle too (unless their lawyers were involved, of course)
Re:That's right! (Score:5, Insightful)
You haven't noticed how they handle patches and vulnerability management for their database products, have you...
"This is the Critical Patch Update for , which fixes a whole lot of stuff we aren't going to tell you about. It's nearly a gig in size and changes all kinds of things...but we aren't going to tell you about any of that, either. Good luck deploying this on your mission-critical applications. You can thank us for doing this in 3-month cycles instead of twice a year (like we used to do) later."
Re: (Score:1)
Re: (Score:1)
Thats why i switched to linux. IIS5 was broken all the f****in time
Re: (Score:2)
You're complaining about Microsoft's patching with regards to IIS 5. IIS 5...which came out with Windows 2000, before they totally revamped their approach to both security and patching. That's like complaining about Ford, "because their cars blow up."
Re: (Score:1)
Doesn't Oracle have a bug bounty program for Java? (Score:5, Interesting)
Surely the bad publicity from a root exploit is worth more to Oracle than $5000? $5000 is peanuts in this context. Why doesn't Oracle have a bug bounty program to avoid problems like this?
Re:Doesn't Oracle have a bug bounty program for Ja (Score:4, Interesting)
Actually, this sounds off to me. $5K for an exploitable Java vulnerability? That's waaaaaay too cheap for the exploit market...white, grey or black. I think this guy is selling a crock of shit, but he knows that the big-money purchasers would be able to tell. So he's offering it for chump change, which is exactly what a chump happens to have on hand to pay.
Re: (Score:1)
Actually, Java exploits are pretty worthless in the market since they're so damn rampant. That and the fact this is probably a variant of an existing known exploit which can be potentially fixed greatly decreases it's value.
Re: (Score:2)
Re: (Score:3)
Re: (Score:1)
Re: (Score:2)
What makes you think he'd only sell it once?
Java Sandbox Exploit, Not Java Exploit (Score:5, Informative)
This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.
The Java Virtual Machine (JVM) has access to the filesystem and can fork processes. In an attempt to make this safe to use in a browser, Sun wrote a sandbox, that is supposed to block access to the filesystem and to process execution. The sandbox doesn't work, and may never work. Disabling the Java plugin in your browser is a good thing. It might have been nice if the sandbox worked, but it doesn't. Don't run untrusted code in the JVM, whether in a browser or otherwise -- just like not running untrusted C code.
You can Java on a server, open a port, expose that port to the Internet, and as long as you haven't written a hole, nothing bad will happen. That is because this is not a Java exploit. It is a Java sandbox exploit.
Re: (Score:1)
This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.
While that distinction is important to the people exploiting the bugs and the people fixing or mitigating them, to consumers it doesn't matter. It doesn't matter if the bug is in "Java Plug-In", or "Java(tm) Plug-In SSV Helper", or "Java(tm) Plug-In 2 SSV Helper" or "Deployment Toolkit". What matters is that they got attacked because of a bug somewhere inside the Java Platform. If most people who don't care about the distinction between the various components also have no use for Java outside of the brow
Re:Java Sandbox Exploit, Not Java Exploit (Score:4, Insightful)
Well, that depends on what kind of "consumer" they are. If they're a user who only has the Java plugin installed, then yeah, you're right.
But for people who are running non-browser-based desktop apps like Vuze [vuze.com], PHBs who oversee server-side Java projects, and the poor bastards who have to work under them, the advice that "Java is unsafe!!" is misleading and sensationalist.
I'd wager that most Java applications are not applets, and so they are safe from this exploit and similar ones. So the distinction between the Java platform in general and the browser plugin is a valid one.
Re:Java Sandbox Exploit, Not Java Exploit (Score:5, Informative)
I wouldn't be too keen to blame the plugin per se anyway.
The whole Java library (rt.jar and others) relies on a security model. Each class invoked has checks to see if a security manager is running and if yes then possibly deny a request based on permissions.
Poor development practices in not vetting the codebase for security checks have caused this. Specifically, this security breach is via new functionality included in JRE 1.7, where any assumptions of security requirements have been invalidated.
An audit of every class included in the JRE needs to occur with unit tests for expected behaviour inside a sandbox and outside.
Applets in a browser are the most common usage of a SecurityManager but pointing a finger at the plugin itself won't fix the underlying library code...
This is insane (Score:3)
I can't help but observe that the rate at which Java exploits started pouring forth really started skyrocketing after Oracle's acquisitiion of Sun.
I mean, seriously... look at the history. It shot up by multiple orders of magnitude in the first six months of 2010 alone, which was right after the Oracle acquisition. This, following a period where Java had actually been getting increasingly *more* secure over time, and as individual vulnerabilities were fixed, Java exploits were getting rarer and rarer.
But in 2010, it was like some sort of switch flipped. The number of exploits not only went up for the first time in many years, but it jumped at a rate previously unparallelled at any time in Java's history.
What the fuck is going on?
Re:This is insane (Score:5, Funny)
Well, the obvious conspiracy theory is that disgruntled former Sun engineers, people with extremely deep knowledge about Java, are angry at Oracle and venting their frustrations by poking holes in their former product. ;)
Re:This is insane (Score:5, Informative)
Simple:
I worked at Sun for 6 years in the JVM group before the acquisition. I stayed on for another 1.5 years before I left. I only know a handful of people there anymore, and they're staying simply to ride it out to retirement (all are in their 50s). Over three dozen people I used to work with are gone, and there's no decent replacements.
Basically, people used to working "the Sun Way" detested the new "Oracle Way" and decamped en masse between 2009 and 2011. The whole Java division is a shadow of itself, and won't ever recover.
Re: (Score:3)
Your description of what happened seems to carry a tone of some sadness to it... almost bereavement, in fact.
I'm a bit curious, however... if you don't mind going into detail, could you describe what you mean by the "Oracle Way", and what was it about it that people detested so much?
Re: (Score:2)
Well since the acquisition was announced in April 2009, there have been a total of 25 updates to the JRE 1.6 u14-u39. That represents about 150 security fixes (according to wikipedia) to a 'stable' product for which development commenced at least as early as Mustang's release in Sept 2004.
I'd suggest a fair number of those bugs lurked in the codebase back in 2008, back in the days of "the Sun Way".
So while we can blame Oracle for the current crisis in not vetting new 'method handle' code for invokedynamic f
Re: (Score:1)
The JDK codebase is incredibly complex - far worse than practically anything else I can think of, including the Linux kernel. The number of people on the planet who are good VM coders numbers maybe a hundred or two. That's it. And the rest of the organization has been decimated, too.
That's a little bit troubling, since a popular method of writing Android apps employs the JDK. People can talk about how the JRE platform can die, or be put to sleep. Android doesn't use the Sun/Oracle VM, but Java is importan
Re:This is insane (Score:4, Interesting)
It's so weird. This betrayal at acquisition seems to play out over and over. A great team is disbanded by the heavy-handed and mouth-breathing attitude of the new boss.
I'm reminded of the Easter egg in Amiga OS 1.2, which was a secret message accessible by an obscure sequence of keystrokes, UI mouse clicks, and floppy disk ejection/insertion.
Re: (Score:1)
I would say it probably has to do more with Microsoft doing a lot of work to make ActiveX safer and browsers like Firefox and Chrome taking increasing market share.
Before that Internet Explorer had such a large market share and so many easier attack vectors than Java plugins.
And after constant stream of security updates Flash is probably a bit harder nut to crack than Java is.
Re: (Score:1)
LOL
Remote Code Execution (Score:1)
Bad idea.
Just FYI (Score:1)
Marking data as code at runtime then executing it is dumb.
JIT is bad, mmkay?
Re: (Score:1)
So the consensus is that Javascript and HTML5 are also bad and to be shunned?
Near as I can tell, with both those technologies, all that an httpd does is shovel some data over the wire to a browser that then executes it.
Re: (Score:2)
The problem is that everything in http is text, no binary data. It is connectionless and the hacks that have come along to try and fix that are a joke and don't really work. So now we have shit like Avro, or JSON all this cruft that takes binary data, turns it into text, then javascript has turn that into code, then turn the results back into text, to send that data back to the server, to then get it turned back into binary data to then actual do something with it.
The web browser was never intended to be
That flushing sound (Score:2)
Is the value Oracle bought from Sun going down the toilet one piece at a time.
A couple weeks ago, it looked as if they were trying to rehabilitate Java's image and now DHS recommends that everyone disable or uninstall it.
Re: (Score:2)
The only reason Oracle bought Sun was so that Larry Ellison could use its patents to wage war against Google and Android. Java's security problems don't impair his abilities to do that, so he doesn't care.
Drop Java (Score:2)
It is a horrible language anyways. Unfortunately, there are some far better languages running on the same broken virtual machine.
Practical question (Score:2)
Can I use the IcedTea Web Plugin on Linux, or is that also vulnerable?
Re: (Score:2)
Yes.
Bah, that's what i get for not phrasing the question properly. Oh well, it's disabled for now
Click-to-play plugins to the rescue (Score:2)
It's been in Chrome for a while and landed in FF with version 16 or so. Once it's enabled ("under the hood" settings in Chrome, plugins.click_to_play=true in about:config for FF) sites can't run plugins without you giving some form of explicit permission (either whitelisting a trusted site or clicking to play the plugin elsewhere).
It really should be the default. In fact, it should have been this way ever since NPAPI came on the scene back in Netscape 2.0. Countless security problems would have been much mu