Cross-Platform Java Sandbox Exploit

DrWho520 points out this report at silicon.com which begins "A flaw in Sun's plug-in for running Java on a variety of browsers and operating systems could allow a virus to spread through Microsoft Windows and Linux PCs. The vulnerability, found by Finnish security researcher Jouko Pynnonen in June, was patched last month by Sun, but its details were not made public until Tuesday." The hole affects Linux and Windows.

Comments

Makes me wonder...

[Thaidog]

...If java is really just as bad as ActiveX

Re:Makes me wonder...

[Ctrl-Z]

... Or worse since it runs on more than just Windows.

Re:Makes me wonder...

[Anonymous Coward]

Correct. Except ActiveX cannot infect Linux. So I suppose the answer is actually no. Cheers.

Re:Makes me wonder...

[I confirm I'm not a]

...Or better, since Java runs in a (relatively) secure sandbox. It's worth noting, from the article, that there hasn't to date been a single Java virus. This is bad, but it has to get a lot worse before comparison with ActiveX is warranted.

Re:Makes me wonder...

[JustOK]

hasn't to date been a single Java virus.

...that we know about...

Re:Makes me wonder...

[fforw]

...If java is really just as bad as ActiveX

no.

This the only cross plattform security issue known. and it's a theoretical one, no exploits known.

One failure in a secure sandbox environment is still not as bad as an environment where any code is executed and the security consists of the developer saying:

"I don't think I built in something harmfull and sign that belief with this digital signature"

Re:Makes me wonder...

[owlstead]

There are differences. This is a bug in the security implementation of Sun. That's bad, since it goes for every platform. However, this is a single bug. With active X, you are in problems if there is a bug in *any* ActiveX component that is safe for scripting. So the target is way smaller with Java. Obviously that also makes it possible to vigourously (no spell check available - dang) test that part, so no excuse for Sun for not doing that.

Note that there are very few security notifications with Java. I can remember a few buffer exploits in the VM (not in the Java applications itself, that's impossible, unlike active X). Java makes it much easier to write secure code. So the chance on serious bugs occuring is smaller (bugs tend to be in the design, not so much in the implementation). But it is definately not a holy grail, mistakes can be made as you can see.

So is it a serious bug: answer YES. Does that make Java (/.NET managed code) a bad idea: NO. Do you need to upgrade: certainly. Is java as bad as ActiveX in the browser: definately not.

Re:Makes me wonder...

[rdc_uk]

" There are differences. This is a bug in the security implementation of Sun. That's bad, since it goes for every platform."

What you should have really noted was that this is a bug in the security implementation of java. Which is bad.

ActiveX, on the other hand, doesn't HAVE a security implementation in which to get such a bug, which is terminally bad.

Re:Makes me wonder...

[I confirm I'm not a]

> > hasn't to date been a single Java virus.
> ...that we know about...

True, and it's worth noting that the quote I offered above came from Jonathon Schwarz, who - just possibly - might be biased. I'm still inclined to trust a platform with no visible viruses than platforms with very obvious viruses. Put another way, I'm in no hurry to locate a browser that supports ActiveX.

Re:Makes me wonder...

[owlstead]

Lets make a deal: it is a bug in the security implementation of Java by Sun. Sheesh. That's what I said, didn't I?

As for the ActiveX part: ActiveX does have a security implementation. You need to sign your ActiveX component to make it safe for scripting. There can be security leaks in that. For instance the ASN-1 decoder may have a buffer overrun exploit, to name a completely random example. Or you might release a few libraries with the same signing certificate, needing to update *all* the libraries instead of one (another completely random example).

Obviously, it does not have a sandbox implementation, so you're right with the "terminally bad" part :)

Re:Makes me wonder...

[rdc_uk]

" Lets make a deal: it is a bug in the security implementation of Java by Sun. Sheesh. That's what I said, didn't I?"

I think you read an implied slur into me simply having chosen to use the word "java" instead of "sun" when paraphrasing instead of actually quoting you. None was intended.

On to the point; as I recall the 2 main problems with ActiveX security are:

1; the browser (IE being _the_ ActiveX browser IIRC) pushes "security" options such as "allow signed scripts to run". Johnny Hacker is quite capable of signing his code, thus getting it run without question on most installs.

2; it is quite plausible to spoof your signature. Then even if you are requiring manual authentication of each signature before you let it run, it may well look to the casual user like a macromedia or Microsoft signature, and therefore it gets run.

Contrast with the (intention of the) Java security model, where it is not supposed to be possible to GET the kind of access that allows destruction / subversion in the first place.

Its the (piss-weak) "security" attitude that "if company X wants access that would let it format your drives, but only after scanning all the files on them, then its OK, because its company X, isn't it?" that is the problem with ActiveX.

No "program" run through your browser has legitimate need to that level of access to your local machine.

My personal opinion is that there are 2 fundamental flaws in how some companies view "browsers":

1 - they think that the web browser and the file manager shouyld become one.

2 - they think that goal justifies tying the browser tightly to the file system on the local machine, and justifies including low-level local access mechanisms into the browser and the things it can browse.

Personally I disagree; I think that having any "web format" of data/program able to escalate its rights to that kind of level is suicidal in terms of security, and therefore the risks of the required infrastructure make having your web browser serve to handle your local file system vastly outweight the minimal benefit of dropping one program from the machine.

I also think that may have been the longest sentence I've ever written; so I'll preserve it for posterity!

Re:Makes me wonder...

[Anonymous Coward]

It is not exactly a failure of the secure sandbox environment. If you were running a standalone Java application or a Java Web Start application in the sandbox this hole wouldn't apply. This hole applies to the _C_ code that manages the Java plug-in.

Re:Makes me wonder...

[fforw]

It is not exactly a failure of the secure sandbox environment. If you were running a standalone Java application or a Java Web Start application in the sandbox this hole wouldn't apply. This hole applies to the _C_ code that manages the Java plug-in.

Well.. the result of this vulnerability is a circumvention of the sandbox environment ( not in C code but via Javascript ). You may argue that the sandbox in itself has not failed which is formally correct, but a hacker shouldn't be able to circumvent it via javascript.

Re:Makes me wonder...

[qray]

That could be like comparing two prisons. In prison A, there have been no escapes, while in prison B there have been several.

The other variable, prison A is housing no prisoners, while prison B holds 200 prisoners.

Which is a better prison? It's really impossible to tell from the number of escapes.

Java definitely has some inheritant benefits. Is it better than ActiveX, most likely, but we need to make sure we don't rely on simple imperical measurements that may not present an accurate picture.

At this point in time it would probably be more beneficial to compare Java and .Net since Microsoft has pretty much depreciated the ActiveX technology anyway.

Re:Makes me wonder...

[I confirm I'm not a]

Java definitely has some inheritant benefits. Is it better than ActiveX, most likely, but we need to make sure we don't rely on simple imperical measurements that may not present an accurate picture.

That's a fair point, and one I was largely overlooking. I'm not sure I agree with your point about .Net, however, as .Net isn't a browser-level technology like Jave applets or ActiveX (and, as far as I know, this problem only affects Java applets).

I suppose the one conclusion we can definitely draw from this is that browser-based technologies are potentially dangerous ;)

Re:Makes me wonder...

[Anonymous Coward]

Get a mac. Not only is it not affected by this bug, it also has a spell checker for every textbox in the OS.

Re:Makes me wonder...

[qray]

I'm not sure I agree with your point about .Net, however, as .Net isn't a browser-level technology like Jave applets or ActiveX (and, as far as I know, this problem only affects Java applets).

It's not yet, but I expect Microsoft to allow ASP.Net to capitalize on its existance on the client, if they haven't already. Allowing people to do some interesting things if .Net resides on the client.

One of the interesting things they could do is to use .Net's language agnostic attribute to provide the browser with more varied scripting language support. More than their current stable of VBScript, JScript, etc. Imagine using Python to script web pages. But I'm going off on a tangent now.

Re:Makes me wonder...

[Anonymous Coward]

Or better, since Java runs in a (relatively) secure sandbox. It's worth noting, from the article [silicon.com], that there hasn't to date been a single Java virus.

There was an attempt to write a Java virus, but after the coder wasted a bunch of time fooling with deployment descriptors, ANT builds, and CLASSPATH problems, he just threw up his hands and said "f--k it, I'll write it in C".

Re:Makes me wonder...

[jrumney]

There was one, it was used to spread other malware about 6 months ago. However, it only affected the MS JVM (a bug in the exception handling of the system classloader), and MS had released a fix for it about 3 months before the virus appeared, so the people it affected probably wouldn't notice it under the swarm of other viruses an unpatched Windows machine is going to pick up.

Re:Makes me wonder...

[mabinogi]

There is no reason whatsoever why using the same UI for a web browser and a file browser should cause any new security problems.

File managers do not have any higher access to the filesystem than the web browser already does.

Re:Makes me wonder...

[msoftsucks]

Actually there is a virus that attacks M$ JVM through a security hole. Take a look at Symantec's note regarding this. This is the only issue I've ever had with Java.

It figures that it would be M$ that would once again introduce security problems into software that has proven to be quite secure.

Re:Makes me wonder...

[hunterx11]

It does encourage stupid design flaws like shell:// though.

Re:Makes me wonder...

[mabinogi]

not really....I wouldn't expect shell:// to exist in a filemanager either.

hmmm...does such a thing exist in IE / Explorer, or is that a KDE thing? and what does it actually do?

Re:Makes me wonder...

[rdc_uk]

"File managers do not have any higher access to the filesystem than the web browser already does."

Bullshit.

A browser has NO need to have rights to copy or delete files that it did not create. And it only need rights to create its own files in specific places.

By definition a File Manager needs to be able to copy and delete arbitrary files in the file system, otherwise you cannot Manage your Files with it.

There is no legitimate need for the two requirements to be brought together, and the fact that they end up co-existing in the same (externally scriptable, by definition as a web browser) leads to security risks.

Re:Makes me wonder...

[mabinogi]

those words tell me you're not a programmer, or do not understand operating systems very well.

Pretty much every application written for an operating system can create, copy, move and delete files, as long as the user running the application has the appropriate permission.
The ability to do so is part of the standard operating system libraries.

A filemanager is just a graphical interface to those functions - it has no special priveledges that allows it to do those operations.
An execute arbitrary code bug in a web browser would allow you to do all those things regardless of whether or not it was the same programme as the filemanager.

There is no reason why combining the two programmes should immediately make the filemanager externaly scriptable - a programmer has to deliberately and manually expose a function to the scripting engine before it can be used, it's not something that happens by magic. (Although with QT4, it probably will - but DBus / DCOP are totally different things to the javascript scripting used in the browser, and javascript should not be able to make DBus or DCOP calls any more than it should be able to write to the filesystem).

Also - explorer.exe and iexplore.exe are not actually the same programme. They share common components, such as the rendering engine, and explorer.exe has some UI concepts from a web browser - such as the back button, but other than that, they are different applications.

I would be interested to know just how many security flaws in IE are a direct result of the supposed integration of browser and filemananger.
I think you'll find that most of them are buffer overflow bugs, Active X vulnerabilities, and cross site scripting bugs.

Windows and Linux?

[Locdonan]

Since the architecture is so different, could a virus really spread between the two of them? I mean Linux is more secure for a userlevel, so I think that may be overrated.

Re:Windows and Linux?

[DaEMoN128]

There are already proof of concept viri that work on both linux and windows.
http://antivirus.about.com/library/weekly/aa032801 a.htm/
http://www.itworld.com/AppDev/1312/IWD010328hnvirl in//
looks like this has been happening since 2001 according to the itworld article (look at the date in the upper left hand corner.)
the only thing that has changed is the vector of infection. There was also a /. article if i remember right, but i can't seem to get the right search terms to find it.

Re:Windows and Linux?

[rdc_uk]

What the article says is that the same exploit (same hole in the Java Runtime Engine's security) allows access to multiple OSes (through multiple browsers)

So; johnny hacker writes his Java exploit; part of which decides what OS it is currently fiddling with, then has it deposit an appropriate payload for the OS.

Voila; spreads through Windows and Linux.

Write once, run anywhere :)

Re:Windows and Linux?

[Burb]

"Write once, infect everywhere."

Re:Windows and Linux?

[owlstead]

That goes for any plugin that you cross compile though. If you create a bug in the plugin you are in a mess on any platform (except if they are platform specific). Unfortunately, Java is a sort of META plugin, like flash etc. So there are many Java runtimes/plugins out there which all need to be patched. Also, with a platform dependent plugin you might need to do some cross compiling to the exploit as well. You will need to do something like that for the exploid anyway, deleting "boot.ini" on a linux system may not work.

Re:Windows and Linux?

[fforw]

So; johnny hacker writes his Java exploit; part of which decides what OS it is currently fiddling with, then has it deposit an appropriate payload for the OS.

Voila; spreads through Windows and Linux.

.. except that this vulnerability will escalate the privileges to that of the user which runs the browser if exploited, so in Linux it can "only" trash the user's home directory.

Re:Windows and Linux?

[conteXXt]

It's a sandbox exploit right?

So it jumps out of the sandbox right?

Perhaps it only jumps out on one platform but spreads using many?

interesting indeed.

Re:Windows and Linux?

[jvervloet]

There was also a /. article if i remember right, but i can't seem to get the right search terms to find it.

I found this onethis one using "cross-platform virus site:slashdot.org".

Re:Windows and Linux?

[DaEMoN128]

thanks, i was just using "cross platform virus", way too many results about the two links I posted to look for the slashdot.org one. preciate it.

Re:Windows and Linux?

[Cereal Box]

so in Linux it can "only" trash the user's home directory.

I think a lot of Linux zealots tend to downplay the importance of the home directory. After all, if you're a smart user and don't run as root, all your important data is going to be in the home directory (and possibly other directories where your user has permissions). I could care less if the OS install gets wiped out -- that can easily be replaced. The data in my home directory can't. In that regard, losing your home directory is just as bad as losing the entire system.

Re:Windows and Linux?

[fforw]

I think a lot of Linux zealots tend to downplay the importance of the home directory. After all, if you're a smart user and don't run as root, all your important data is going to be in the home directory (and possibly other directories where your user has permissions). I could care less if the OS install gets wiped out -- that can easily be replaced. The data in my home directory can't. In that regard, losing your home directory is just as bad as losing the entire system.

The home directory normally only includes data and settings. It's not fun if you lose data ( if it's important data you should have backups ), but it's worse to have a system compromise where the attacker can control your system, install backdoors to use your system for every purpose he can think of and can even fry your hardware in some cases.

Re:Windows and Linux?

[Finuvir]

All of what you say is true, but you omit the possibility of a multi-user system. If a single user has non-root permissions he can only destroy his own data, not those of others.

Re:Windows and Linux?

[Mysticalfruit]

Your totally right. Here's how you solve the problem.

1. Create a seperate user called "webuser". Thus when some stupid java exploit attempts to delete your home directory, it can't.

2. configure your selinux security so that the JIT can't create/delete stuff except inside of a "java temp" directory. Fine let the virus go wild, too bad it won't get anywhere.

3. Impliment a sensible backup plan. What's really important for you to backup? Software can generally be downloaded again. The only stuff that's not replaceable is code and settings.

Re:Windows and Linux?

[StormReaver]

"There are already proof of concept viri that work on both linux and windows."

This has been covered ad-infinitum, and is a non-issue. If you can write to an executable file, you can potentially create a virus for the host system. This has always been a big problem for Microsoft based systems because such systems have no file protections. Anything on Microsoft systems can write to any executable file, hence viruses flourished this way.

Microsoft then must have decided that virus writers had to work too hard to destroy Windows based systems, because Microsoft then coupled automatically-executed scripting languages with all its major products.

Linux systems have files with both an owner and access rights. By default, all executables found on non-developer machines are owned by the administrator and are unwriteable by regular users. Hence the difficulty of Linux viruses propagating.

Adding to that, no one has been been brain damaged enough to create a Linux based email program that includes a scripting language that automatically executes attachments. If Microsoft -really- wanted to harm Linux, it would port all its products over to Linux. Nothing destroys security faster than Microsoft. Further yet, no one has been brain damaged enough to write a Linux based email program that sets the execution bit on a downloaded file.

All known supposed "proof of concept" viruses for Linux are nothing of the sort, since they don't work. No one has yet figured out how to make a virus propagate on a typical Linux system without the express permission of the administrator.

The best anyone has been able to do to Linux is to manually exploit buffer overflows in specific server software on specific sites. Linux users will still be safe from viruses for the foreseeable future. It will require ineptitude of Microsoftian proportions to change that.

Re:Windows and Linux?

[Cereal Box]

And all of the above things are steps that are immediately obvious to new and casual users, I'm sure.

Re:Windows and Linux?

[syates21]

Time to re-calibrate the dial on ye olde time machine dude.

For at least a decade there have been "Windows-based systems" with file system access control much more sophisticated than anything offered by Linux (at least in typical configurations using rwxrwxrwx style permissions) even today.

Not to say the hard shell on most Windows systems doesn't more closely resemble swiss cheese, but you don't need to resort to inaccurate statements to make that case.

Re:Windows and Linux?

[Greyfox]

The bit about the backups damn well should be. If you can't be bothered to at least burn a CD or a DVD with your important stuff on it from time to time, you really shouldn't complain when something happens and you lose that data. It's a bit easier in UNIX since you just have to worry about your home directory. From what I've seen of Windows systems, you can install programs willy-nilly and the programs usually seem to want to store their data in the directory they installed in. The programs also modify the registry, so it seems like backing up a Windows system would be a pain in the ass.

I'm sure you can probably manage the Windows backup issue somehow, but I haven't done Windows in any significant capacity in over 7 years, so I'm not really qualified to talk about it.

Re:Windows and Linux?

[Cereal Box]

The average user, I don't think, is terribly concerned about regular backups (and definitely not willing to do them on a daily basis -- remember, even with periodic backups you could still face tremendous loss if you're between backups). Furthermore, if a new or casual user has made the switch to Linux (by either being convinced by a Linux nerd friend to so or because said Linux friend went ahead and did it without the user's knowledge), I think they'd be less inclined to perform backups, after hearing constant talk about how secure Linux is.

Re:Windows and Linux?

[ultranova]

I think a lot of Linux zealots tend to downplay the importance of the home directory. After all, if you're a smart user and don't run as root, all your important data is going to be in the home directory (and possibly other directories where your user has permissions).

Unless you're really smart and use "su" to move/copy really important data to a place your normal user account only has read permissions to.

AFAIK SELinux should allow one to solve this problem, by allowing a finer-grained control over permissions (so you could tell the system to not let the web browser write anywhere except its download/cache directories). Theoretically, that should allow you to gain virtual immunity for widespread destruction from anything but kernel bugs.

Re:Windows and Linux?

[Carnildo]

I think a lot of Linux zealots tend to downplay the importance of the home directory. After all, if you're a smart user and don't run as root, all your important data is going to be in the home directory

And the nice thing about that is that it makes it dead simple to back up your system -- you know where all your datafiles are.

Re:Windows and Linux?

[egreB]

You do have a point regarding the Windows security model and, in particular, the NTFS security system. Critics might argue that the model is far more sophisticated than one needs (and thus, among other things, will lead to more potential security holes), but my point is a different one. The trouble with Microsoft-products is usually the high-level security - point in case; user accounts in Windows XP Home run as administrator by default. This, of course, renders almost every low-level security policy designed and implemented in NT unusable.

Re:Windows and Linux?

[Greyfox]

Backups aren't just about security! Hard drives DO eventually die after all. Break-ins, fires and other disasters do occasionally happen. If you back up every so often, you have a much better chance of not having to rebuild everything from scratch.

Of course, if you don't really care about the data, don't back it up. But if you've got 2 or 3 years of pr0n^H^H^H^Htax returns stashed in your computer, you might want to think about burning a backup CD every once in a while.

Re:Windows and Linux?

[JThundley]

If you're like me and run Gentoo, it's harder to replace the rest of the system compared to your measily un-compiled home directory!

In all seriousness, back up /home and /etc regularly and don't worry about it.

Re:Windows and Linux?

[Anonymous Coward]

"For at least a decade there have been "Windows-based systems" with file system access control much more sophisticated than anything offered by Linux"

"More complicated than"

Re:Windows and Linux?

[imess]

This is the case only if you are the only one using your computer.

Re:Windows and Linux?

[Trejkaz]

Nevertheless that single user still loses 100% of his data.

In any case, the home directory tends to be one of the partitions which is easier to back up, due to it (generally) having less crap in it. A nightly script which backs up my home directory to another disk pretty much ensures that nothing can screw you completely.

Re:Windows and Linux?

[Anonymous Coward]

... so in Linux it can "only" trash the user's home directory

I'm guessing you aren't aware of something called a privilege escalation vulnerability. They have been around for a long time, sometimes refered to as "local root exploits". There have been hundreds discovered for Linux since it's creation. More will be found. Chances are there's some setuid-root program on your current Linux box vulnerable to privilege escalation attacks.

Saying a Linux virus can only trash your home directory is a pretty ignorant and dangerous thing to say, so please stop repeating it.

Re:Windows and Linux?

[gNukkekAalosj]

[...]but it's worse to have a system compromise where the attacker can control your system, install backdoors to use your system for every purpose he can think of and can even fry your hardware in some cases.

Not to mention that an attackers inabilaty to gain system-level privileges in most cases removes the incentive to exploit...
Sure, some people get a kick out of deleting my personal files, but a significant portion of exploit have a different purpose, making my computer a less attractive target.

Re:Windows and Linux?

[Temporal]

Three things:

(1) Windows has full multi-user support with the ability to do most of your work as a non-admin, just like Linux. Most users don't bother, since multi-user features are essentially useless on a desktop system that is only used by one person (see point 2), but it is perfectly possible.

(2) Why would a virus need or even want to be root? To log your keystrokes? It can already do that as a user (and, BTW, it can log your keystrokes when you run sudo and capture your root password). To launch a DDoS? No, that can also be done as a user. How about to spread itself? Nope! It can easily set up a web server on a high-number port and send out all the e-mails it wants linking to it.

(3) A dual payload wouldn't be a big deal if most of the virus was implemented in Java. The only OS-specific portion would be editing the necessary startup scripts to make sure the virus is run, which isn't much of a task.

Disclaimer: I am a fan of neither Windows nor Unix.

Re:Windows and Linux?

[nikster]

ad: webuser

I wanted to have this for a while: If I am a system admin, and start my browser, could it not be set up so that i am actually starting a browser-launcher, which then starts the browser but with the rights of "webuser", who can't do anything but modify the downloads directory?

even Microsoft could do that, and even their buggy-as-s*** web browser would now be safe because it's the OS that is taking care of security.

on linux or mac, it would be even easier because AFAIK all the OS support for a scheme like this would already be there.

you get a 100% safe web browser, guaranteed by unix security. the web browser, with all it's messy bits and pieces, is running in a safe sandbox.

Re:Windows and Linux?

[DrYak]

Since the architecture is so different

No, the architecture IS NOT different.
I mean, yes, Linux and Windows ARE different, but according to the article :

A vulnerability in the Java Plug-in may allow an untrusted applet to escalate privileges, through JavaScript calling into Java code, including reading and writing files with the privileges of the user running the applet.

The bug is INSIDE the Java virtual machine.
If a virus targets the bug, it won't be binary (x86) code targeting Linux or Windows, but Java bytecode targeting the bugged Java VM (not knowing at all on which OS the VM itself is hosted - this could be x86 Windows, AMD64 Linux, or even SPARC Solaris).

I mean Linux is more secure for a userlevel, so I think that may be overrated.

I agree with you, because, in windows, "privileges of the user running the [virus]" usually means "total absolute administrator privileges".

Re:Windows and Linux?

[Anonymous Coward]

really? strange. mine tend to include a .ssh/ directory which includes an ssh key or three.

now, perhaps i have a passphrase on my key, but that's not guaranteed to protect it for very long.

the directory also has a list of hosts which i tend to frequent, a great starting list for places to attack once you do get my keys.

some people i'm told have pgp keys too...
perhaps those are stored in /usr or some strange place, but i'd bet they're stored in ~/something.

sure i can go out and cancel my pgp keys, but that's non trivial, damage can be done first, and then people should decide to trust me less. after all someone successfully impersonated me.

and yes, someone will tell me that i should have kept all my keys on a usb device, so that it can be crushed or stolen (for bonus points, someone should capture my keystrokes and key by rooting the computer i visit w/ my usb key device).

Re:Windows and Linux?

[MisterEntropy]

That's the promise of Java -- write it once, and infect anything.

Re:Windows and Linux?

[fforw]

So you would prefer a root compromise?

Another good reason to allow third party review...

[johnhennessy]

I think this tries to highlight another reason why allowing a third party review your code is a good thing

Generally, the most cost effective way can be an open source model.(there are others !)

Re:And you said Mozilla Firefox wasn't exploitable

[djsmiley]

java != mozilla

Wow i've learnt something already at uni! i better leave!

no fear slashdot!

[Scythr0x0rs]

You may soon be receiving a Java virus via your web browser.

Symptoms:

1) system loads increase by 3x magnitude
2) system starts to work slowly
3) the JVM has now loaded
4) the virus starts to install... ...
you can use the 15 minutes it takes java to load a virus (or anything) to close your web browser at this point.
5) If you are not able to stop the virus, look out for strange windows with dodgy toolkits. Yes, Java AWT, this means you.

At least...

[lxt]

At least (unlike several other large companies), Sun produced a patch before the issue was released to the public. How many times does this normally happen (certainly, I can think of no instances this has happened for Windows - anyone care to enlighten me?)...

Re:At least...

[Anonymous Coward]

That's the way Microsoft typically tried to do it before everyone started bitching about them doing it that way. Of course Sun does it that way and they're the darling hero. Slashdot is Fox News for people who should know better.

Re:At least...

[Anonymous Coward]

It happens all the time with Windows. The difference is that when the /. crowd finds out that Microsoft knew about an exploit a month before they release the patch it turns into another bashing session.

Re:At least...

[rdc_uk]

The "patch before admitting the problem" thing DOES happen on Windows.

But when it happens on windows it is microsoft "covering up their vulnerabilities".

Apparently, for you, when someone else does it they are doing something good...

Security by Obscurity, no matter who does it, it is still bad. Just because the WHOLE WORLD didn't know about it, doesn't mean some virus writer didn't; it just meant everyone continued to use un-patched Java installs in blissfull ignorance of the risk.

Re:At least...

[Anonymous Coward]

The key is "for people who should know better."

I regret to inform you Ms. Huddy maps to tubgirl. And knowing is half the battle. (The other half being forgetting)

Re:At least...

[Jokkey]

Security by Obscurity, no matter who does it, it is still bad. Just because the WHOLE WORLD didn't know about it, doesn't mean some virus writer didn't; it just meant everyone continued to use un-patched Java installs in blissfull ignorance of the risk.

You're saying that vulnerability details should be announced before patches are completed? I'm afraid I disagree. There's a fair bit of evidence (see stories here and here) that black hats are using vulnerability announcements and patches to find exploits rather than finding them themselves. If that's the case, keeping vulnerabilities quiet until the software company's had a chance to patch them is a good idea, even if security through obscurity is in general a bad idea.

Re:At least...

[sumdumass]

Wow, you can bash fox news. Maybe we are at a point in life were you just don't get it.

The people saying sun is the hero isn't the same people that are saying microsoft is the root of all evil for the same reasons. Yes it may be a shock to you but, different people with different opinions frequently visit this site. Also like the fox news comment, you don't seem to have the ability to read somethign with a grain of salt. You take one statement and asume it is the belief of the entire comunity.

Why don't sub you fox news comment with a cbs comment. afterall they are the one making the news up instead of reporting it in a way you don't like.

BTW, what has fox news ever reported that was wrong or missleading? Outside calling florida in the 2000 elections i am not aware of anything.

Re:At least...

[Fjornir]

certainly, I can think of no instances this has happened for Windows

Holy shit, you knew about EVERY security fix released on 11/2 ahead of the fact? And on 10/5? And on 9/9? And on 8/10? 7/6? This is STANDARD, you TROLL.

Listen up -- when someone finds a problem with a product they generally go to the manufacturer say "Component foo has problem bar which can yield baz result. Note the following sample code." The company then isolates the cause, finds a fix, tests it, and releases the patch. They don't send out an irresponsible security bulletin saying "OMG!!! WTF?!? U K4/\/ 0\/\/NZ0R O|_|R SH1+ L1K3 TH15! \/\/3 W1|_|_ F1>But... occasionally... something does go terribly wrong. The person who finds the bug may not be responsible enough to contact the vendor directly and might instead go public right away. At which point the vendor posts a bulletin about an exploit "in the wild" -- and describes mitigation procedures to keep you from being f'd.

Re:At least...

[bunratty]

"Security through obscurity" refers to a cryptographic algorithm that relies on security by keeping its algorithm secret. It does not mean that keeping any kind of secrets is not a valid form of security. After all, even with modern cryptographic algorithms, you still need to keep your private key secret don't you?

Re:At least...

[Jameth]

The reason it's different here is that the patch was submitted swiftly. They clearly were dealing with the problem as quickly as possible. Some other organizations have sat on information for over a year without issuing a patch, which is an unacceptable turn-around.

Most people believe in giving companies a head-start on fixing problems, because they often can fix them swiftly. In this case, that head-start worked out.

Re:At least...

[Cereal Box]

other organizations have sat on information for over a year without issuing a patch, which is an unacceptable turn-around.

Sort of like how Mozilla "classified" bugs that sat around for YEARS before getting fixed? Case in point, the "shell:" expoit of a few months ago. Turns out the Mozilla team knew of a potential problem for years, but "classified" the problem and didn't do anything about it until an actual exploit surfaced. Of course, here on Slashdot, there was no harsh words for Mozilla, because after all, it was "Microsoft's problem".

Re:At least...

[Archangel_Azazel]

http://64.233.167.104/search?q=cache:B7hYQ0Ipn1sJ: www.philly.com/mld/philly/news/special_packages/ir aq/6918170.htm+fox+news+wmd+weapons+of+mass+destru ction+study&hl=en&client=firefox-a/
Weapons of Mass Destruction. That was the first thing that came to mind...I'm sure that with more time and want...I could find more...but there's a start for you.

Asmodeus

Re:At least...

[teromajusa]

I agree with your main point, but not what you say about Fox news.

Why don't sub you fox news comment with a cbs comment. afterall they are the one making the news up instead of reporting it in a way you don't like.

They did not make up the story about Bush's service records, they were tricked into believing it. Whether they should have detected the fraud or not is a matter of opinion. Much like Bush's similar misstep.

BTW, what has fox news ever reported that was wrong or missleading?

Read this

Re:At least...

[Anonymous Coward]

"and describes mitigation procedures to keep you from being f'd"

But, as we all know, such procedures are not needed for the /. readership.

Re:At least...

[Jameth]

There were plenty of harsh words for Mozilla here. Perhaps we read a different article, where yours had completely different comments?

Re:At least...

[Anonymous Coward]

Oh Please. Microsoft bashing around here is ridiculous. It's part of a strict dogma that creates it's own truth which bears no relation to any objective truth ala 1984.

And Fox News is much the same, hate on Micheal Moore (who is a hack) but take Ann Coulter seriously.

Logistically, what they do is pretty impressive. A very lightweight responsive organization that disseminates information very quickly on occasion. Well Slashdot does that too.

Re:At least...

[sumdumass]

I read your link. i don't think it conveys the message you are attemping to. While people that believed one of the three misconceptions listed fox news as a primary source of news, there were plenty of examples of other sources with people holding the same opinion. CBS was one of them but they indecated newspaper and other sources as well.

I have seen The study it is refering to. The conclusions drawn from it or the artice you referenced wasn't that fox news makes things up rather then people that relly on television news as a primary source of information often are not as informed as the people that radio and print media as thier primary source of news. Once you examine the numbers you also find strange fact like 60% of ABC's viewer also held at least one of the major misconceptions about the war despite ABC strongly questioning the motives and reporting the grounds for the war as "shakey".

This lends one to believe that people "watching thier news" tend to not be as inteligent or capible of comprehending it as much as those that read about it or use some source that lets relies on thier imagination/mind to occupy the reletivness of the news reports. Asmuming this is actually the case, the fact fox news had a higher percent of misinformed viewers was because thier audience is greater.

Also the page you cited has a disclaimer stating that

" Monday, October 20, 2003 - Page updated at 11:22 A.M.
Clarification: The headline states "Survey shows Fox led in misleading public," but the University of Maryland's Program on International Policy (PIPA), which conducted the survey, later issued a clarification that the correlation between viewing Fox News and holding misperceptions does not prove that Fox News' presentation caused the misperceptions. "

meaning the authors of the study doesn't claim fox news is misleading the public. In reality it is more likley what i described above in the level of comprehension of the viewers compared to the amopunt of viewers. In another article here here with its original here sheds a little more light or at least make it a little clearer on the numbers from other news sources.

I think to continue to claim fox news lies or purposley misleads in thier news reporting (not neccesarily you saying it but the general impression from others too) Is not only intelectualy dihonest but intelectualy lazy too. On the surface it is easy to come to the conclusion you did. It is the minute disclaimers that surfaced afterwards and looking into the source of the story a little that makes it clear.

In essence, you can say that you held misconceptions about "fox news' integrity" based on the same situation. Now there was actually a sitr found with about 20 barrels of a chemical (i forget the name right now) That was though to be a WMD and could have definatly caused damage as a WMD would but it turned out later to be an insecticide used with agriculture aplications.This was reported by manny news sorces other then but including fox news. This redacted story is probably the main reaosn of the misconceptions about the WMDs in iraq. The news print had to wait until publication and distrobution before releasing the news and by that time the chemicals purpose was already clearified.

I'm not a fox news schill or fanboy in the lest. I generaly get the majority of my news from the radio. I think most people would agree that the content on television (new anyways) has started lacking with the flux of 24hour news stations. I did however take the time to offer this post because i have heard too many time about how fox islieing to it's viewers or somethign along those lines. I'm under the impression that this is likely the result of

Re:At least...

[sumdumass]

This article really doesn't prove anyhing. It is a clear example of what you are attempting to claim about fox news but instead does what it claims fox news does..

Actualy that article is misleading at best. It is refering to this study

In this study you will find that almost all the news sources had at least 40% or more of thier patrons/viwers from differing networks and meadia services (ie newspaper) believing the same thing. Yest fox news watchers were higher on the list by 10% at a total of 33% of viewer belived we found WMDs in iraq were CBS was in second with only 22% of it viwers believing the same.

Also the site you linked to generalizes the concept of 3 misconceptions rather then each single one. Again fox news viewers were at a 10% higher rating with 80% of thier viewer beliving in at least one of the misconceptions with CBS again in second place at 71%. What is further interesting is that the 3 misconceptions include the U.S. finding WMD's, iraqs links to alqaeda and general worl opinion of the U.S. Over 60% of american held a misconception on at lest one of these three areas. This isn't psecific to fox news either.

You will find other resorces about this study entitled Misperceptions, The Media and The Iraq War A PIPA/Knowledge Networks Poll look under the iraq section. The questioning proccess is interesting in itself.

What we have here is a situation were national public radio had the least ill informed persons with printed news next in line. The most misinform people are the ones that watched thier news form fox news, CBS, ABC,NBC,CNN,. Somethign that debunks the effort to discredit Fox news is that over 60% of ABC's viewer were misinformed and ABC was one of the most critical and skeptical news sources about the war and events leading up to it. This leads me to believe that the study is a representation of the comprehesion and interpretation abilities of the audience rather then reflecting on the news source itself. here is another article on the same study. Somethign worth noting is the authors of the study asked for a clerification statment ammended to the article clearifying that it doesn't reflect on how fox news reports its news. Also in thier initial press release it stated Among those who primarily watch Fox, those who pay more
attention are more likely to have misperceptions. while also clearly stating

The level of misperceptions varies according to Americans' political positions.
Supporters of President Bush and Republicans are more likely to have misperceptions.
However, misperceptions do not appear to only be the result of bias, because a significant
number of people who do not have such political positions also have misperceptions.

I would contened that the majority of fox news viewers are conservative/republican in nature and that could be why the increased amount was with them. However when you have 60% of the country holding one of the misconcptions it is clear that other news sources are rrporting the same stuff in a simular fashion. If anything it describes a lack of quality in the news information reportin in general.

Re:At least...

[teromajusa]

Heh, just noticed this reply a week too late. Odds are you aren't going to see this, but since you wrote such a long reply to my post, I'm going to go ahead a reply anyway.

Admittedly, the article I linked to was not the best. I found a more pertinent one afterwards, but I don't have the link anymore. You're right that viewers of all tv news had misconceptions, but viewers of fox news had signficantly more misconceptions. Its hard to prove cause and effect with something like this, but its interesting to note that people who said they followed fox news closely were even more misinformed than those who watched it casually.

I don't think that fox news actually lies. I do think they are strongly biased, and it shows in the way they present the facts, who they choose to interview, how much time they devote to a story. Of course I can't prove this; proving something like that would require pouring over videotape with a stopwatch for hours (and would still be subjective).

Final point: you say that fox may be biased to the right, but other networks are biased to the left. I don't agree with this. The other news are biased to the center. They tend to downplay either extreme and try to balance one side with the other (even when such balance is absurd). The fact that people think that what cbs reports is the left's point of view shows how under-reported the views of the left actually are.

Java != Java Sandbox

[Cyphus]

Its the browser-based sandbox that's the culprit here, not Java. Saying its a problem with Java, is like saying an IE exploit is a problem with HTML.

Re:Java != Java Sandbox

[Anonymous Coward]

The sandbox wouldn't exist if it wasn't for Java. HTML is not IE dependent. I think that kind of nullifies your point.

Re:Java != Java Sandbox

[Anonymous Coward]

Saying its a problem with Java, is like saying an IE exploit is a problem with HTML.

You're new here, right?

Re:Java != Java Sandbox

[hackstraw]

Its the browser-based sandbox that's the culprit here, not Java. Saying its a problem with Java, is like saying an IE exploit is a problem with HTML.

I believe this is completely wrong. First, if the problem were in the browser and not Java, how did Sun fix it on 2 different operating systems and there was not mention of a specific browser.

Also, AFAIK, the Java plugin does have a sandbox which prevents Java toys from doing things like accessing local files, etc. It takes a trusted and signed applet and user intervention to go outside of the sandbox.

Re:Java != Java Sandbox

[Anonymous Coward]

It is not exactly a failure of the secure sandbox environment. If you were running a standalone Java application or a Java Web Start application in the sandbox this hole wouldn't apply. This hole applies to the _C_ code that manages the Java plug-in.

Re:Java != Java Sandbox

[Anonymous Coward]

1. Java the language != Java sandbox

1. Java sandbox != Java VM

1. Java VM != Java the language

And yet, Sun still calls all of them "Java". It is little wonder that people are confused.

Re:Disable Java

[leonmergen]

And your arguments are ?

Come on, don't just make those statements without having anything constructive to say... now you're just flamebaiting.

Time for an open source Java implementation?

[cyclop]

Ok,I know it's (1)the most trivial thing to say on /. and (2)looks like plain karma-whoring, but someone had to say it.

I know about Kaffe, but it seems to not work that well (most Java programs don't work with Kaffe)...

Re:Time for an open source Java implementation?

[steve_l]

I dont disagree, I will just point out that people are trying to get everything to work. Look at the kaffe gump stats to see how it is faring. There are problems bootstrapping ant; more diags are being added to things to track them down. Once Ant is booting, more stuff will follow.

Re:Time for an open source Java implementation?

[Anonymous Coward]

There also used to be GCJ and GIJ (GNU java compiler & interpreter). But they're several versions behind Sun Java, and frankly they're unimpressive compared to what Sun brings out.

Opera not affected

[TheJavaGuy]

This bug affected IE and Firefox, but not the Opera Browser.

Re:Opera not affected

[Anonymous Coward]

Actually the Java in Opera is even worse: http://archives.neohapsis.com/archives/bugtraq/200 4-11/0250.html

Re:Opera not affected

[Anonymous Coward]

Would you care to post more information? (It's not that I don't believe you, it's just that I don't see anything about it anywhere)

Re:Opera not affected

[TheJavaGuy]

Would you care to post more information? (It's not that I don't believe you, it's just that I don't see anything about it anywhere)

Here is more information.

Re:Opera not affected

[0zymandias]

Well, http://lynx.browser.org/ is not affected.

Re:Opera not affected

[Myen]

Hmm, I don't suppose you could explain why Opera isn't affected?

IIRC they use the Sun JRE / plugin as well... Or is there something different in Opera about Java/JS connectivity?

Re:Opera not affected

[Carnildo]

Opera uses the Sun JRE but not the Sun plugin.

Not that critical..

[fforw]

This only affects the Java plugins in the 1.3 and 1.4 Java release. The current java release 1.5/5.0 is not affected at all.

And it's a java plugin vulnerability so a website running java on the serverside is not affected.

Re:Not that critical..

[Anonymous Coward]

Yeah cause everyone is always patched right up to the newest release of everything at all times.

Now we have to patch not just all our Windows installs, but our Linux and Solaris installs as well.

Re:Not that critical..

[Anonymous Coward]

The current java release 1.5/5.0 is not affected at all.

Meanwhile, applications such as Freenet are not working reliably under 1.5 JREs, and 1.4 is still suggested. "Latest and Greatest" is one thing when you're talking about an OS, but with Java, using the latest release is often counterproductive.

Re:Not that critical..

[sporty]

Not that critical? 1.5 was released in the last month. What do you think all the people were using before last month?

Re:Not that critical..

[fforw]

Meanwhile, applications such as Freenet are not working reliably under 1.5 JREs, and 1.4 is still suggested. "Latest and Greatest" is one thing when you're talking about an OS, but with Java, using the latest release is often counterproductive.

Applications like Freenet are not affected by the vulnerability. It only affects the Interface which couples java with a webbrowser (Java Plugin).

Re:Not that critical..

[fforw]

Not that critical? 1.5 was released in the last month. What do you think all the people were using before last month?

It seems to me that Applets are dead. I am a java developer and have often browsed for months without encountering the need to tell my browser where my java is.

So most of the people are using java for applications or server-side programming.

Add the fact that this is only a theoretical vulnerability with no known exploits and the fact that not all browsers are affecrted and the conclusion (for me) is "not that critical".

Re:Not that critical..

[hendridm]

This only affects the Java plugins in the 1.3 and 1.4 Java release. The current java release 1.5/5.0 is not affected at all.

How many millions of PCs are running that JVM right now? Mom and dad get a PC a year or two ago, which still has the same JRE the manufacturer or their son set up on the thing. There is little chance that they will upgrade it themselves.

Why doesn't the JRE have an auto-update feature enable by default on install, easily disabled from the control panel for those who are savvy (and stays disabled, unlike Acrobat Reader)?

Re:Not that critical..

[sporty]

I'm a java developer too. You'd be surprised about applet use. Lots of games for instance, are written in Java. There are always two options. Applets and flash. Also, whensomeone doesn't know flash, they usually default to java. It may be a small enough group of people to you, but they are still a significant number.

Re:Not that critical..

[DeadMeat (TM)]

Why doesn't the JRE have an auto-update feature enable by default on install, easily disabled from the control panel for those who are savvy (and stays disabled, unlike Acrobat Reader)?

As of one of the 1.4.2_0x releases, it does.

Re:Not that critical..

[Tony Hoyle]

1.4.2_05 certainly doesn't have any auto-update feature, which I believe is the latest stable version.

Re:Not that critical..

[EkkiEkkiShiwaddle]

I am a java developer and have often browsed for months without encountering the need to tell my browser where my java is.

That's mostly because the developers who write applets, stick to the 1.1.8 JRE. This way, your applet runs on most browsers.

So whether or not you update your browser or JRE frequently does not matter - chances are it will be able to run the applet in question.

Re:Not that critical..

[Joe Tie.]

I think many would be glad for that lack of update features. For whatever reason one of the applications I make the most use out of, DVarchive, will only run with Java 1.4.x. Aditionally it's closed source so a person can't just run out and recompile it to the latest version, or try to fix whatever is keeping it from working. If Java did autoupdate, anyone using that program for example would be out of luck unless they both noticed the command line option to overide the jvm check and that an older version of dvarchive will actually work with the latest version of java if that is used, while the current version of the program will not. Both of which would be unlikly for someone not too very into computers.

Re:Not that critical..

[fforw]

Mozilla/Firefox on linux will not run anything if I don't symlink libjavaplugin_oji.so to the plugins directory..

Re:Not that critical..

[M. Baranczak]

applications such as Freenet are not working reliably under 1.5 JREs

Are you actually suggesting that Freenet "works reliably" under any other JREs?

Re:Not that critical..

[Insurgent2]

Yes it does.
Control Panel->Java Plugin->Update tab.
However, I just forced a check with "Update Now" and it says "You already have the latest Java(TM) Platform on this system.". I'm running 1.4.2_05.
Very useful.

Re:Not that critical..

[Angostura]

I take it you haven't spotted the Java-based ads on ummm... Slashdot.

Re:Not that critical..

[kiwi_james]

Thanks for that - I'd been hunting for an update feature for about 5 minutes before I found your post.

Interestingly, my settings were set to do "automatic updates" but no update had run for the last the few months. I clicked the "update now" and it's chugging away downloading the update as we speak.

Hopefully the latest version's "automatic update" is a bit more automatic than my current one!

Re:Not that critical..

[Anonymous Coward]

strange. i started getting requests to update my java hosts sometime last week.

Re:Disable Java

[arivanov]

You are mistaking a Sun plugin exploit with Java exploits in general. This limits this exploit to people who actually have a jdk installed. This limits the population of susceptible systems to people who develop with java or to people who use java based software which uses a recent java spec. Once again a fairly small group (I am talking general population, not slashdot readers).

No root privilege escalation

[Xpilot]

From the Sun website:

"...through JavaScript calling into Java code, including reading and writing files with the privileges of the user running the applet."

A unix-like OS like Linux is somewhat safer than Windows, as one user account compromised doesn't trash the stuff that user doesn't have read/write permissions on (such as root or other users). So it's possible to contain on Linux, but on Windows... people usually run as Administrator.

Re:No root privilege escalation

[mordors9]

Unfortunately I see an astounding number of people log in to irc channels and they are running linux as root. Of course it serves them right if their system gets fscked because of it.

Re:No root privilege escalation

[Anonymous Coward]

A unix-like OS like Linux is somewhat safer than Windows, as one user account compromised doesn't trash the stuff that user doesn't have read/write permissions on (such as root or other users). So it's possible to contain on Linux, but on Windows... people usually run as Administrator.

Flamebait!

Uhhhh, that's a fault of the user not the OS.

Maybe it's news to you, but a compromised user account on Windows (NT+) doesn't "trash the stuff that the user doesn't have read/write permissions on" either. Meaning that while I agree with you that "it's possible to contain on Linux", inferring that it's impossible to do so on Windows is ridiculous. Also, the reverse doesn't wash either - I don't know how many Linux geeks you know, but all the ones I know run as root religiously.

(Ahhhh! Parent marked Score:3 Informative - I'm reading /. again!)

Re:No root privilege escalation

[hackstraw]

A unix-like OS like Linux is somewhat safer than Windows, as one user account compromised doesn't trash the stuff that user doesn't have read/write permissions on (such as root or other users). So it's possible to contain on Linux, but on Windows... people usually run as Administrator.

BFD. Most machines that are used for surfing the web are single user machines and having that users stuff trashed is the same as trashing the whole machine.

Re:No root privilege escalation

[CaptainABAB]

agreed. What is more important to me - personal files that can't be replaced or software (OS, programs) that I can reinstall.

Re:No root privilege escalation

[Baal Sebub]

Nevertheless this will allow a potential attacker to gain root access by taking advantage of a local exploit. So this effectively turns any (or at least some) local security bug that might be sitting on your machine into a remote root exploit.

Re:No root privilege escalation

[Meostro]

A unix-like OS like Linux is somewhat safer than Windows, as one user account compromised doesn't trash the stuff that user doesn't have read/write permissions on (such as root or other users). So it's possible to contain on Linux, but on Windows... people usually run as Administrator.

That is absolute misinformation. How are the two any different?

I run as root and as Administrator because i'm too lazy to set up actual, proper permissions and accounts. That doesn't mean that I couldn't, just that I don't.

Both OSes support limiting access to crucial files. Both can keep you from screwing up other people's files / settings / etc. It's possible to contain on Windows too, if you care to.

Re:No root privilege escalation

[hackstraw]

I run as root and as Administrator because i'm too lazy to set up actual, proper permissions and accounts. That doesn't mean that I couldn't, just that I don't.

This will change when you get a job. I recommend breaking this habit soon.

Re:No root privilege escalation

[StormReaver]

"Most machines that are used for surfing the web are single user machines and having that users stuff trashed is the same as trashing the whole machine."

On Linux, this can be made mostly a non-issue. If a user's sole account is trashed, delete and recreate the account. Restore user data from backups, and pick up where you left off. The years spent accumulating system software, and general maintenance done on the system over the years, are not wasted.

In a complete Linux user account compromise, I can be back in order in a half hour since the system itself was not compromised. On Windows, it would be the beginning of weeks of hard work getting everything reinstalled, reconfigured, and back in order. This is because on Windows, a user compromise -is- a total system compromise.

Of course, if a Linux user doesn't keep his home directory backed up, he's still screwed. But Linux makes the backup and restore easy.

Re:No root privilege escalation

[Tony Hoyle]

I wouldn't employ someone who admitted that on a public forum...

Re:No root privilege escalation

[Meostro]

Sadly, it hasn't changed.

One department just switched from an AIX-based telnet client to a full GUI for one of our processing systems. Until the switch, everyone who processed jobs on the AIX box had a step in the routine to log in as root and run a command to transfer/combine some files locally, and then a root FTP login to get the files to the local system. I was horified that any production environment would allow such a thing!

Luckily I transfered out of that department pretty quickly, but for the 5 years I've been here (and for at least 4 before that), every user on that box had root.

Re:No root privilege escalation

[Kehvarl]

The primary difference is: Most of the linux distros I've tried indicate that running as root for everyday tasks is a bad idea. They generally prompt you to create a non-root account at install time (again, this only applies to distros I've tried, some others might not). Windows, on the other hand, defaults to creating users as Admins, and doesn't indicate this is a bad idea. Yes both operating systems support limiting access, yes both have a root/admin account, and yes some (many?) users do log in as root consistantly. The difference is, as far as I've observed, to run solely as root in linux you have to disregard the warnings not to.

As always, feel free to ignore my rambling incompetence :]

Re:No root privilege escalation

[Caligari]

So it's possible to contain on Linux, but on Windows

Its usually trivial to get root once you have local access to a Linux box. Same goes for most UNIX-likes.

Re:No root privilege escalation

[sumdumass]

speeking of root access. i had an issue with a linux box that didn't do much more then serve as a windows files share, one day i had an employee from the company call with a problem. he ended up getting the root password and left it loged in as root after he was playing with it later. some how the password was changed on all the people and they freaked out. of course it only took a couple minute to set it back but running as root can allow others to scr ew it up and i would be severly woried about that more then some virus/exploit wich most likly isn't going to be automated anyways.

Re:No root privilege escalation

[Anonymous Coward]

Right... If the user has X, a web browser and java installed and is clueless enough to have both java and javascript enabled in browser settings and can be tricked into visiting a website. The attacker now has to find a local exploit to get root, which greatly varies in difficulty depending on the system...

By your logic and windows exploits a process to execute code with privileges of a standard user is effectively a remote system compromise.

For the record I and thousands of other *nix users don't have java (or flash :) installed, so it isn't a remote exploit, not even close...

Re:No root privilege escalation

[Mercano]

Uhhhh, that's a fault of the user not the OS.

It is somewhat the fault of XP Home. Microsoft, trying to get people who know what they are doing to shell out the extra $100 for Pro, left only two account types in XP Home, Administrator and Restricted User. Because the restricted user account is so, well, restricted, most people use admin. If they just left in the Power User type and made it the default, life would be so much easier.

Re:No root privilege escalation

[radtea]

The difference is that running as a non-admin on Windows is a huge pain, as many programs don't play nicely with non-admin accounts. Windows has a huge legacy of "one user per machine" thinking in its applications development history.

That means that many apps will not run well under non-admin accounts on Windows. Try it sometime and see. Talk to any tech-support person and ask what fraction of calls they get due to people trying to run under non-admin accounts (there's been a spate of this lately as folks upgrade to SP 2 and decide to get a bit more serious about security.)

In comparison, I've run Unix of one kind or another since the 80's and have never had to be root to do anything other than install software or do configuration stuff.

--Tom

Re:No root privilege escalation

[Anonymous Coward]

well you are keeping good backups so that is not a worry.

so it is just easier to get you up and running, without having to ask the neighborhood geek for help

Re:No root privilege escalation

[Anonymous Coward]

give me some methods, not general methods, but something specific.

Re:No root privilege escalation

[alnjmshntr]

Yeah when you are logged on as a normal user under Windows, you can't even view the system calendar and clock. This is the main reason why I log on as admin :)

Re:No root privilege escalation

[mikefe]

The power user doesn't protect you much from what an administrator account can do.

Power Users can write to most of the filesystem, including \Program Files. There are limitations, but, Power User doesn't buy you much.

Re:No root privilege escalation

[pe1chl]

While there are still some badly developed programs around in Windows, the above is largely historic.

All software that refuses to run as a user, and did not get updated by now, deserves to die. Developers have had at least 5 years to change their attitude.

Re:No root privilege escalation

[DunbarTheInept]

How many programs in Unix refuse to work if you run them as a normal user, as opposed to in Windows where some games and other third-party apps just don't work at all without admin rights (and no, I'm not talking about just to install them, but to keep running them each time)? There is more incentive in Windows to run as Admin than there is in Unix to run as root. Luckily for people still doing serious work in Windows, I think this is going to change for them soon. Now that Windows has a feature like 'su' that is easily accessable and works for gui apps, people won't have to log in as admin on the main console anymore even to run brain-damaged programs that inist on admin rights where they shouldn't.

If you still run as admin at all times (or as root at all times) then you deserve what you get.

Re:No root privilege escalation

[DunbarTheInept]

It's a bit harder to compromise a machine to the point where it propigates a virus and changes its behavior when all you have access to is one user account. It doesn't make much difference to that user whether it was just his account that got hosed or the whole machine, but it certainly matters to other people on the network that are 'near' that host and don't want to see his "owned" computer spewing pollution all over the network.

Re:No root privilege escalation

[DunbarTheInept]

Of course. But this isn't local access we're talking about here. It's remote access to a user account. Getting root from local access would be trivial - it involves using a boot disk or if the BIOS has that disabled, then a screwdriver to get to the hard drive and remove it.

Re:No root privilege escalation

[Politburo]

That was fixed in XP.

Java finally reaches its full potential

[scatter_gather]

Write once, exploit everywhere!
:)

Re:Disable Java

[erykjj]

You clearly did not 'see the attachment for details'.

Actually, this is my personal experience/observation, not flamebait at all.

Just because your browser can run a certain plugin/extension does not mean it has to - unless you need it. You avoid potential issues by limiting yourself to the bare necessities.

Sun needs to update their site!

[Anonymous Coward]

The latest version for download on java.com is still the 1.4.2_05... Someone needs to apply the cattleprod to the webmonkey :)

And you can quickly see which version you are running on this page which also thinks _05 is latest!

V1.4.2_06 is available for download here

Re:Sun needs to update their site!

[Gr8Apes]

Actually, I'm running 1.4.2_06, and it still lists me as running an older version. Because I am, there's 1.5 (5.0) available now.

Re:Sun needs to update their site!

[simplypeachy]

Well after installing _06, when I click the "Update" button in the config under Windows 2000, it says "Your system is currently offline from the network. Please go online and try again."

Time to give 1.5 a go I think!

WARNING!

[prandal]

java.sun.com is STILL dishing out J2re-1.4.2_05.

Be sure to get the right one from java.sun.com/j2se

Re:WARNING!

[prandal]

Oops, engage brain before posting. www.java.com is the one which is wrong. I raised this issue on bugtraq / full-disclosure yesterday. Obviously Sun's a bit slow.

Java automatic update binary is old and unpached

[Anonymous Coward]

at least for Windows, using Update from Java control panel, I'm receiving

1.4.2 05 which STILL contains the hole!!

Only from

https://jsecom16.sun.com/ECom/EComActionServlet/Le galPage:~:com.sun.sunit.sdlc.content.LegalWebPageI nfo;jsessionid=E905362D3A165CC3656EFD992704CC78;js essionid=E905362D3A165CC3656EFD992704CC78

(stupid link, no?)

it's possible to get

1.4.2 06

Sun bad!

Re:Disable Java

[Anonymous Coward]

I agree that the post is rather terse, BUT it is a basic security measure to only enable what you realy need to use. You know, the old thing about the defender needing to defend all the perimeter while the attacker needs to find only a single weak point.

This is the base for the "Secure by default" in Win XP SP2 (not a very good example, I suppose).

You can argue about the "rare" part of the post, but it is a sound advice.

Mod parent up

[upside]

If you go to java.sun.com and click on Java VM under "popular downloads" you also end up getting the vulnerable _05 version.

Write once, run everywhere

[Lucky Kevin]

A virus writer's dream!

Windows and Linux, huh? ...what about Mac?

[mrchaotica]

Is the Java that comes on Macs exploitable by this too? (Maybe not, since Apple might have changed something, but I don't know)

Also, what about BSD?

java.com is only offering 1.4

[Anonymous Coward]

Where did you get 1.5 for windows?

Re:java.com is only offering 1.4

[fforw]

http://java.sun.com/j2se/1.5.0/download.jsp

Re:java.com is only offering 1.4

[Tony Hoyle]

.. and how is anyone supposed to find that out from the sun website?

1.5 is a devel release until it's officially released on the sun website. I'll wait until the proper www.sun.com download is available - there's probably nothing written that runs under it yet anyway.

Re:Another good reason to allow third party review

[atcdevil]

This is absolutely the least insightful statements that has ever been rated insightful on slashdot. Not that I disagree or anything, but EVERYONE knows this.

The nice thing is

[CastrTroy]

The nice thing is, is that if you are using Linux, Java is most likely running as root, and therefore less likely to mess around with your OS, Or files which that user does not have access to. Therefore, it's probably hard to get something into a startup script, and to create a virus that would be around after you rebooted the computer.

Re:The nice thing is

[hawaiian717]

Looks like you left out the word not:

The nice thing is, is that if you are using Linux, Java is most likely not running as root, and therefore less likely to mess around with your OS, Or files which that user does not have access to. Therefore, it's probably hard to get something into a startup script, and to create a virus that would be around after you rebooted the computer.

:)

Re:The nice thing is

[Anonymous Coward]

Wrong. Do some reading on how Unix permissions work. No one surfs the net with their browser running as root - the Java process UID will be the same UID as your browser.

Re:The nice thing is

[CastrTroy]

yeah... left out the word not. Funny how this can change the meaning of the sentence so much. :)

The thing is, some poster didn't even read the whole comment because he didn't notice that the whole point of it was that it couldn't mess around with your OS, or start up scripts.

Re:The nice thing is

[mangu]

yeah... left out the word not. Funny how this can change the meaning of the sentence so much.

Don't worry, it has happened before.

More detailed info ...

[Anonymous Coward]

From the horses mouth right here. The issue is actually with the plug-in, not Java itself. In brief, you can load a Java class in an applet via JavaScript using getClass().forName() and use that reference to make calls outside the confines of the sandbox.

there have been lots of those before

[jeif1k]

The "sandbox" that cordons off Java applets from the rest of the system has typically worked well.

When Java first came out, people found lots of security problems with its sandbox; there were both fundamental flaws in Java's type system and problems in Sun's implementation. That aspect of Java was subject to intense scrutiny back then because Sun had positioned Java as a new way of delivering client applications, which depended critically on sandboxing. The vision was that Java would replace heavy desktop apps.

These days, it doesn't matter much anymore: Java has failed to achieve its goals on the client; you can browse perfectly fine with applets disabled and never even notice. And for Java's current server side uses, sandboxing isn't really that important. So, people stopped finding flaws in Java's sandbox because they stopped looking--it just doesn't matter to anyone anymore.

I think Java's original vision of a thin client platform for high-quality applications delivered through the Internet is still relevant, but Java won't be able to fulfill it anymore: it has become too bloated and too complex. More likely, that niche will be filled by an updated version of Flash (yuck), XUL, or, perhaps, something entirely new.

Re:there have been lots of those before

[Anonymous Coward]

Thanks for giving us the benefit of your 13-year old level of inexperience.

"it just doesn't matter to anyone anymore"

What kind of person thinks they speak for the entire planet?

"it has become too bloated and too complex"

If you don't want API x, then don't use it. Complexty? Maybe for _you_ troll...

Re:there have been lots of those before

[Anonymous Coward]

Look, the truth is that not only is Java irrelevant on the desktop... but even its exploits are obvious to the user. Once your machine slows to a crawl you know Java is loading... and any exploit would take at least half an hour to do anything beyond finish loading and open a file.

No worries.

Re:there have been lots of those before

[Anonymous Coward]

"it just doesn't matter to anyone anymore"

What kind of person thinks they speak for the entire planet?

I don't (look up "rhetorical devices" or get some help). But to your literal mind, let me spell it out...

Go back to the 1990's and compare Sun's vision of thin clients and web-based application delivery with what has actually happened. You will find that delivery of applications using Java applets has had almost no impact on the desktop, while people are building more and more sophisticated GUIs using DHTML and Flash instead. And among desktops, Windows, IE, and Firefox all ship without recent versions of Java installed, while almost all browsers have Flash and DHTML. In fact, I can't find anybody who bothers even keeping statistics on what percentage of browsers have Java installed anymore.

"it has become too bloated and too complex"

If you don't want API x, then don't use it. Complexty? Maybe for _you_ troll...

It's not about whether I want to use it, it's about whether third party implementations have to implement it, whether it consumes resources, whether it can be used on embedded devices, whether users have to download it, and whether it potentially contains security holes.

Re:there have been lots of those before

[Anonymous Coward]

It's not "the truth". You are completely unable to back up your claims.

Re:there have been lots of those before

[Joe Tie.]

Look, the truth is that not only is Java irrelevant on the desktop...

I would have agreed with you a year ago, but it's really made a comeback for desktop use. SWT, SwingWT, and the performance increases in 5 have changed things around enough that I'm considering it a viable development platform again after having discounted it for quite some time. Two of the programs I use most often are in fact written in Java, azureus and dvarchive. The latter even uses swing, and I'm still amazed by the fact that I don't mind that anymore.

Re:there have been lots of those before

[Anonymous Coward]

The problem is that you're still stuck in the 90's. No one develops applets anymore - they build Java applications distributed by Java Web Start.

wrt third party implementations: "no one" needs n number of implementations of the same APIs. The resources Java consumes on the desktop are irrelevant nowadays "to everyone". It's a one-time download so "no one cares". Security? Obviously you haven't been paying attention to the news over the past 10 years...

Re:there have been lots of those before

[jrumney]

Java has failed to achieve its goals on the client; you can browse perfectly fine with applets disabled and never even notice.

You can browse perfectly fine with images disabled too, and if that is what you are used to I'm sure you wouldn't notice that either. It is only the poorly designed aspects of HTML like javascript and DHTML that can completely ruin the browsing experience if you choose to turn it off.

Re:there have been lots of those before

[Anonymous Coward]

So, people stopped finding flaws in Java's sandbox because they stopped looking--it just doesn't matter to anyone anymore.

Not on desktop perhaps, but how about cellphones? A lot of the phones on the market have support for user-installable Java apps and many of these phones don't support native apps at all because of security problems.

Re:there have been lots of those before

[mpcooke3]

Avalon + .NET

Write once, infect everywhere!

[dangermen]

Write once, infect everywhere!

Re:Write once, infect everywhere!

[Anonymous Coward]

Who says Java isn't truly cross-platform...

java.com still offering BAD version

[prandal]

www.java.com is only offering j2re-1.4.2_05, a vulnerable version.

Version 1.5.0 is available from java.sun.com.

WAKE UP SUN!

Re:java.com still offering BAD version

[Anonymous Coward]

You know what pisses me off about Sun's java website is the stupid java/os detection they have.

"Congratulations you have the latest version of Java"

Forget about the fact that I might want to download an install for ANOTHER computer. Want to download an installer for a different OS? Too bad, we're not giving you the links. This is a serious oversite that is making it a pain in the ass for administrators.

Re:java.com still offering BAD version

[prandal]

Hear hear! And the fact that the "java test" page is well hidden from view. Yet another triumph of web page design gimmicks over usability.

Re:java.com still offering BAD version

[fforw]

java.com is the java marketing site.

java.sun.com is where an administrator should go to.

Re:java.com still offering BAD version

[lokedhs]

That's why you should go to java.sun.com, not www.java.com

Re:java.com still offering BAD version

[prandal]

Home users will go to the former, not the latter!

Re:java.com still offering BAD version

[Anonymous Coward]

Home users don't download installation software on one computer to run on another.

Re:java.com still offering BAD version

[Anonymous Coward]

You know what pisses me off about Slashdot? People can't even spell simple words like "oversight" correctly.

Re:java.com still offering BAD version

[prandal]

Hmm, I do, and I'm a home user! I'm forever fixing friend's PCs, including updating their Java runtimes, and I burn the JRE, Firefox, and a host of other useful stuff onto one CD which I take with me. So many people are still on dial-up :-(

Re:java.com still offering BAD version

[blake182]

www.java.com is only offering j2re-1.4.2_05, a vulnerable version.

You should probably go to http://java.sun.com/j2se/1.4.2/download.html instead which has 1.4.2_06, which I've been using for weeks.

WAKE UP prandal!

Re:java.com still offering BAD version

[isometrick]

I just went there (www.java.com), I saw 1.4.2_06. I even tried it with the Firefox user-agent set to IE6 on Windows and found 1.4.2_06.

Unless they changed it in the past couple of hours, maybe you should wake up :)

No patch

[roman_mir]

There is no patch, there is only the next release of the JRE, why is that? Wouldn't it make more sense to also release an executable patch rather than forcing a 14MB download (not that I care, I download it at 400KB/s?)

Re:No patch

[prandal]

No, it wouldn't. People could be running any mix of old Java runtimes. A full release is the only goof-proof way of ensuring that the fixed version is correctly deployed.

Re:No patch

[roman_mir]

So? As if it is impossible to build a patch that detects what you are running and update what is necessary... these are computers after all, they can do that.

Re:No patch

[prandal]

Yes, but there are still people out there running JVM 1.3.x. I suspect a universal patch would be larger than the 14MB full install.

Re:No patch

[roman_mir]

Doubt that very very much. Besides, the binary identifier only needs to point to the correct patch.
Whatever, it's not my bandwidth.

Re:No patch

[prandal]

Yes, right, and download that way for corporate deployment? Or multiple home machines? I for one would prefer full releases over patches for most products. In the old days, Veritas used to release fully patched builds of Backup Exec on a regular basis. It made a sysadmin's job so much easier not having to chase after a handful of patches every time a new (licensed) copy was deployed. Patches bad, full releases good ;-)

let's have a little perspective

[bratboy]

I'm sorry, but the comments here are getting a little absurd. The Java sandbox has had how many security exploits discovered in the eight or nine years it's been around? Perhaps there have been a couple, but I can't remember any. And now, a flaw is discovered by an independent researcher, a patch quickly released, and the bug made public only after a significant amount of time has passed for people to upgrade, and before an exploit appears - and you're complaining because ...? Oh right, because Java isn't open source.

Open source, although a wonderful thing which should be given away at school bake sales, church meetings, and nascar rallies, is not a silver bullet. Case in point - the Firefox browser (which I use and love) has already had several security flaws (e.g. the same JPG flaw as IE) for which exploits have been released. The major reason we don't see more is *not* because it's so much more robust - it's because it still doesn't have the visibility and marketshare of IE, not to mention the raw hatred of ubergeeks around the world. I know, I know - the marketshare is going up, and as a faithful user I'm honestly torn. I'd love for it to be successful, and for Microsoft to have some kind of competition, but for now, Firefox is pretty safe. Give it the marketshare, and watch all those 2600-loving eyes start reappraising their goals.

daniel

Re:let's have a little perspective

[jeif1k]

The Java sandbox has had how many security exploits discovered in the eight or nine years it's been around? Perhaps there have been a couple, but I can't remember any.

The Java sandbox has had lots of security exploits over the years. I suspect the main reason people stopped discovering them is because Sun pretty much destroyed Java for applet use.

and you're complaining because ...? Oh right, because Java isn't open source.

Indirectly, yes. Sun has lost its focus on a thin client platform and instead gone for the money--server side development. Open source could have forked Java as an applet platform before it got bloated and complex and focused on making it high quality for that purpose.

The major reason we don't see more is *not* because it's so much more robust

Oh, you are so wrong. The major reason Firefox works well is because the community took the bloated commercially-derived software (Mozilla) and pruned it down to its essentials (Firefox). It is about time that the same happened with Java.

Re:let's have a little perspective

[flibuste]

Oh right, because Java isn't open source.

Well...less whiners soon since Java is going to be open-sourced.

Re:let's have a little perspective

[LWATCDR]

"security flaws (e.g. the same JPG flaw as IE) "
Ummm that was a security flaw in GDIplus.dll That was by all standards an OS level bug and one that can be laid right at the feet of microsoft. I have seen the phishing exploit which seems like more of an abuse of tabs. And everything has to set up just so for it to work. Overall I would say that FireFox/Thunderbird are safer not just because of the lack of hacker mindshare but because they do not bury there hooks so deep in the OS as does IE and Outlook. Microsoft wants the browser to be part of the OS while Firefox runs on top of the OS as a program should.

Re:let's have a little perspective

[Anonymous Coward]

*Cough*.. Firefox is not still bloated?

Yawn and inevitably someone will bring up the tired example of Apache (typically admin'd by people who know what they are doing) as proof that it's the software and has absolutely nothing to do with the computer illiterate masses who willingly submit their credit card information to untrusted sources and blindly click yes on any popup window they see.

I do wish Firefox takes over the majority marketshare.. if just to disprove the fanboi rallying cry as to why Open Source is so much better than a Microsoft solution.

Re:let's have a little perspective

[bratboy]

Oh, you are so wrong. The major reason Firefox works well is because the community took the bloated commercially-derived software (Mozilla) and pruned it down to its essentials (Firefox). It is about time that the same happened with Java.

As for Firefox, this basically boils down to a religious argument - you pretty much ignored the research showing that IE handles broken code better. As for Java, I would be happy to see an effort - whether open or not - to get a thin client working. Currently, I put up with Flash because I have to, but it would be nice if there were a Java-based alternative which didn't take ten minutes to download and a half-hour to install.

daniel

Re:let's have a little perspective

[crazyphilman]

There's an interesting situation in your analysis, and here it is: it isn't open source itself that is more secure, but rather the operating system most people running open source are using. Most open-source advocates use Linux or a *BSD, which are more secure than Windows because of their inherently multiuser, networked architecture. So most people who use open source enjoy a more secure operating environment. This leads to the misconception that it is open source that is more secure -- which you are debunking.

My theorem is this: most open source users are more secure because of their operating system, not because they're using an open source application. Using open source on a less secure platform is less secure.

So it's platform, not distribution method, that makes a person secure.

Discuss?

Re:let's have a little perspective

[bratboy]

Actually, I'd go one step further, and say that the do-it-yourself hacker mindset of the open source community (myself included) also makes it more secure. Every day I check CERT, and visit the sites of the products I use to check for updates. I use a hardware firewall to prevent incoming, a software firewall to prevent outgoing, anti-virus software, and spyware-removal software. I know how to perform an update, and more importantly, I know that I should (which sounds like an absurd thing to say, but I guarantee that most average users do not). And I would suspect that the open source community (and the /. community) is disproportionately more like me than like the average user.

So I would say that it's not even the OS, but rather the users who are more secure.

daniel

Re:let's have a little perspective

[prandal]

I don't think the open-sourceness or not of an application is the relevant issue.

Consider three email clients for home users of Windows:

Outlook Express - proprietary, bundled, and happily executes malware without a thought (and aids in social engineering attacks by hiding file extensions), insecure by design

Pegasus Mail - proprietary, free, but not open source. Never excecutes anything unless explicitly told to, secure by design.

Thunderbird - open source, secure by design.

Design's the key, not the platform.

But things aren't helped by idiotic PC games and applications requiring users to have administrative rights in order to play them (The Sims, The Sims 2, for example - it even says so on the box).

Re:let's have a little perspective

[Anonymous Coward]

you pretty much ignored the research showing that IE handles broken code better.

you could also argue that the fact that IE handles broken code, although superficially this sounds nice, has actually done nothing but encourage people to be lazy with their coding, which has resulted in a downward spiral where we have to write browsers that handle bad coding. Instead, wouldn't it have been better if it were STRICT, forcing people to learn how to code proper HTML? Then we wouldn't be stuck with having to deal with ambiguous structures and unclosed end-tags.

Frankly I think it would have been better if from the very beginning, web browsers refused to even display a page without proper end-tags. If that were the case, the whole web would have to be coded properly.

We have to stop being so forgiving when people, especially coders, make mistakes. Lexical precision should be enforced. Do you think it's for nothing that kernel coders are encouraged to use gcc -Wall?

Re:let's have a little perspective

[Anonymous Coward]

Well...less whiners soon since Java is going to be open-sourced.

Don't hold your breath.

Re:let's have a little perspective

[jeif1k]

As for Firefox, this basically boils down to a religious argument - you pretty much ignored the research showing that IE handles broken code better.

I was making an analogy between a bloated, feature-laden commercial product (which is what Netscape started out as) and what open source has been able to transform it into, Firefox. Even if IE were a better browser than Firefox, that would have no relevance to that analogy. (Of course, Firefox's stricter handling of "broken code" is deliberate.)

As for Java, I would be happy to see an effort - whether open or not - to get a thin client working

Well, that's my point: so would I. But Sun evidently isn't doing it themselves, and their control over Java allows them to keep others from doing it ("no subsetting"), so it isn't going to happen.

Re:let's have a little perspective

[bratboy]

Having written an HTML parser (and had to deal with the crazy HTML that even major websites use), I'd agree that it would be nice if only stricter HTML existed. On the other hand, crashing doesn't seem like a good way to handle malformed HTML. ("All browsers but Microsoft Internet Explorer kept crashing on a regular basis due to NULL pointer references, memory corruption, buffer overflows [and] sometimes memory exhaustion, taking several minutes on average to encounter a tag they couldn't parse," wrote Zalewski.) And, although not a contributor to Firefox, I wonder just how deliberate the strictness was (am genuinely curious - links, anyone?)

I remember a /. thread a couple of months ago from a student who was gathering input from the community for possible new features to put into firefox as part of a research project. I remember the comments veering from "neural net laser-guided search functionality would be pretty cool" to "for the love of Stallman, please don't bloat our browser!" I think the thing that's been so significant about Linux is that it's been able to generally avoid this problem through Linus's benevolent-rule-by-reputation. I think that this is also part of what Sun fears about letting go of Java.

daniel

Re:let's have a little perspective

[Blackjax]

Indirectly, yes. Sun has lost its focus on a thin client platform and instead gone for the money--server side development. Open source could have forked Java as an applet platform before it got bloated and complex and focused on making it high quality for that purpose.

Just as a point of information, Java did essentially fork. That is why you have J2ME. I agree that J2SE could be more streamlined itself, but they didn't really try to force the server stuff off on it altogether, they made J2EE. No this forking was not an emergent phenomena as you'd see in pure Open Source, it was preplanned, but I can't say I view that as a negative thing.

Re:let's have a little perspective

[Anonymous Coward]

It is about time that the same [ cut out stuff ] happened with Java.

And how do you maintain write once run anywhere when there's multiple versions of java that don't have the same API? Keeping the language the same across all platforms and across all download sizes is the best thing Sun's done for java.

The reason this can be done with Firefox as it has a pluggable architecture that can include features that aren't in the core product. Unfortunately that can't be done with the core java product.

Re:let's have a little perspective

[Anonymous Coward]

The Java sandbox has had lots of security exploits over the years. I suspect the main reason people stopped discovering them is because Sun pretty much destroyed Java for applet use.


Just wait for the Java programm to become popular on cell phone and the discovery will start again

Re:let's have a little perspective

[mutterc]

The issue is that open-source (and, to a lesser extent, free-as-in-beer software) can have good quality, in both design and implementation.

Proprietary software, on the other hand, (especially for the consumer market) typically cannot have good quality in implementation, and often not in design either, because of market forces.

(i.e. the next version always "has" to be rushed out at breakneck speed, with cheap coders, rushed QA, and lots of bugs, because if you don't, someone else will, and everyone will just buy from that company. Isn't the race to the bottom wonderful for everyone?)

Re:let's have a little perspective

[jeif1k]

Having written an HTML parser [...]

Again, I'm not sure what point you are trying to make. I wasn't arguing the relative merits of IE and FF, or which browser is the best in existence.

I was arguing that taking product X and turning it into open source project Y has a good chance of making it leaner, less bloated, and generally better quality. Do you agree that Firefox is a leaner, less bloated, and higher quality product than the last commercial Netscape release? Well, if so, then we aren't disagreeing on anything.

I remember the comments veering from "neural net laser-guided search functionality would be pretty cool" to "for the love of Stallman, please don't bloat our browser!" I think the thing that's been so significant about Linux is that it's been able to generally avoid this problem

I don't see "the problem". Have any of those been incorporated into FF? No. That's because those discussions are useful and productive. There are hundreds of add-ons, but only the ones that work well enough, have been tested enough in the real world, and are desired by enough users actually make it into the distribution. Sun and the JCP, on the other hand, evidently have little self-control.

I think that this is also part of what Sun fears about letting go of Java.

"Fear" implies that there is some unrealized horrible consequence. But this consequence is already realized: Java is already bloated because Sun is trying to put in every buzz-word compliant checklist item they can. If Sun Java were to become open source, the first thing people would do is remove most of the crud that has accumulated over the years. And you can be certain that such a lean Java distribution would be a lot more popular than the mess Sun is shipping.

What Sun "fears about letting go of Java" is that it's the only piece of software they control that is even vaguely still relevant to the computer industry. But they are killing the goose that's laying the golden eggs by not letting it go free.

Re:let's have a little perspective

[jeif1k]

Just as a point of information, Java did essentially fork. That is why you have J2ME.

But still no usable Java applet platform.

No this forking was not an emergent phenomena as you'd see in pure Open Source, it was preplanned, but I can't say I view that as a negative thing.

I view it as a negative thing because the planning was based on Sun's proprietary interests, not on the needs of Java developers and users. That's why you get forks for J2ME (=mobile devices) and J2EE (=server-side stuff), both of which are niche markets that happen to be of commercial interest to Sun. And J2SE isn't going anywhere, except as a platform for alternative middleware implementations.

Re:let's have a little perspective

[Anonymous Coward]

calling thunderbird secure by design isn't fair or reasonable. there have been attacks against gecko including thunderbird. there have been bugs in gecko, including thunderbird.

perhaps the simplest example is the external protocol handler, which thunderbird at one point happily handed off to the os, which merily allowed an arbitrary application to handle, which resulted eventually in someone complaining about the security model (or lack thereof). this was fixed, but its existence should be enough to indicate that thunderbird was not 'secure by design'.

thunderbird maybe be designed with security in mind, or even designed to be secure, but it is not secure by design.

Java == Java Sandbox

[jeif1k]

Browsers aren't responsible for sandboxing plugins--in fact, they couldn't do it if they wanted to. Sandboxing is exclusively a function of the language and its runtime, in this case Java. If Sun's Java plugin allows the execution of dangerous code by untrusted code, it is Sun's fault. Note also that this is not the first time that this has happened.

Fortunately, the solution is simple: just turn off Java applets in your browser. These days, you won't be missing anything important on the web by doing so.

Re:Java == Java Sandbox

[DickBreath]

Browsers are not responsible for sandboxing plug ins. But maybe a browser that might want to go the extra mile might try to sandbox plug ins. What if Mozilla were to use User Mode Linux to execute plug ins in a sandbox? Within the sandbox, the UML would provide an IP address that is NAT'ed. No access to the user's files, other than perhaps a some specialized folder within the user's home directory that appears within the filesysem of the UML sandbox. The UML sandbox could, like Java, only allow, or at least selectively allow and even trap access to any internet servers other than the server from which the original web page came from. Of course, it would not be nice or fair for Mozilla to try to sandbox plug ins on Linux, because Mozilla on Windows would not have similar protections. Microsoft does not provide a "user mode Windows", it would be unfair to leverage open source to sandbox plug ins within the browser.

Re:Java == Java Sandbox

[javaxman]

Browsers aren't responsible for sandboxing plugins--in fact, they couldn't do it if they wanted to. Sandboxing is exclusively a function of the language and its runtime, in this case Java. If Sun's Java plugin allows the execution of dangerous code by untrusted code, it is Sun's fault.

Which explains why the problem doesn't affect Opera or um, anything on OS X ?

You're sure it's not the plugin implementation more than Java itself?

Your point that in this case it's Sun's implementation that's buggy is well taken... but the problem is not so much Java as it is the plugin, or it'd be a problem on all browser platforms.

Re:Java == Java Sandbox

[Anonymous Coward]

Um, was there ever a point at which you'd be missing something important by not having Java turned on?

Re:Still do not understand...

[DrWho520]

It was nice that a patch was released before the exploit was widely known, but this is the first I have heard of the exploit. From TFA, the exploit was patched last month by Sun, but now we hear details. Now is when I first found out about this.

I am sure this would have clouded over the launch of Solaris 10, but I would have appreciated knowing about this last month when the exploit was patched.

Where's the patch?

[Asprin]

The linked notice sez the bug is patched in 1.4.2_06, but the web site and java auto-update both say the 1.4.2_05 I have now is the latest.

Does anyone out there have _06 yet or is this another case of premature press-releasination?

Re:Where's the patch?

[Slimcea]

1.4.2_06 is the latest. You can get it at here. Alternatively, use 1.5.0.

Auto-update is broken though. Hasn't been working for some time for me at least (always tells me I have the latest version). Sun might want to look into this.

Re:Where's the patch?

[crazyphilman]

I just downloaded 1.4.2_06 from Sun's website. Go to java.sun.com and look for J2SE. You can get both 1.4.2_06 and 1.5 there, on the page. I didn't use the automagic update, myself, so I don't know what's going on there.

Re:Mwahhaaa

[Anonymous Coward]

Don't dis the *nix on the /. or else they'ss kick you in the OO or the (_|_).

Java language != Java Sandbox

[Cyphus]

I agree with you, browsers aren't responsible for the sandboxing, and it is Sun's fault for having a buggy plugin. But sandboxing is not a function of the language - it is solely a function of the runtime. I could use a different runtime with the same compiled Java code and not have the problem. Therefore its not a problem with the language.

So What's a Doofus User To Do?

[dwm]

Okay, I'm a doofus.

To fix this vulnerability, you have to go to

http://java.sun.com/j2se/1.5.0/download.jsp

and download the J2SE 5.0 JRE, right?

(Yeah, yeah, I know, and then install it.)

I wonder why java.com isn't dishing out 1.5

[prandal]

Get j2re from here.

follow the links to the JRE download.

www.java.com is STILL dishing out the wrong version (1.4.2_05). Grrrr. Naughty Sun!

Re:Another good reason to allow third party review

[hackstraw]

Actually, its another good reason that I don't load any plugins.

I only enable them when I'm staring at a blank page and for some morbid curiosity I want to see what is on the site.

Just use JDK1.4.2_06 or JDK1.5

[crazyphilman]

The new JDK/JRE is "safe"... I've heard they're faster, too, with some JRE improvements. I just downloaded the whole 1.5 set, and I'm pretty excited, looking forward to it... I install it on my Slackware instance tonight!

If I had a girlfriend, I'd invite her to hang out and share the joy; this'd be way better than a movie as a date... Um... Maybe I should get out more, now that I think about it...

Is java still used for web pages

[SmallFurryCreature]

My browser is opera on linux so obviously I am vulnarable. So I checked my preferences and I not only haven't got it enabled. It doesn't even have the link to where it can find java.

Not so long ago (for someone my age. For some /. it may be half a life time ago) java web applets were everywhere. Has this now been replaced with flash or have webdesigners decided they didn't need what java can do or am I visiting the wrong pages?

Not I am not talking about web applications here but java applets that things like menus, scrolling news banner etc etc.

I did a quick check of both real life and online friends and only a few had java enabled. Hardly a scientific measurement and neither is asking here but is your webbrowser java enabled?

This is not an anti-java post. I like azureus wich would never be available to a linux user if it had not been done in java.

Re:Is java still used for web pages

[WhiteDragon]

You are right that foir a lot of things like menus, flash has largely replaced java applets. However, there are still lots of sites using java applets. For instance a few that I use are pogo.com (a gaming site that I play spades and backgammon on), yahoo games, hushmail.com (an end-to-end encrypted free webmail that uses applets to do OpenPGP email), and lots of educational sites. On the other hand, many sites like neopets and other games sites are using flash in much the same way.

Re:Is java still used for web pages

[Anonymous Coward]

You're right that Java hasn't taken off on the client as Sun had imagined it would. That's kind of ironic, given the rich history of security exploits involving JavaScript and ActiveX, not to mention plain old click-to-install executable content.

Java was designed to prevent such vulnerabilities. The problem was that, in order to do so, it had to reimplement a lot of system functionality within its own security model, and that made it bloated.

In theory, this sort of bloat eventually won't be a barrier to adoptio, but in the meantime the Internet bubble came along and created a sudden demand for eye candy, for which JavaScript and Flash became the relatively lightweight answers. Java has successfully found other niches, and it may eventually return to the web client in force.

That said, I have to admit that about the only serious Java web application I ever used was a DNS management tool associated with our Nortel router on campus. It was exceedingly slow, functionally limited, and nonintuitive. In fact, it was so bad that I set up our own BIND server and went through all the bureaucratic hassle of convincing the campus to delegate our zone.

Re:Disable Java

[crazyphilman]

Aaah, piffle.

Just fetch a newer JVM, they're faster anyway.

Re:I'll only say this once *ever*

[northcat]

I completely agree with parent. And Microsoft supporters at least admitt mistakes some times.

no ;-)

[prandal]

You go to www.java.com, upgrade from 1.4.2_03 to 1.4.2_05 and think you're safe, until one day, BOOM!

WAKE UP SUN!

God I hate being stuck in Windows

[gregarican]

On my development workstation I am reporting back JRE 1.4.2_02 but my MSIE plug-in reports it's running the Microsoft JVM 1.1.4. My corporate workstations can be upgraded to JRE 1.4.2_06 without a hitch. But then again I would really rather patch the Microsoft JVM since most of the standard workstations don't have (or need) the entire Sun JRE installed on them.

I know that Microsoft won't release a patch for their JVM. That means I will have to deploy the entire Sun JRE on all worsktations and then deploy some MSIE registry hack that will disable Microsoft's JVM in favor of the new Sun JRE instance. Fun, fun, fun.

By default I have disabled all active scripting unless users manually add websites to their Trusted Sites list. I would think then that the Javascript initiation of the exploit wouldn't work unless there was some site-spoofing going on. Perhaps this might be a band-aid just continuing this policy.

No matter what I think the only permanent solution for most Windows security is probably pulling the plug on the Internet connection. I don't think I could get away with that here at work though :-)

Re:God I hate being stuck in Windows

[Anonymous Coward]

Or you could click the cute little box in your advanced IE settings to say "use Sun Java pwease".

Re:God I hate being stuck in Windows

[fzammett]

Isn't it the case that Microsoft LEGALLY cannot update their JVM?

If I'm mistaken, then moving along, nothing to see here. If I'm NOT mistaken though, then we need to be at least a little fair to MS on this one.

Re:God I hate being stuck in Windows

[gregarican]

I'm not talking about a single workstation. I'm talking about a larger-scale deployment. So in essence, it's packaging the latest JRE, installing it, then including a registry tweak to default the MSIE JVM to Sun's. It's not as simple of a scenario as a single checkbox on one workstation.

Re:Disable Java

[Marcus Green]

And of course more importantly disable JavaScript. And after that get into a very long series of discussions with your users as to why so many web sites don't seem to work "properly".

Uninstall old version first

[prandal]

Sun's Installer will happily leave your old copy on, so uninstall first. If you're using the Java 3D addon, you'll need to uninstall that and the old Java first. Then install jre 1.5.0 and Java 3D. Then all works happily.

Re:Uninstall old version first

[Tony Hoyle]

That's one of the things that really annoys me about the JRE.

You have to uninstall it completely to install a new one, otherwise you end up with half the apps using the old one and half the apps using the new one... with the resultant breakage.

Have sun never heard of 'upgrade'?

Re:Uninstall old version first

[dwm]

Thanks for the tip! Turns out I had two old Java versions to uninstall.

You have got to be shitting me.

[Lethyos]

Makes me wonder if Java is really just as bad as ActiveX

Who the hell moderates stuff like this as "insightful". I don't have any exact numbers in front of me (nor will I spend the time to find them), but I can safely tell you that over their respective lifetimes, ActiveX has suffered many orders of magnitude more exploits than Java ever will. The only meaningful caveat I can think of to this statement is the "default" Java runtime environment (that used to be) packaged with Internet Explorer that is written by Microsoft. Of course, you can hardly attribute any problems with that to Java because Microsoft built it on top of ActiveX and took very little interest in security when doing so.

Also, I should point out that any of theoretical exploits will have the most damage on Windows than other platforms because Windows is insecure. It seems that any code running on a Windows box has, one way or another, unbridled access to resources that should be above the user's privileges, but that's an entirely different situation altogether...

Re:You have got to be shitting me.

[ttfkam]

Exactly! And another aspect that people can't seem to wrap their heads around is the lack of confirmation windows in Java client-side. Sure a signed applet that will be accessing the local filesystem or connecting to an arbitrary server on the net will pop up a dialog box as it should, but normally it just starts up and runs.

ActiveX pops up a dialog box at every new instance on every site. The user ends up thinking, "Oh, another damned popup," and just clicks on it. It's like email and dealing with spam. There are so many junk emails, eventually you make a mistake accepting one you shouldn't have or dumping one that you would have wanted.

With the Java applet sandbox, only actions that are potentially dangerous require a confirmation dialog, and 99.9% of all applets do not need signing. Sure, today Sun announced a vulnerability. That makes how many in the last ten years? Seriously, compare that number with the number of exploits in basically any network-aware program in any language. Dumping Java over this is like refusing to go out to restaurants anymore because a friend of a friend got food poisoning.

You want to be absolutely safe, unplug your network or modem cable. There you go. Absolute network safety. Life is a compromise.

Re:You have got to be shitting me.

[Anonymous Coward]

ActiveX has suffered many orders of magnitude more exploits than Java ever will.
- Few problems I see with this statement.

(1) ActiveX is a type of object. If (insert random company) writes a shitty ActiveX it will cause you trouble. Same can be said of multitudes of network applications, protocols and servers.
(2) ActiveX objects are not to be blamed. The lack of security and boatload of bugs in IE are to be blamed. Obscurity (even with XP SP2) reguarding what ActiveX modules are installed is still the fault of MS, not the ActiveX itself.
(3) Drive by install? IE. Zone security bypass? IE. Myriad of buffer overflows? IE. ActiveX has nothing to do with it (unless the plugin itself is vulnerable like a myriad of other networking applications).
(4) 99.99% of the people run IE with root privileges. Again, the fault on IE and the operating system, not ActiveX.

ActiveX architecture is slow, bloated and has access to the OS (read: not sandboxed). That is a proble, however it's not the "stop the presses, news at 11" kind of vulnerability. Myriad of applications are like this. However, the problem lies mainly in two parts:
(1) Operating system where everyone and his mother is root.
(2) No security in IE and myriad of bugs.

Java == Platform

[bheer]

> But sandboxing is not a function of the language - it is solely a function of the runtime.

Pedant alert. In this case, ignorant pedant alert. the runtime is the Sun(R) Java(tm) Runtime Environment(tm), and Sun has lawyers who will do bad things to you if you claim the Java moniker does not apply to the JRE (which includes plugins for several popular browsers). Cue "Java is a platform" blather from Sun execs.

In this case, they are simply being hoisted on their own petard. It is a bug in Java. The Platform (or, if you prefer, the thingamajig they sell/give away). Period.

Re:Java == Platform

[tolan-b]

Yes, it's a vulnerability in the Sun implementation of the Java platform, but not Java the language or the Java platform generally.

There are other Java runtimes, which are allowed to use the name Java because they pass the conformance tests (such as IBM's Java runtime), they would not be vulnerable to this exploit.

Re:Java == Platform

[gekko513]

Yes and the same goes for the Java runtime environment on Mac OSX, which is made by Apple. According to news.com they are still investigating if it's vulnerable as well.

Re:Java == Platform

[Myen]

Do you know if there are other plugins? (I'm most interested in ones for Windows.)

Yes, IBM has a Java runtime - but last time I checked, it didn't have a plugin for browsers available; it just ran Java bytecode (presumably for things like web servers). Since the bug appears to be in Sun's browser plugin, that wouldn't help...

The only other plugins I know of are the Microsoft one (old, discontinued, incompatible), Blackdown (Linux), and the Apple one (Mac).

Re:Java == Platform

[BayBlade]

That's not true actually, but on my system it had to be installed manually.

In the IBM jre/bin directory are a handful of netscape/mozilla plugin DLLs (this is on Windows).
Simply copy anything that matches the signature np*.dll to your mozilla/plugins directory and assuming the JRE is installed correctly, you're locked and loaded to run IBM Applets in Mozilla.

Linux!?! Nooo

[NitsujTPU]

Linux?

No, no, it can't be? Linux is invulnerable to virii!

Auto-update does not seem to work (yet?)

[Guus.der.Kinderen]

Sadly, the "Update Now" button in my J2SE 1.4.2_05 RE Plug-in Control Panel still informs me that I already have the latest version installed. You'll probably have to update manually, for now.

Another thing: the auto-update timer in that same Control Panel is set to go off once a month by default. You might want to turn that up a notch for fixes like these.

Re:Auto-update does not seem to work (yet?)

[Tony Hoyle]

Where do you get this control panel? I presume it's a separate download now.

They used to ship it with the install in JRE 1.3.x but it hasn't been installed in any of my 1.4.x installs (ironically the 1.3.x one was almost entirely useless...)

Re:Auto-update does not seem to work (yet?)

[Guus.der.Kinderen]

I'm not exactly sure: I installed three seperate java-packages on this Windows XP laptop:

j2me_wireless_toolkit1_0_4_01binwin.exe
j2re-1_ 4_2_03-windows-i586-p-iftw.exe
j2sdk-1_4_2_04-nb- 3_6-bin-windows.exe

I doubt you'll find it in the wireless toolkit though.

I'm accessing the control panel through the windows start menu, config screen, java plug-in.

Notice that I did not install the version I'm currently using (I'm running 1.4.2_05, the files are numbered differently) so the update function seems to have worked before.

TRUE

[essreenim]

This is the first Java exploit I have ever heard of, and it was patched long ago..(in virus terms)
Java IS still the best choice in terms of security for me.

Java == Java Platform

[jeif1k]

But sandboxing is not a function of the language - it is solely a function of the runtime.

Java isn't a language, it's a platform: it's the language, the entire set of official APIs, and the runtime. Sun says so (in fact, they insist on it), that's what they require compliance for, and they own the trademark.

(Note that, disturbingly, this bug in Sun's implementation shows that, not only is their implementation buggy, but their extensive certification process didn't catch the bug either.)

Re:Java == Java Platform

[DunbarTheInept]

No. Yes it is true that Java is the name of the whole platform. No it is not true that Sun's platform is the only thing you could possibly be talking about when you say "Java Platform", in exactly the same way that Microsoft's Visual Studio is not the only thing you could possibly be talking about when you say "C++ development IDE"

Re:Disable Java

[hackstraw]

Disable Java in your browser unless you absolutely need it (rare). Period.

Why is this flamebate?

My browser has _no_ plugins running by default. Also, my browser (Safari) has a separate Java and plugin preference checkbox, and I rarely load Java. The last time I did was to look at some buggy applet that someone wrote at work.

Over the years I have come to dispise Java. It would be different if it worked, but for me, Java has caused many problems, and I have seen 0 benefits from it.

So, I won't get modded as flamebate as well, I'll elaborate.

Oracle's "Universal Installer" is written in Java so that it could be crossplatform, etc, etc. to make it easier and universal for people to install Oracle. How convenient that it took me _hours_ to install it on a NT machine because of a bug in Java made the installer fail if the display was using more than some arbitrary number of colors (256, 16k, dunno, don't care). Thanks.

There are many "web installers" or whatever written in Java for Solaris machines. I've had these fail about 40% of the time.

I've had Netscape crash at least on the order of hundreds of times because of Java.

Java in a browser applet is very slow loading.

My brand new Apple Xserve RAID came with a GUI admin program written in Java. It worked for about a week, now it doesn't, and I have to call Apple and bitch when I get the time.

Java applets _never_ looked near the same on different OSes or even on the same OS with different browsers. Besides the silly thing a coworker wrote, I don't rememember the last time I had to load the Java plugin for a website.

I have installed Websphere once, I won't go into details from here.

One of Java's cool "features" is that it does not have pointers. I can't tell you how many times I've run a Java program and gotten a traceback which mentions a "null pointer exception".

I'm familier with Java for years. This is not some blind "this sucks" thing. I've coded in Java to write applications and applets that run native on a normal OS, and in browsers, and on embeded devices like smartcards and iButtons.

I don't particularly care for Python either, but at least most of the python applications that I have used work, so I have no real objections to it besides I just don't like the language or the quirky way python and python programmers do things. For example, the damn #!/usr/bin/env python thing kills me. Try explaining to (l)users over and over again that there are 2 versions of python on the system. One in /usr/bin one in /usr/local/bin. If the (l)user has sufficiently screwed up their PATH statement, or uses a broken shell (like bash which cannot decide which dotfiles to load under which invocation, don't get me started with (t)csh)) then the wrong instance of python gets loaded, and I have to go through my speach again about how #!/usr/bin/env python is wrong. But since it works most of the time, I don't rant about it like Java.

I'm just talking from my experiences here, and I have not had a pleasant experience with Java.

Unix Viruses ?

[anux]

I have always found the idea of viruses on Unix amusing. I mean, any user can cause damage to his/her files, either manually or by running a script or binary. But this is not an "infection" as the system is left completely untouched. What worries me though is the way the news sites report "Linux viruses". Someone unfamiliar with Linux/Unix might think: "Oh! So Unix also has viruses, just like Windows." This I think is giving a completely wrong impression about Unix to such people.

Re:Unix Viruses ?

[gone.fishing]

Some very early viruses were cross--platform, infecting DOS, Windows, and *nix machines. They "infected" before the boot process was completed and made no use whatsoever of the O/S. They were simply dependant on the PC standard and the Intel processor (so Apple machines were immune).

Again, early on in the "macro virus" game, some of the macro viruses were written to be cross-platform. At this point, Apple became suseptible but most *nix machines were unaffected (because they weren't running Word).

Don't feel exactly smug because you are running Linux. There are vunerabilities everywhere.

Re:Unix Viruses ?

[Anonymous Coward]

If Joe windows wouldn't login using his admin right, the windows system would stay uneffected too!

Re:Unix Viruses ?

[kistral]

Not so fast. First of all, how bad off would you be if you lost everything in your homedir? For me, it'd be tantamount to a windows virus infection: I'd lose everything that was important. Everything irreplaceable. Aside from that, the first rule of linux/unix computer security is that, once the malicious user has a foothold into the system (say, a non-root shell) it's essentially equivalent to having root. In this case, all a blackhat needs to do is use this exploit to open up a shell on some port and report back, and then they can poke around and exploit at their will. That, or a virus could have a common local root exploit payload. Either way, you just can't blindly trust the root/normal user distinction.

Re:Disable Java

[Marcus Green]

"One of Java's cool "features" is that it does not have pointers.

No, Java does not allow a programmer to directly manipulate pointers.

Browsers lack security functionality

[freelunch]

Browsers should allow you to configure java and javascript on a per site basis. Much like you can allow pop-ups from certain sites.

I prefer to have javascript off all the time.

Being able to selectively enable them for certain sites would be nice and would improve security.

Re:Browsers lack security functionality

[Senzei]

That is, for the most part, possible with internet explorer. You can configure java/javascript for a security zone, then assign a site to that zone.

I know that there are loads of other problems with IE, but in this very narrow application of the software this is somewhere that I feel it beats firefox. This is for out of the box installs on both obviously, as there may be a plugin that I am not aware of which gives firefox similar functionality.

Re:Browsers lack security functionality

[SCHecklerX]

You can use adblock in firefox do block embedded objects on a per-site basis.

Re:Browsers lack security functionality

[Anonymous Coward]

Yeah, I love adblock.

But it is no substitute for browser designers getting a clue about security in their core product.

Adblock only blocks based on URL, not content type. And it lacks the ability to do a proper deny-all/except policy.

See GCJ/GIJ

[Anonymous Coward]

They are much more advanced than Kaffe.

http://gcc.gnu.org/java

--Coder

Doesn't matter to the average user

[UnConeD]

For the average user, the most important stuff is their own documents, images and programs. These would be in danger as well on a Linux box.

FUD

[prandal]

It IS on java.sun.com, so it is released. JRE 1.5.0 runs fine here. Firefox users will find fewer Java-related crashes with that release too.

Re:FUD

[Tony Hoyle]

But it is *not* on www.sun.com which is the main site that everyone uses to download java It's on an essentially hidden development site.

Apart from a few slashdot fanboys who has even heard of java 1.5?

Re:FUD

[blinky]

http://www.sun.com

Home > Products & Services

Select "Java 2 SDK, Standard Edition"

which takes you to http://java.sun.com/j2se/

hardly hidden?

Re:FUD

[cduffy]

But it is *not* on www.sun.com which is the main site that everyone uses to download java It's on an essentially hidden development site.

"Everyone"?!

java.sun.com is pretty damn near ubiquitously known to anyone who knows/cares about Java. it's not a "hidden development site", but rather the primary source for Java-related documentation and downloads from Sun.

Don't assume that "everyone" is as clueless as you are.

Re:FUD

[Zwaxy]

I went to patch my Dad's Windows XP box last night.

Imagine my surprise when I found that he was already running Java 1.5!

Neither of us has any idea how it got there - he barely even knows what Java is.

Incidentally, on one of my laptops I found that I was running a vulnerable version of the Java Virtual Machine. It's running XP Home. I went to the Internet settings in the control panel, unchecked the "run Sun java' checkbox, rebooted, and found that IE was *still* vulnerable. Can anyone explain that?

Java *IS* OPEN SOURCE

[ymenager]

Actually Java *is* open source.

Maybe not the "Open Source" that most OS fanatics have come to preach, which has to be "Free Beer, fork and redistribute at will"

But the sources are freely available from Sun. There do are restrictions, which in short are that you can't run a modified JVM in a production environment. But for any kind of research purpose ( finding bugs, security flaws, experimenting new techniques ), the Sun JVM is no different than the Linux Kernel !!!

Re:Java *IS* OPEN SOURCE

[Anonymous Coward]

So I can find bugs, but I'm not actually allowed to do anything about them? Yes, I can see why someone would have to be a fanatic to have a problem with a situation as steller as that!

Re:Java *IS* OPEN SOURCE

[Zoolander]

Actually, now you can download the source to Java 6 and soon you will be able to submit patches. It's opening up bit by bit:
Patches

Re:Java *IS* OPEN SOURCE

[mlk]

I'm sure you can run a customized version of Java in a production env. You just can't distribute, or claim that it is Java.

Re:Java *IS* OPEN SOURCE

[DunbarTheInept]

When did they jump from version 1.5 to 6? (Yeah, I know - version 1.5 is also version 5. This is one aspect of Sun I really, really hate. They did the same thing with their operating system - alternately calling it one version number when calling it "Solaris" but calling it a different number when calling it "SunOS". Confusion for no good reason.

Re:Disable Java

[Tony Hoyle]

Wow, that's worse than I've seen.

The worst problem I've had was writing a commercial app that had a Java frontend. Because Sun kept making seemingly random changes to the API and not fixing bugs (or worse, breaking the bugs that they fixed on the last version) we were stuck with 1.3.1-05 almost right until the java code was abandoned (went to c# - we only supported Windows servers anyway).

One customer wanted a 1.4.0 release, which we duly did (required a special fork and about a month of developer time) - then rejected it because it wouldn't work through MS Proxy server (a java bug which has never been fixed to this day .. if first appeared in 1.3.1-02, was fixed in 1.3.1-05, broke again in 1.3.1-06 and never fixed since).

Regarding Java

[sneezinglion]

You sir are reacting like an idiot. You list applications that do not work and then blame the language. Blame the application writers, not the language. This is like saying "C++ sucks, look how buggy and insecure windows is, C++must be to blame, not the developers." Thanks then post.

Re:Regarding Java

[mangu]

Blame the application writers, not the language.

Perhaps this is because the Java evangelists keep pointing out that Java is just wonderful because it doesn't let the programmers manipulate pointers, has a sandbox,etc. You can't have it both ways. Either a language allows the programmer to do whatever he wants, or it guides the programmer by the hand.

If a language is restrictive, supposedly to help the programmers to avoid mistakes, then it's only natural that the errors made by the programmers will be blamed on the language. After all, if people write so many bad applications in Java, then why should we have to give up on the very big advantages in C/C++, such as being able to manipulate pointers?

Re:Regarding Java

[Anonymous Coward]

It may not prove that Java sucks, but it shows that the oft touted features in Java are in reality not that useful. It shows that many Java applications are buggy and poorly maintained. Why is that? A company like Oracle should be able to write something as simple as an installer with Java, surely? The OPs experience with the OUI is in no way unique. I remember attempting to install Oracle 8.1.7.4 client on a Pentium IV machine only to find that it didn't run. I thought Java was supposed to be platform neutral? Java is one of lifes ultimate dissapointments.

Re:Regarding Java

[hackstraw]

You sir are reacting like an idiot.

Thanks!

You list applications that do not work and then blame the language. Blame the application writers, not the language.

I don't have an issue with the language. Its the buggy runtime environment (jre) that I have an issue with. The language has many good features. From what I understand, its one of the best languages to program in. But since the jre is so finicky and broken, its not worth it to use the language, no matter how good it is.

Another issue that I have with Java is the CLASSPATH stuff. Its simply too difficult on a multiuser system to maintain a clean environment for all users. Again, this is from years of experience and pain.

Yet another 3 bugs I just remembered with the jre is a web installer toy that would not run by typing /path/to/application, but would run by cd'ing to /path/to and then do ./application. This was due to a CLASSPATH problem. This was for a mature commercial product. Another interesting bug with Java was I have had issues with Matlab randomly not dislpaying to a remote X server. I've had this too crash yet another web installer that could not correctly display to a remote X server.

Again, I have no beef with the Java language, its the Java implementation that simply has never worked that has pissed me off too many times since Java 1st came out. Its been, what, almost 10 years now, and I still cringe every time an application that I have to use is written in Java. I'm firm with this, and again is just from years of painful experiences.

Re:Regarding Java

[Anonymous Coward]

You realize that some asshat put a relative path into your CLASSPATH, right? Either it was you, or the script which invoked the application. Several solutions:

Fix your CLASSPATH to not have relative paths

Fix the script that invoked the app to not have relative paths

Fix the script that invoked the app to first cd into "/path/to"

(most kludgy, but perhaps simplest) create a bash script that says "cd /path/to; ./application"

Blame it on Java and the JRE (extra bonus whining points for this choice)

You obviously chose the best course! You am smart!

Re:Regarding Java

[Anonymous Coward]

if people write so many bad applications in Java, then why should we have to give up on the very big advantages in C/C++, such as being able to manipulate pointers?

Mozilla crashes on me from time to time, losing ALL data in ALL open windows because of pointers. And when you come down to it, the only thing they buy you is supporting small memory size and are a little bit easier in certain rare cases. But you give up any notion of sane failure modes, ease of programming, garbage collection, security, and other benefits (GC in C/C++ is the suck).

Give me a break. Pretty much anybody that thinks pointers are an advantage for applications is uninformed or stupid. QED.

Re:Regarding Java

[ttfkam]

But since the jre is so finicky and broken, its not worth it to use the language, no matter how good it is.

I have two problems with this. One is that I've been coding in Java for years and yet I find no more bugs than I come across in common C or Perl libraries. As for finicky VMs, I wonder if you'v ever actually pushed the Perl and Python VMs over the years. Those have not been without their fair share of bugs.

Problems with CLASSPATH? Right. Like people don't have many of the same problems with PATH and LD_LIBRARY_PATH. Your problems are inherent in splitting programs into modular pieces, not with Java specifically.

As for a multiuser system and Java, I've been doing it for years. Wasn't all that bad. You have a wrapper script in /usr/bin right? Handles all my classpath and pathing issues in one fell swoop with users just typing "java" at the command line.

Re:Regarding Java

[hackstraw]

One is that I've been coding in Java for years and yet I find no more bugs than I come across in common C or Perl libraries.

I'm guessing that you coded in Java for appservers or something similar? This is where Java has landed. It was not intentional, but also not by accident. Initially, Java was supposed to be the end all be all write once run anywhere GUI language. People experienced the same problems that I did with the Oracle installer and with Java applets looking like ass on different platforms and/or browsers. Java quickly became known as "write once and run nowhere" or "write once and crash everywhere".

My point, is that I realize that some people do use Java effectively, and it has come to be in the appserver or whatever you want to call it between a web server and a database. Also, this is kinda of a niche environment that is under fairly tight control. This is simply not my experience with Java as an end user application. (Aside from the Websphere junk).

Problems with CLASSPATH? Right. Like people don't have many of the same problems with PATH and LD_LIBRARY_PATH.

Its pretty common knowledge that using LD_LIBRARY_PATH is a hack and has obvious security issues, and should not be used unless it is absolutely necessary. LD_LIBRARY_PATH can be fixed with /etc/ld.so.conf or using the -R linking flag for those linkers that support that, or some other sane fix.

The same arguments can be made for CLASSPATH.

Your problems are inherent in splitting programs into modular pieces, not with Java specifically.

I'm sorry, but no. My problems are with Java. Just about every program is split up into modular pieces. Perl works. C works. C++ mostly works. Python mostly works. sh works. awk works. Java, although it very well may be near 80 to 90% working, its that 10 to 20% of the time that has wasted my time, my coworkers time, and my users time.

Again, I have no inherent beef against Java. Its just that my experiences have been so negative for so many years, that I have been conditioned to dislike the whole thing.

Re:Regarding Java

[Anonymous Coward]

Fix the script that invoked the app to not have relative paths

Let's pick one famous example: IBM WebSphere.

Have you actually tried running WebSphere from the command line? The scripts aren't documented very well, they rely on environment variables set by other scripts, and they put together a CLASSPATH a mile long before invoking a specific installation of the JVM. Oh, and they tend to be patterned after the matching .BAT files (the Windows scripts came first you see) so they sometimes don't even return the exit value from the JVM.

Yeah, let's all just fix those anytime we want to.

Want to call IBM support afterwards? Shall I tell you what I'd say as IBM support (I used to be the developer you see)?

"First, try it with the default script and see if the problem goes away. It's gone? OK keep using that version of the script then."

Re:Regarding Java

[Anonymous Coward]

Give me a break. Pretty much anybody that thinks pointers are an advantage for applications is uninformed or stupid. QED.

Or they are writing code on a system with 32MB of memory that has to run continuously for about five years.

Anybody that thinks "applications" refers to "desktop" is pretty simple-minded. Quod erat
demonstrandum.

Re:Regarding Java

[ttfkam]

You would guess wrong. I have coded for appservers, applets (where I started with Java), and standalone applications. AWT since the 1.02/1.1 transition and Swing since the 0.5 beta.

Yes, there are differences in rendering on different platforms -- mainly the sizes and shapes of native widget peers. I have also had FAR more problems getting GTK+ to work on X and Windows. It's like nitpicking that HTML isn't crossplatform because h1 tags use a different default font and sizing depending on the browser/platform. HTML addressed it (mostly) with CSS. Java addressed it (mostly) with the metal UI. They are issues, but far and away less of a problem than alternatives. Are you honestly going to try to tell me that Java is inferior to millions of #ifdef statements? Please.

Oracle installers aside -- and that argument holds little water with me since Oracle had crap JDBC drivers for years too (evidence of bad programming, not a bad programming environment) -- I have had very few inherent Java problems. The web plugin has been extremely stable in my experience. Server apps have been as stable or more so than many of their C or C++ counterparts. I can't remember the last time I heard of a Java app allowing a remote exploit by way of buffer overflow.

As for the statements "Perl works" et al., you haven't left the traditional UNIX world lately have you? Go to Windows and you'll find out how many vaunted CPAN modules were written for UNIX only. Go to OS X and tell me how easy it is to install the Python Imaging Library, a very common dependency for many apps. Done much debugging of C++ where templates (including the STL) are used extensively? Nothing "just works". Chances are the things that "just work" do so because the environment was set up for you already in the distribution. Yes, this is largely because the JDK/JRE aren't allowed to be redistributed with the operating system in most cases. Yes, this is the biggest reason why Java should get a more liberal license. But there is nothing inherent to the VM setup or libraries that makes it inferior to the others.

java -jar myapp.jar

Works for me. If a standalone app can't be started reliably like this, blame the program author, not Java. The Java plugins come with the JRE. Make a symbolic link to the browser's plugin directory. Done. All users on my multiuser server have the plugin installed. Run the JRE installer on Windows. Done. All users on the XP box have the plugin installed. I don't why it's been so hard for you when it's been so much easier for me.

Re:Regarding Java

[Anonymous Coward]

Gee, you picked one option out of 4 that didn't fit this situation, then whined about it. You're an asshat. Pick option 4. I'll help:

cat >IAmAWhinyAsshat <<END
#!/usr/bin/bash
cd /where/the/stupid/thing/is/installed
exec ./run_stupid_app
END
chmod ugo=rx IAmAWhinyAsshat

Replace /where/the/stupid/thing/is/installed with your app, replace "run_stupid_app" with the actual app, just don't replace "IAmAWhinyAsshat", since it's true.

Re:Regarding Java

[hackstraw]

You would guess wrong. I have coded for appservers, applets (where I started with Java), and standalone applications. AWT since the 1.02/1.1 transition and Swing since the 0.5 beta.

OK. But it was a good guess. And I am glad to have this discussion with someone that is knowedgeable about the subject.

I have also had FAR more problems getting GTK+ to work on X and Windows.

Hmm. Mentioned the W word. That is another thing I don't touch because of too many bad experiences. No other comment.

It's like nitpicking that HTML isn't crossplatform because h1 tags use a different default font and sizing depending on the browser/platform.

Not really. HTML's H1 tag looks good enough. Its big, bold, and there is some padding under it. Thats good enough. No bugs added. Maybe the Swing stuff has gotten better, and it should be better than AWT ever was, but the whole point of Java initially was to be a crossplatform GUI language, that was not HTML's goal.

As for the statements "Perl works" et al., you haven't left the traditional UNIX world lately have you?

Nope :)
Go to Windows and you'll find out how many vaunted CPAN modules were written for UNIX only.

Ditched Windows years ago.

Go to OS X and tell me how easy it is to install the Python Imaging Library, a very common dependency for many apps.

I said it mostly works.

Done much debugging of C++ where templates (including the STL) are used extensively?

Shutter. Again, I said C++ mostly works. Templates, good idea in theory, but good luck in doing any kind of portable project that requires templates. For that matter, C++ is very difficult if porability is desired. No 2 compilers can agree on what the laguage is. C++ is fine in a specific environment. I believe that C++ and MFC is OK for Windows apps, but that is a pretty specific case, and another discussion.

Yes, this is largely because the JDK/JRE aren't allowed to be redistributed with the operating system in most cases. Yes, this is the biggest reason why Java should get a more liberal license. But there is nothing inherent to the VM setup or libraries that makes it inferior to the others.

See, Java was pushed down my throat. Not too many years ago you could not apply for a job without at least 15 years of Java programming experience. (Yes, an exaggeration, but people now want things like 5 years of C# experience, you know what I mean.) Sun has pumped this puppy hard. I don't know why. I'm unsure if they make any money off of it, but then again they have trouble across the board in recent years.

Re:Regarding Java

[ttfkam]

Hmm. Mentioned the W word. That is another thing I don't touch because of too many bad experiences. No other comment.

So why worry about cross-platform GUI inconsistencies? If you're only using one platform, it doesn't matter one way or the other. I question both the socially redeeming quality and the business sense to coding to the exclusion of >90% of the desktop population, but suit yourself. (I guess this is why I've shifted so heavily toward web applications. Windows development without having to even look in the general direction of MFC or OWL libraries.)

For the record, I think a purely C or C++ desktop app on any OS is an absolutely horrible design decision from a security standpoint.

Regarding Sun's monetary woes, I don't know if they make enough money off of Java to cover their related costs. I imagine it does. It's their hardware and Solaris divisions that have performing so poorly lately. I know IBM does cover their Java-related investments easily. Being such a pragmatic company, I know that they didn't, they would have dropped it like a hot potato years ago.

They ain't using it for love of Sun, I can tell you that.

Re:Regarding Java

[hackstraw]

So why worry about cross-platform GUI inconsistencies? So why worry about cross-platform GUI inconsistencies?

I've said this somewhere in this thread before, but I currently use 3 different OSes and 5 different hardware platforms.

X is OK on my Mac. Looks like ass sometimes. It has window management issues, but its at least usable. And yeah, being that over 90% of the world uses different OSes and possibly different hardware than I do, it would be nice to play with the other 90% I touch on this with my previous reply to another of your posts.

For the record, I think a purely C or C++ desktop app on any OS is an absolutely horrible design decision from a security standpoint.

I can respect that. Unfortunately, there isn't much else that is even remotely portable while maintaing execution speed.

Regarding Sun's monetary woes, I don't know if they make enough money off of Java to cover their related costs. I imagine it does.

OK. Out of curiosity, do you know where these funds come from? I mean they just dumped what, $1 bil to Kodak because of dumb patent stuff over Java. I've never paid directly for any java stuff.

It's their hardware and Solaris divisions that have performing so poorly lately.

Hmm, what else do they do? Sun is OK. I'll think they will hang in there. Gheesh, where I work, we cannot stop using Sun equipment because they give us like 80% discounts. We literally got an overengineered RAID array that was cheaper than I could buy the indivual disks from pricewatch. Solaris is good. Slow, but never really slows down under load. Its always the same. Sun is doing better about GNUising their default installs, which is a good thing.

Enough, I'm sick and tired. I've go a fever and about to fall asleep.

fixed. was "Not critical" anyway

[porneL]

It is not worse. News mentions "Highly Critical" bug, while the one that affects Opera is "Not Critical": http://secunia.com/advisories/13257/ It is fixed already, in beta version though. http://snapshot.opera.com

Re:Linux!?! Nooo

[Finuvir]

It's also invulnerable to wormii and trojanii. You know why? Because there's no such thing. On the other hand, viruses for Linux are quite possible.

MOD PARENT UP

[Anonymous Coward]

This is correct, I'd also like to be able to prefetch and audit javascripts one at a time. The files should be signed with a site specific key and and browsers should inform the user when there's an updated script availiable. This means disabling inline script except for event handlers but it's the only way I'm prepeared to enable javascript for web pages.

90% of browser exploits involve javascript, wake up and smell the coffee people!

"Patch released quickly"

[hkb]

4 months is quick? Boy, I'm sure glad there's such a large anti-full disclosure mentality going around lately. Now, vendors don't have to secure their vulnerabilities in a timely manner!

1. Get notified about a serious security flaw
2. ....
3. Release a patch a quarter of a year later
4. Profit!

Re:"Patch released quickly"

[Q2Serpent]

4 months is a third of a year. On earth, anyway.

Re:"Patch released quickly"

[Greyfox]

That's probably the fastest the Sun process can move. Doubtless the programming team had it done in under a week and the rest of the time was spent tring to find a manager who would be willing to put his ass on the line by committing to release the change.

I never trusted Java on the browser and never install the plugin. On the other hand, there ARE a lot of PostScript network printers out there running a language interpreter, too. I always thought it'd be fun to write a PostScript worm that would propigate from printer to printer and, while running on the printer, would quietly replace every instance of the word "Strategic" with the word "Satanic."

Re:"Patch released quickly"

[hkb]

Whoops!

Re:"Patch released quickly"

[chrome]

Thats genius. I would like to subscribe to your newsletter.

Re:Mwahhaaa

[JaxWeb]

Since Java is not free software, many GNU/Linux users will not use it.

Aha

[mpcooke3]

I'm glad someone can get java running cross-platform even if it does only run on the Sun JVM.

Sun finally figured out what Microsoft knew

[bigpat]

to get people to upgrade, you just have to find "critical" security bugs in your old software. Of course Microsoft has known this for many years.

Don't Disable Java

[ttfkam]

My browser has _no_ plugins running by default. Also, my browser (Safari) has a separate Java and plugin preference checkbox, and I rarely load Java. The last time I did was to look at some buggy applet that someone wrote at work.

Over the years I have come to dispise Java. It would be different if it worked, but for me, Java has caused many problems, and I have seen 0 benefits from it.

So you have plugins including Java applets turned off but then say you haven't seen any useful applets. So let me get this straight: you hide them and then complain that you can't see any good ones. Self-fulfilling prophecy? By that metric, do you drop all usage of OS X if you come across a badly written program on the Mac? Starting the plugin the first time is slow, granted. But I've been running Safari on a 500MHz iBook and Java applets haven't been a problem for me. The best written ones have been the ones where I almost didn't notice they were applets. Well-written ones are like this. A lot of folks who denigrate Java out of hand have come across good applets but not recognized them as Java.

I've had Netscape crash at least on the order of hundreds of times because of Java.

Have you used Java since the old Netscape days? The plugins in IE, Mozilla, Firefox and Safari have not caused me any problems in years. I find it hard to believe that I've just been the only person in the world and/or am extremely lucky.

Well... except for that one applet that was a site logo rippling like it was underwater. Pure eye candy that sucked up 60% CPU time sustained on a 3GHz processor. Once again, good technology, bad applet writer.

That said, I prefer DHTML and related technologies to visual Java applets these days. In a better world, I would have the UI handled by the browser's renderer and the logic handled by Java. Javascript is nice and all, but sometimes you want to do some heavier lifting. And I sure as hell am not going to use ActiveX for that even if it was supported on non-IE and non-Windows environments.

And I too am talking from experience as I have developed on Java on Windows since Win95, OS/2 Warp, Novell NetWare, Solaris, OS X and Linux. Applets, servlets, EJBs and standalone apps. Aside from filesystem path differences, I have had maybe two problems in the last seven years moving my code from one platform to the next. And yes, I can code in C (K&R and ANSI) and C++ (including ISO98) too. Learned them before Java, so it's not because I haven't seen any other platforms.

By the way, your mention of NullPointerException is funny to me. Take a C app and access a null pointer. Boom! Hope you have core files enabled so you load the image in a handy debugger. Take a Java app and access a null reference (pointer). Not only can the exception be caught so that it doesn't completely take down the app, but you get an easy to read (relative to C and C++) stacktrace telling you exactly where it occurred so that you can fix it.

It's not the only language in the world and definitely isn't the only language you should have in your toolbelt, but it doesn't deserve the maligning you just gave it.

Re:Don't Disable Java

[hackstraw]

So you have plugins including Java applets turned off but then say you haven't seen any useful applets. So let me get this straight: you hide them and then complain that you can't see any good ones.

If I come to a website and see a mostly blank page my 1st guess is that is a flash site. I turn on the plugin and reload the page to see if there is any content there. Again, I can't remember the last time I had to go enable the Java plugin to view a website. From what I remember, 99% of all Java junk on websites are goofy eyecandy that make's my laptop hot. On that note, that is why I don't enable plugins (basically flash) because they are pretty much exclusively used for advertisements, and they are very annoying and I cannot stop them from animating like I can with a GIF image. The same goes for flash that goes for java. Its simply unnecessary for most all of its uses. There are some pretty cool flash animations, but I would personally be happier if I could just download them and view them in a flash viewer. I do not need nor want this crap inlined with standard text and images on a website. Its annoying to be listening to music or watching TV and have some silly flash thing overpower that or annoy a friend or coworker. Again, if I'm interested I would prefer to download the toy and play with it at will. I do not want or need it to load automatically. Sorry for the flash rant, but my opinions are similar for Java, and Java and the "plugin craze" that was going on in the late 90s just got me so turned off to them that I have dismissed them. My prediction is that the next version of spyware will be browser plugin based. That way you can get some kind of consent by installing the plugin, and get away with doing things that the user probably does not want you to do. HTML, CSS, JavaScript can't and don't do these thins. Again, sorry for the rant.

Have you used Java since the old Netscape days?

Not really. Only when absolutely necessary for something like the Oracle installer or Solaris web installers.

Well... except for that one applet that was a site logo rippling like it was underwater. Pure eye candy that sucked up 60% CPU time sustained on a 3GHz processor. Once again, good technology, bad applet writer.

Small comment. But this is the junk I just don't want. I know that ripple applet (or lake or something), and its horrible and simply unnecessary. The problem here is not with the technology, it with people. Invariably, some people have this "give me an inch and I'll take a mile" thing going on. I'm sure you have seen a browser popup ad before, right? Fortunately javascript has become useful again and stabalized since decent browsers took away the ability to do dumb stuff like popup windows, resize windows, raise/lower windows, and change the text on the status at the bottom of the browser window.

And I sure as hell am not going to use ActiveX for that even if it was supported on non-IE and non-Windows environments.

Hmm, do you have some kind of beef with ActiveX like I do with Java?

By the way, your mention of NullPointerException is funny to me. Take a C app and access a null pointer. Boom! Hope you have core files enabled so you load the image in a handy debugger. Take a Java app and access a null reference (pointer). Not only can the exception be caught so that it doesn't completely take down the app, but you get an easy to read (relative to C and C++) stacktrace telling you exactly where it occurred so that you can fix it.

Not my job. I've already paid for said software its supposed to work. We are talking about two different things here. I'm talking as an end user and your talking as a developer. Yeah, I know that accessing a NULL pointer in C will dump core. I guess I can agree that I maybe misdirecting some of my past frustrations on Java vs. poor Java developers. But oftentimes there is a Java part of a bigger software package like the installer, and the package works once

Java == Java Sandbox... ohpps!

[Ghoser777]

You were comparing references (memory addresses) instead of actual values. I think you should have used:

Java.equals(JavaSandbox)

instead. It's a common mistake, don't sweat it.

Re:Java == Java Sandbox... ohpps!

[Anonymous Coward]

isNot! (pat. pending)

What about Blackdown or IBM Java

[SpaFF]

Does anyone know if this only affects SUN-branded java? IIRC, the version of java (and plugin) that ship with RedHat Enterprise is IBM-branded.

Just curious...

I'll stay smug, thanks.

[brlewis]

Can you point to some source to corroborate your story that early viruses infected Unix machines? Early viruses predate Unix on x86, and I don't think most Unix installations used boot floppies.

Yes there are vulnerabilities everywhere, but the difference between *nix vulns and Windows vulns are enough to justify smugness.

Re:I'll stay smug, thanks.

[gone.fishing]

Here is one: http://antivirus.about.com/cs/tutorials/a/bsvirus. htm
and another:
http://www.microsoft.com/resources/docum entation/W indows/XP/all/reskit/en-us/Default.asp?url=/resour ces/documentation/Windows/XP/all/reskit/en-us/prkd _tro_vail.asp

And yes, many of the early *nix's did come on floppy. The first couple of Linux installations I did were from floppy. But with a BOOT SECTOR virus, you can be infected simply by leaving an infected floppy in the disk drive (it does not even need to be a bootable floppy).

Re:Another good reason to allow third party review

[Frankie70]

I think this tries to highlight another reason why allowing a third party review your code is a good thing



How?
Haven't exploits been found in third party reviewed
code?

Singular of virus is virus

[brlewis]

You point to two articles that describe the same virus. Yes the proof of concept happened in 2001. No such viruses have been found spreading in the wild. Windows apologists who claim that most people run as root on Linux are obviously wrong.

Mac

[JavaLord]

I tested my PC, which the sample code worked on, but it didn't seem to work on my mac which runs OSX 10.3.6 in safari or firefox. Safari comes back with a "Class undefined" and firefox just seems to ignore the javascript alert at the end.

Anyone else try this on the mac and have similar results?

Prompting to create a non-root account works

[brlewis]

Prompting to create a non-root account works. If lots of people were running as root, there would have been a Linux virus spreading in the wild by now.

"All bugs are shallow" doesn't apply to security

[brlewis]

Certainly some people get overly smug about free software being more secure. More users means more people finding normal bugs. Security holes, however, aren't usually found by casual users trying to use the software as intended. Security is achieved not by exposing the source to many eyeballs, but to the right eyeballs.

Re:Another good reason to allow third party review

[Anonymous Coward]

The source for Java is downloadable, feel free to review it...

When was the last time you reviewed any OSS projects code?

Re:Disable Java

[LarsWestergren]

I don't rememember the last time I had to load the Java plugin for a website.

I actually have several websites with banking etc that use applets. The JVM load time is annoying though, I agree with that.

One of Java's cool "features" is that it does not have pointers. I can't tell you how many times I've run a Java program and gotten a traceback which mentions a "null pointer exception".

Yes, that is an unfortunate wording in the JVM. It should say "null reference exception". Everything except primitives are pointers in Java, but unlike C/C++, Java does not allow pointer arithmetic, so they call them references instead.

If you see "null pointer exceptions" often, you must be unfortunate enough to have to be running some pretty amateurish programs though (no offence). Null pointers are not hard to avoid in normal code, and in situations where they might fail from an external source (for instance loaded from file), the programmer should of course wrap that in checks to see that the instance is properly initialized before proceding.

I have not had a pleasant experience with Java.

So I see.... sorry to hear that. My experiences have been much better. Eclipse and Azureus kicks ass. I couldn't do without Java on my mobile phones these days.

I'll stay humble thanks

[Anonymous Coward]

People tend to like you more, you know, like nice looking women, who might actually be Windows users and find your smugness - umm - offputting.

Re:I'll stay humble thanks

[brlewis]

Smug and humble are not opposites. The opposite of smugness is self-effacement. The opposite of humility is conceit. If you want to keep yourself humble, there are better ways to do it than exposing yourself to needless security holes.

Re:Another good reason to allow third party review

[Anonymous Coward]

think this tries to highlight another reason why allowing a third party review your code is a good thing

How many bugs like this have been found in the plug in? How many have been found in Apache and Sendmail?

Re:Linux!?! Nooo - I stand corrected

[NitsujTPU]

Yes, you're right: Virus Definition

Well, my usage improved today.

openoffice.org and jre

[poetd]

When I installed openoffice.org I pointed it to my 1.4.2 install of jre. Will updating to 1.5.0 affect openoffice.org? Has anyone had any problems? I've spent too long customising openoffice.org to want to reinstall it.

Re:openoffice.org and jre

[pe1chl]

There is a program "setjava" with in the OpenOffice directory that lets you re-select the java environment it uses.

Re:openoffice.org and jre

[poetd]

Thank you. :)

Re:openoffice.org and jre

[pe1chl]

Actually it is called "jvmsetup", but you probably found that. "setjava" was the name of the wrapper script I used to automatically set another java version on our remotely administered workstations...

Re:vigourously

[Anonymous Coward]

Just use your Googlebar. Enter the word [vigourously].

Still not sure? Enter the keywords [vigourously dictionary].

This is better than a spell checker. It will even pick up the site/cite/sight, the priciple/principal or the capital/capitol problems, etc.!

Browsers sandboxing Plug Ins

[DickBreath]

Could browsers such as Mozilla when running on Linux, sandbox plug ins? Could User Mode Linux be used for this? Within the sandbox, the plug in would run, could make kernel calls, etc., but would be limited by what the "kernel" (i.e. the User Mode Linux) would let it do. The plug in would see a network interface, but could only communicate with the server that had the original web page. (Or the end user could have policy control over this.) The plug in could truly be restricted to what files it could create and/or modify. Maybe inside the UML kernel you could see some folder within its filesystem tree that maps to an actual folder within the user's home directory? Maybe each individual plug in could be given its own sub folder within a folder such as $HOME/mozilla/plug-ins/Flash/Temp $HOME/mozilla/plug-ins/Flash/Permanent That way, a plug in can create and store preferences and permanent config settings, as well as temp files that the browser is free to delete. The plug in could be restricted in its ability to draw to the display, or open windows, or in almost any possible way. Maybe an easier design would be a new plug in API that is designed to run inside of a UML type sandbox? Just some psuedorandom thoughts. ("plug ins" and "Glade" are a trademark of Johnson Wax.)

All I have to say is...

[Lethyos]

"Bingo."

Found in April not June

[BovineOne]

"found by Finnish security researcher Jouko Pynnonen in June, was patched last month by Sun, but its details were not made public until Tuesday."

But according to the Bugtraq posting Sun Microsystems was informed on April 29, 2004.

That's a GOOD thing?

[WebCowboy]

Sun produced a patch before the issue was released to the public.

You say that like it was a good thing. I don't think it is. I'd rather have had Sun issue a security bulletin outlining the problem and how to avoid it as soon as they knew about the problem. Concealing a product defect until after it is fixed and it is most convenient for the compnay (and has the least impact on share price) is not trustworthy behaviour. Microsoft does that too often too and I hate it.

Just because a defect hasn't been offically disclosed does not mean people with malicious intent do not know about it. I want to know about a problem as soon as it is discovered so I can work around it until it is fixed. The longer vendors of closed software (or leaders of open source projects) drag their feet in informing the public, the more opportunity there is for the defect to be exploited by intelligent but malicious individuals with advance knowledge.

My employer sells mission critical equipment where failure can result in extensive property damage, injury or death. If a defect is discovered it MUST be reported IMMEDIATELY. We cannot wait for a firmware update because someone could stumble upon the defect and be killed. Any time there is a potential problem reported it includes a recommended workaround. If there is no acceptable workaround the product is recalled (this is rare--it has not happened while I have worked here).

Why is it that this practice is considered "due diligence" and the responsible thing to do in other industries, but in the IT/software world it is considered reckless by some to inform the public of all issues in a timely fashion?

Applets are dead

[rve]

The parent is right, client-side Java is dead.

Web developers make sure not to have the functionality of their website depend on applets, as Windows only comes with a mutant of java 1.2 - if any - installed, and of the clients on the interweb, the overwhealming majority will be windows PCs with Internet Explorer. You just can't count on visitors being willing to download a 14 megabyte installer to use your site.

Also the performance of client side Java is still very poor compared to the alternatives, and in the early years, when Java was still heralded as the future of computing, it was so unreliable, that it's image has been tainted forever.

Re:Applets are dead

[Evil Pete]

The parent is right, client-side Java is dead.

Client side java is not dead. Applets may be, but client side gui applications are still being written. Ask the Eclipse people if they think it is dead.

Re:Applets are dead

[rve]

You have to give them away though, companies generally don't want to pay for client side java applications...

No matter how excellent JEdit is, most of the time it takes longer to start up than the task you will be using it for takes you.

Eclipse takes about a minute and a half to start up on my machine at work, and makes the thing noisy (almost constant high CPU load causes the fans to speed up).

One of the main reasons for Java's failure to take the desktop in my opinion was the fact that until not so long ago, java applications would just crash or hang all the time. This problem has not been an issue for years now, but you can never repair a bad first impression. Much like the way Microsoft will never ever ever repair the impression they made with MS-DOS, Windows95/98/ME etc.

Another reason is that native rapid application development tools for Windows have become really good, making it simply more efficient to write a native app for each client you wish to support. The platform independance of Java turns out to be a disadvantage when there is only one type of client anyway: windows on intel.

Server side Java thrives, because there is not one architecture dominating the server market, so Java's platform independance is actually an advantage there.

Re:Applets are dead

[Evil Pete]

The last two java projects I worked on were client side Java. Swing etc.

You have to give them away though

Like Poseidon or MagicDraw ? There are commercial products in client side Java. I don't care whether it survives or not, but it aint dead.

I was hit last night by this exploit

[yoDon]

Only on slashdot would a comment that this exploit is "Not that critical" receive a "Score:4, Insightful" rating.

Last night, while sitting at my machine, I noticed a Java icon appear in my taskbar. "That's wierd," I thought, "I'm not doing anything or hitting any pages that should need the JRE." Since I don't use the JRE much anymore (I installed it while testing a java-based web server) I went to "Add/Remove Programs" and uninstalled j2re-1.4.2_05.

Too late. This morning I browsed to Slashdot and saw the parent article telling me why the Java icon had popped up.

Whatever payload the thing delivered appears to have punched a hole in Norton AntiVirus (the Norton Firewall console is reporting that Norton AntiVirus requires "Urgent Attention" but the annunciator on the AntiVirus tab appears to have been disabled in an effort to hide whatever was done to the AntiVirus). It may also have installed the bat/mumu-a worm (one spyware scanner is reporting an infection by the worm, but Symmantec's bat/mumu-a removal tool reports the machine is clean).

Once a drive has been compromised by something more complicated than a simple virus, there's no way you can ever trust the machine again because there is no way to know what sort of rootkit the exploit delivered.

I've already disconnected the machine from my network and picked up a new hard drive. The old hard drives will go into an external drive housing that I'll only connect to the machine (a) after I have antivirus software reinstalled and (b) only if I absolutely have to pull data from the drive.

"Not that critical" hah! This is by far the most serious attack I've ever been hit with, and I downloaded j2re-1.4.2_05 at most two months ago (elsewhere in the comments someone is reporting that j2re-1.4.2_05 is still available for download from sun.com, I can't confirm that but this is hardly an antiquated version).

There goes my day...

-Don

Re:I was hit last night by this exploit

[bLanark]

Are you sure you've been hit by _this_ exploit? Because the parent article does not mention any exploit being seen "in the field", as they say.

CERT says "As of the writing of this document, we have not received any reports indicating exploitation of this vulnerability outside of the context of obtaining it from the Brown Orifice web site."

If you think you have, then which website were you browsing? I.e. which one contained the rogue applet that can exploit the bug.

Don't worry if it's pr0n - we're all adults here :-)

Re:Another good reason to allow third party review

[Anonymous Coward]

I think this tries to highlight another reason why allowing a third party review your code is a good thing

I think this just shows that simply allowing a third party review does exactly nothing. The source to jse has been available for a long time now from Sun (http://wwws.sun.com/software/communitysource/j2se /java2/download.html)

Perfect

[Anonymous Coward]

Lol, who cares about Windows advanced file permissions, what good are they when half of the programs you want to use won't run under a limited user??? I have had nothing but problems using limited accounts or guest accounts in Windows XP. So, even if Windows has advanced file permissions, many people still have to use admin accounts...at least many home users. Now, as for Linux (excluding Linspire, if they were smart they would fix this for version 5.0 of their OS)by default you log in as a limited user.

On Windows, you have dominant Office software to attack. You have a dominant email client. You have a dominant Web Browser. You basically have millions upon millions of people with almost identical software configurations. As for Linux, although Mozilla Firefox is the dominant web browser, many people use Konqueror, Lynx, Links, Dillo, the Mozilla Suite, etc... Firefox doesn't enjoy the monopoly on the Linux desktop that IE enjoys on Windows, therefore virus writers would have to target specific vulnerabilities in each and every web browser to cause the damage. Same with office software and pretty much everything else. Linux attacks will rise, but will never reach the level of Windows attacks out there. Although that is just my observations and opinions.

Running multiple versions is normal

[KenSeymour]

It is just like the glib library under linux.

I notice that debian, for example, has glib 1.2 and glib 2.0.1.
If you have apps that depend on glib 1.2, you cannot remove it from your system and only have glib 2.

The same is true of the JRE. You may run some Java apps that were written against 1.3 and other Java apps that were written against 1.4.

Even if apps that run using older APIs are open source, someone still has to do the work of updating the software to use the new version of the APIs.

Re:Disable Java

[quantum bit]

If you see "null pointer exceptions" often, you must be unfortunate enough to have to be running some pretty amateurish programs though (no offence).

Um, yes, like the Oracle Financials client. Very amatuerish.</sarcasm>

Re:Disable Java

[quantum bit]

Actually, I take back the sarcasm. It just plain sucks.

Re:Another good reason to allow third party review

[farble1670]

I think this tries to highlight another reason why allowing a third party review your code is a good thing

open source does not prevent security bugs. why don't you go google for mozilla or firefox security problems. they existed. they were quickly patched, as was the issue you're ragging on sun about. for a platform that is as widely used as java, there have been amazingly few security issues. huh? i guess that proves that open source is not the way to go right?

slashdot reminds me of right-wing radio more and more. it's a place where people come to have their beliefs re-affirmed and not for real discourse and facts.

• linux=good
• sun=bad
• apple=okay
• ipod=good
• riaa=bad
• etc.

now, this thread, like many others, is just a bait to get /. users to complain in their tired and tedious and precitable manner about sun micro. there was a security bug, it was quickly fixed. where's the story?

the last thread i read about sun had some guy stating that sun was crap because they didn't include enough tools, and he cited the lack of gzip. solaris has bundled gzip for many, many years. you know what also? when i installed linux back in 1994 on my 80386, 66Mhz PC, linux didn't inlude gzip either. huh! linux sucks!

Doesn't affect the mac?

[djcatnip]

Huh. How about them apples.

Re:Doesn't affect the mac?

[dtfinch]

They said they were going to investigate it. If it's the same code base, it's probably vulnerable. Macs just aren't popular enough to deserve equal attention.
-ducks-

Re:Disable Java

[Kombat]

My browser has _no_ plugins running by default.

Ever notice how when people say stuff like that, it almost always means, "More people should be like me."?

I can't tell you how many times I've run a Java program and gotten a traceback which mentions a "null pointer exception".

Those tracebacks are a Godsend compared to C/C++'s completely unhelpful "Segmentation fault." It makes it much easier to find the bug. But why are you blaming the language for a poorly-written programs? Should I mention how many times I've seen an "Illegal Instruction" exception on Windows, and tell you how much C++ much therefore suck?

Re:Another good reason to allow third party review

[Anonymous Coward]

Major, major, karma whoring.

Re:Another good reason to allow third party review

[Anonymous Coward]

That's nonsense... there is ZERO evidence to suggest that open source software is any more secure at all let alone more secure because "there are more eyes looking at the code".

Incorrect

[Anonymous Coward]

Sandboxing is exclusively a function of the language and its runtime, in this case Java.

No. That's incorrect. It's neither function of the browser (by definition, plug-in is an extension that's not part of browser core), NOR function of the language or its runtime. It's because of Sun's Java plug-ing. So don't go thrashing the language or VM, even if they come from the same company as the plug-in in question.

There's nothing wrong with Java the language or its runtime that fundamentally causes problems like this.

Re:Disable Java

[hackstraw]

Ever notice how when people say stuff like that, it almost always means, "More people should be like me."?

In this case it does mean that.

Its foolish for a web developer to depend on a 3rd party plugin to view their site. If you want some platform specific application, then just write a platform specific application. For me, I currently use 3 OSes -- Solaris, Linux, and OS X on 5 different architectures. Its annoying to have to abandon looking at a website because there is no plugin for my specific architecture and OS. The web is supposed to be portable. KISS. Text and images can do a whole lot. Hell, text by itself can do a whole lot.

Re:Disable Java

[hackstraw]

I couldn't do without Java on my mobile phones these days.

What??? I've had a mobile phone for years. Never once considered having a JVM on the thing.

Just out of sick and morbid curiosity, what does Java give you on your phone that you cannot live without?

Re:Linux!?! Nooo - I stand corrected

[Finuvir]

Wow! That's the first time I've got a response like that to a language-nazi post. Kinda makes me feel bad for being so snarky about it. Well you've just ensured I keep up the pedantic fight. Well done!

MOD PARENT UP

[Anonymous Coward]

M1s, please look at this post, I think you'll find it informative. Mac zealot or not, it's information that a lot of people are looking for.

Re:Linux!?! Nooo - I stand corrected

[NitsujTPU]

Go for it bud. Some people mind. In some places, I might mind. However, I'm one of those guys who tries to improve his vocabulary by listening to CDs. I have Verbal Advantage: Complete Edition, Word Smart, Word Smart II, Word Smart: Genious Edition and Grammar Smart.

On business trips and on my daily commute I listen. I used to be pretty religious about it, but I need to fix my car's CD player, so, less so now (playing with an older model FM broadcaster every morning gets old, especially in my area, where ALL of the channels on mine are taken).

Okay, let's give an example

[ttfkam]

I'll try showing things from my point of view. I have been co-hosting a weekly science and technology radio talk show for the last four years. Right now we put the show archives on the web so people can listen at their leisure. But MP3s aren't so hot for dialog. To get voices to sound good, you have to up the bitrate which in turn ups the bandwidth usage.

So I researched around and found Ogg Speex. Even at low bitrates, speech sounds great. So at a smaller file size than MP3, I can get better quality for my listeners. Everybody wins, right?

Well, the codec has a problem. There isn't a uniformly good decoder for Windows, OS 9, OS X and various Unixes where I can just point someone to a URL and have them hear anything interesting -- unlike MP3. So what about a Java applet? There's a Speex decoder for the JavaMedia API. (An Ogg Theora as well, but I digress.) With even an older JVM on the system, codecs can be downloaded as needed. And after the user has left my website, no trace remains. Nothing to install and nothing to uninstall.

But...

There are quite a few people out there who refuse Java "on principle". My website is for a radio program. Audio is an intrinsic part of the overall equation. So what are the alternatives?

It's not that I think Java is perfect. It's that for many tasks, it's the best tool for the job.

As far as ActiveX goes, my hatred of it is a different animal than your hatred of Java. I cannot and will never trust ActiveX precisely because it's native code. You cannot build a code sandbox around a technology that allows direct pointer manipulation. Period. The use of ActiveX in all but the most rare intranets is absolutely unforgivable in my opinion from a network security perspective. Then of course we get into the fact that ActiveX only works on one browser on one operating system on one type of hardware -- quite the anathema to the original spirit of the internet. None of these items is true of Java. The worst indictment of Java is that it has been slow and people have used it for ad banners.

You hate Java for how it's been used. I hate ActiveX for what it is, its underlying design. There's a fundamental difference there.

Regarding NullPointerExceptions -- any unchecked exception for that matter -- and the end-user/developer divide, I couldn't disagree more. Developers get their bug reports from end-users. Stacktraces, being text, fall into log files easily. These log files get emailed to developers in "incident reports". Core files don't fall into log files quite so easily. Printable stacktraces with line number references was one of the best things to happen to the client-debug-patch loop in the software arena. Released binaries with debug symbols stripped out (as is common in shipped software) can be an absolute nightmare when trying to replicate in-house.

If it helps the developer fix bugs, it by definition helps the end-user and is therefore just as relevant to the end-user.

As far as ad banners go, the same technology used against Flash and Gif/Jpg ads could be applied to Java applets as well. The Ad Blocker extension to Firefox comes to mind. By default, all plugin or suspected ad banner activity is blocked from view unless you specifically enable it on a per-site basis. As far as if a complete site is based upon Flash or Java (a horrible design decision 99.9% of the time in my opinion), the simple answer is to avoid the site in the future.

I guess what I'm getting at is that there are technological solutions to these problems, but just turning it all off is akin to throwing the baby out with the bathwater.

Re:Okay, let's give an example

[hackstraw]

There are quite a few people out there who refuse Java "on principle". My website is for a radio program. Audio is an intrinsic part of the overall equation. So what are the alternatives?

Ah, so this is why we have been going at it all afternoon :)

Hey, trust me, I have no intrinsic dislike for Java. I wasn't born that way. Just like I have been saying, it simply hasn't worked in my experience. Be it correlation or not. I'm only human or just like any other living organism, I try to avoid pain and go towards pleasure. Java has been painful for me. I believe Sun has hyped that they even rebrand someone elses Linux distro and throw Java at it.

Also, if I were to go to your site, and wanted to listen to your Speex files, I would turn on the Java plugin. And honestly, if it worked, I would probably tell anyone interested about something written in Java that actually worked.

It's not that I think Java is perfect. It's that for many tasks, it's the best tool for the job.

If it works, I have no beef with it. The high number of failures beit from the developer or from the JVM or somewhere else from so many different developers and companies, to include Sun, has simply left me with the feeling that Java is not the right tool for the job. If it doesn't work, what am I to think? Yeah! On clicking the "Next" button on this installer it crashes! W00t! Oh, I just have to reboot in a color pallete with fewer colors because there is a bug in the JVM. OK. Obviously Java wasn't the right tool for the job.

As far as ActiveX goes, my hatred of it is a different animal than your hatred of Java. I cannot and will never trust ActiveX precisely because it's native code. You cannot build a code sandbox around a technology that allows direct pointer manipulation. Period. The use of ActiveX in all but the most rare intranets is absolutely unforgivable in my opinion from a network security perspective.

You obviously know more about this than me. I'm not too Windows literate, but I have not heard anything positive about ActiveX. But I don't care. I will not come across it in any of the immediate foreseeable future.

Regarding NullPointerExceptions -- any unchecked exception for that matter -- and the end-user/developer divide, I couldn't disagree more. Developers get their bug reports from end-users. Stacktraces, being text, fall into log files easily. These log files get emailed to developers in "incident reports". Core files don't fall into log files quite so easily. Printable stacktraces with line number references was one of the best things to happen to the client-debug-patch loop in the software arena. Released binaries with debug symbols stripped out (as is common in shipped software) can be an absolute nightmare when trying to replicate in-house.

Excellent point. I havn't programmed in Java in years, but if there is a catchall exception handler and I were programming in the language, I would do something like this pseudo code:

catchException *

dumpStackTrace(Logfile);

print "There was a fatal error. If you feel this is a bug in this program please mail
me@here.com with the contents of ", Logfile, "\n";
.
exit(1);

I don't know if there is a default exception handler in Java. But something as simple as that would be much, much better than leaving a stacktrace on my screen. That would save face for both Java and the application itself.

You hate Java for how it's been used. I hate ActiveX for what it is, its underlying design. There's a fundamental difference there.

I disagree. I've established I cannot comment on ActiveX, but Java is supposed to be cross platform, yadda yadda. You know as well as I do. To me, if it were the right tool for the job, I would not have these opinions. In fact, I would probably develop in Java. I'm very interested in crossplatform portable stuff. The concept really inte

Sun should learn about requirements in rpm

[kelk1]

Bad Sun. Bad. Fedora is not the only rpm based distrib.

$ java
/usr/java/jdk1.3.1_13/bin/i386/native_threads/java : error while loading shared libraries: libstdc++-libc6.1-1.so.2: cannot open shared object file: No such file or directory

$ ls /usr/lib/libstdc++*
/usr/lib/libstdc++.so.5@
/usr/lib/libstdc++.so.6@
/usr/lib/libstdc++.so.5.0.6*
/usr/lib/libstdc++.so.6.0.1*

Shite.

What's wrong with "virii"?

[tetromino]

wormii and trojanii [...] there's no such thing

Look, Mr. Spelling Fascist, we computer geeks invent new vocabulary all the time. Bogosity/bogons/quantum bogodynamics (check the Jargon file). Blog (web log). Mob (mobile). Vaxen (plural of DEC VAX, by association with oxen, because they are reliable but slow). Boxen (plural of box, by association with vaxen). Thunk (crazy piece of assembly for transferring code between different ABI's). Foo/bar/baz/wombat (uncertain origin). So if words that aren't in the OED scare you, you better stop reading slashdot right now.

Now, as for "virii". Ancient Romans never used the word "virus" in the plural. Furthermore, didn't write down the rules for how such a plural should be constructed. So it's not like "virii" is replacing a good old Latin plural - there was no plural before, we were forced to construct one.

Re:What's wrong with "virii"?

[Finuvir]

You list wordplays with enough logic behind them to make them fun for the interested linguist. I like the idea of polygoose being the plural of mongoose for example. These words are the creations of educated people making absurd but fun extensions of language.

Virii is nothing like that. It's born of ignorance, clearly by analogy to words like radii. Follow the logic that all words ending in -us should be pluralised with -i, as radi-us -> radi-i, abac-us -> abac-i. This isn't true of course--only certain Latin-derived words actually follow the rule-- but it's good enough if we say we're just toying with the language. Now consider virus. Replace the -us with -i. Viri (Veye-reye). Not Virii (Vye-ree-eye). That's why I hate that version of the word. Not because I expect the language to remain unchanging and joyless, but because it's fucking stupid. It doesn't even follow the (incorrect) rule that it tries to obey.

A good guide to using multiple users on Windows?

[hadaso]

Anyone knows a good online guide to understanding how the user accounts system works on windows, that both gives practical info, but also allows one to understand what's going on? I don't refer to "click this, click that, click 7 times OK" guides, and I'm quite tired of lying to Windows wizards in different ways to try to get them to do what I want. I'm not an active programmer ot techie (I teach math now) but I did Fortran programming many years ago, so I know what computers are, and I do play a bit with things like Javascript and HTML, and I can read RFCs, but I'm looking for guides that don't treat me as either I'm computer-illiterate or have 3 years to learn everything there is to know at highest professional level. Yes, I could spend lots of time learning, but I would rather spend some of it learning something other than Windows (like linux), but I still need to use windows to handle all the things for the kids+|wife+work (word/powerpoint homework, work related word documents, employer's IE5.5+ compatible website etc.) so I want resources that would teach me how windows work without insulting my inteligence or using up too much of my time...

I setup all of my PCs with "limited" user accounts for regular use, and I usually use "run as..." option for running programs that cannot work without admin privileges, but this has its own problems. One thing is that then the program runs with the default settings of the admin account (desktop, "my documents", favorites etc.) Another really more severe problem is that I DON'T WANT TO HAVE THE KIDS "RUN AS ADMIN"!!!
And there are programs they use that don't always work properly when they don't get write permissions to write their ini files that they insist on putting somewhere under "program files". For instance, Celestia doesn't save bookmarks unless "run as admin". PClogo that my son got from his logo school and looks as if made for Windows 3.x had problems accessing files under his username (limited account. plus I'm really surprised that no one has put a kids friendly interface on the open-source MSWlogo. Don'r hackers have kids? or at least nephews?)
Lots of programs that are intalled using "run as admin" install themselves only under admin (I once tried to install palm desktop that I downloaded. The installer only ran under admin. It installed an icon on all accounts desktops that was never really shown (no read permission on the icon, so it always showed as the default windows file icon, and of course did nothing as it was a shortcut to a program the user couldn't start) I could only use that program when logging into admin or "running as admin", and the palm synchronization only worked when logging into admin right after reboot - otherwise it always complained that "the port is already in use").

All of these are really frustrating and even more as I am never able to understand what the problems are, or what the "helpful wizards" really do...

The time to respond

[bLanark]

Is no-one else concerned about the length of time it has taken Sun to respond to this. According to the article, it took 4 months to patch, but in reality, it was nearer 6 months. Sun were informed on April 29, so we can add a month (possibly more) to the figure of 4 months. (I can't determine when the patched version was released while @work).

Most OSS is patched within a day or so, certainly less than a week. So why did Sun sit on this for so long, and then fail to publicise the fix as soon as it was available?

Re:At least...*Mod Up!*

[Archangel_Azazel]

I sit corrected. Thanks for the info!