Mac OS X Users Vulnerable To Major Java Flaw

FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple. "Security researchers say that Mac OS X users are vulnerable to a critical, 6-month-old, remote vulnerability in Java, a component that is enabled by default in Web browsers on this platform. Julien Tinnes notes that this vulnerability differs from typical Java security flaws in that it is 'a pure Java vulnerability' and doesn't involve any native code. It affected not only Sun's Java but other implementations such as OpenJDK, on multiple platforms, including Linux and Windows. 'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,' Julien wrote. This bug was demonstrated during the Pwn2own security challenge this year at CanSecWest, but the details were not made public at that time. Tinnes recommends that Mac OS X users disable Java in their browsers until Apple releases a security update."

Comments

Java and not javascript

[GreatDrok]

I've disabled Java in Safari and doubt I'll see any difference since so few sites use Java applets these days. This is of course unrelated to Javascript which is much more disruptive when disabled.

Re:Java and not javascript

[Serious Callers Only]

I've had Java disabled for years, and have only ever had to enable it for broadband speed test applets. Aside from that, and some upload plugins (though that's mostly flash or AJAX nowadays) client-side java just isn't used much on the web anymore.

I doubt you'll notice the difference.

Re:Java and not javascript

[DrXym]

Sites don't directly use Java but there are plenty of JNLP style apps. Also, JavaFX *may* spark some kind of mini-resurgence which means more sites use Java for video playback or random other things.

I say may because Flex / Flash is pretty embedded and Microsoft is moneyhatting its way into the scene. Sun doesn't have money so its almost a charity case at this time, relying on good will from mobile phone companies and Java devs.

Anyway, Apple's "support" of Java is pretty pathetic. They're usually a year or more behind the curve and its not acceptable.

Re:Java and not javascript

[BikeHelmet]

Anyway, Apple's "support" of Java is pretty pathetic. They're usually a year or more behind the curve and its not acceptable.

You're absolutely right about that. Apple decided that they'd be better than Sun at creating a JVM for their OS, so they did it themselves.

The result? PPC Macs are stuck on Java 1.5; Intel Macs have outdated, slow, and exploit vulnerable Java 1.6...

I'm more inclined to let the company that specializes in that stuff deal with it - but then again, maybe it gave them much needed experience for their Rosetta technology.

Re:Java and not javascript

[RevRagnarok]

I've had Java disabled for years, and have only ever had to enable it for broadband speed test applets.

Then you are very lucky, and likely don't work for a ginormous company whose only way to not make things in ActiveX is to make them in Java. My timesheet program = Java. My Expense Report software = "Extensity" which seems to only like one version of the JVM. Lucky you!

Re:Java and not javascript

[kthreadd]

I'm more inclined to let the company that specializes in that stuff deal with it - but then again, maybe it gave them much needed experience for their Rosetta technology

According to the Sun engineers I've talked to it all has to do with a really old license agreement between Apple and Sun that they can't change for now. Sun is forbidden to directly release Java for Mac OS X until the agreement expire or Apple decides to make a new agreement. The only practical solution they proposed was to use the BSD port of OpenJDK. You won't have the Aqua UI and I think you have to deal with X11, but you will have an overall better Java.

Re:Java and not javascript

[ThePhilips]

Very similar here.

At home, I had removed all traces of Java like eons ago. Never had a problem. Only OO.o occasionally complains that there is no Java installed, but no crucial functionality is affected.

In office, one of the corporate portals uses ActiveX and Java. Though Java applet is used apparently only during authentication, it still requires Java. (IOW, puny 20K applet wastes countless megabytes/gigabytes of disk space on hundred desktops.) Otherwise - no Java in sight.

Re:Java and not javascript

[esme]

It looks like OpenJDK now runs on MacOSX:

http://landonf.bikemonkey.org/static/soylatte/

Re:Java and not javascript

[EthanV2]

Though I'm not sure why this whole discussion is under the title "Mac OS X users vulnerable..." when as the submission says the issue affects everybody. Other than to start yet amother boring FUD/flamebait war, of course.

Maybe it's because everybody else has patched it

FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple.

Re:Java and not javascript

[BrokenHalo]

It looks like OpenJDK now runs on MacOSX:

It does, but only with X11.

Re:Java and not javascript

[Cthefuture]

The result? PPC Macs are stuck on Java 1.5; Intel Macs have outdated, slow, and exploit vulnerable Java 1.6...

Not only that but the Java "1.6" they support isn't the full version, it's missing all sorts of API's that are in the Sun version.

I'm not a huge Java fan but I wish Apple would step up their Java support. I hear rumors that Snow Leopard will contain the full Java 1.6 from Sun.

Re:Java and not javascript

[Serious Callers Only]

Then you are very lucky, and likely don't work for a ginormous company whose only way to not make things in ActiveX is to make them in Java.

: ) Reason no 12939 not to work at a gigantic corporation. Having experienced working in large companies, I sympathise.

The funniest thing about large companies using web-apps for internal software is that most of them produce web-apps which depend on technology which is not truly cross-platform (Active-X, using a certain JVM, depending on a certain browser, etc), thus removing most of the business benefit of using a web application in the first place.

Re:Java and not javascript

[Serious Callers Only]

But, because of this standardization, the internal development staff only needs to target one defined platform, they aren't really worried about cross-platform support.

This works really well as a way to cut costs *for the IT department* in the short term. As to whether it cuts costs for the company as a whole (there's the lost productivity involved in enforcing a standard install that you alluded to, and the lack of choice of tools), is another matter, and I'm sure varies with the company/tech involved. Obviously some degree of standardisation is required when managing large numbers of computers, so I'd happily concede that point.

But there is a bigger issue related to this strategy in the long term. In the long term, targeting one platform exclusively leads to the production of tools which are tied tighter and tighter to that platform. So it means you can never switch to a competitor; you can't even consider switching to a competitor unless you're willing to ditch all the internal software that you've built up which will only work on version X of system X. It becomes simply impossible for your business to even think about switching. You might even find that moving to a new version of an operating system has significant costs which you had not anticipated (an XP to Vista migration for example, or IE 6 to IE 8). These are not the normal costs of doing business, they are the costs of doing business if you choose to lock yourself too tightly to one platform.

There is a reason that Microsoft pushed things like Active-X, .NET and IE for web apps, Sun pushes Java everywhere, Apple encourages web pages made for iPhones, etc. It is to tie developers/companies in to using just their products, and it is in the long-term interests of the tool provider, not the company using the tools to work with.

Using web apps for internal software is a good way out of this conundrum, so long as you do not target a specific platform with them. Otherwise, you may as well be writing binary software tied to a specific version of one OS - the end result is the same - lock-in. I understand completely why, in the real world, these decisions are made, but if you look at the situation rationally they are not good investments of time/money over the long-term, and they undermine the very reasons for writing software as a web application in the first place.

Re:Java and not javascript

[RevRagnarok]

Point taken, but then large corporations can define which version of which browser or JVM is standard and installed on their users' machines, n'est-ce pas?

Their corporate machines, yes. But I am an off-site worker (embedded as a contractor elsewhere) so need to use my personal machine at home to do my time cards, expense reports, etc.

Re:Java and not javascript

[bobdinkel]

I'd like to know more about this agreement between Apple and Sun. I did a bit of searching and couldn't find anything. Do you have more info? A link maybe?

Re:Java and not javascript

[obijuanvaldez]

The funniest thing about large companies using web-apps for internal software is that most of them produce web-apps which depend on technology which is not truly cross-platform (Active-X, using a certain JVM, depending on a certain browser, etc), thus removing most of the business benefit of using a web application in the first place.

Your experience may be different from mine, but the driving motivation behind using web applications for internal software has nothing to do with being cross platform but rather to do with ease of deployment. The business has a pretty tight control over what platforms are being used, they don't need to cater to any platform they haven't put in place. The real business benefit is not having to send out IT people to update each and every client machine for every update to the software.

Re:Java and not javascript

[TurboNed]

If anything is misleading, it's the "100% reliable" part. It's only 100% reliable against unpatched JVMs. Everybody else has patched their JVM except Apple.

Re:Java and not javascript

[Kz]

If anything is misleading, it's the "100% reliable" part.

that's a quote from the time the flaw was discovered. the news today is that Apple is the only one still vulnerable.

Re:Java and not javascript

[foo fighter]

Apple decided that they'd be better than Sun at creating a JVM for their OS, so they did it themselves.

That might have been the initial reason. Maybe.

But Apple really, really wants developers to use Objective-C and Cocoa when they are creating software for OS X. From Apple's strategic perspective, why support an alternative platform (and Java is an alternative platform) that doesn't lead to great Mac software, especially great Mac-only software.

And about that agreement between Sun and Apple that keeps Sun off OS X: now that Java is open sourced, what is keeping the community from creating and releasing an OS X-native client?

Re:Java and not javascript

[dave562]

If by "public sector" you mean government, it has been my experience that Microsoft has a very small portion of the market. Here in California, most state and county governments use Novell. A lot of them are still on Groupwise 5.5.

Re:Java and not javascript

[nxtw]

It does, but only with X11.

AWT/Swing may be limited to X11, but SWT applications can still use Carbon (or Cocoa using the in-development version.)

Great interoperability

[Chrisq]

'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,'

And the Java critics said total platform independence was impossible!

Re:Great interoperability

[x2A]

Yay this is gonna be so much easier than trying to ship Wine with my viruses...

Re:Great interoperability

[AJ Mexico]

And the Java critics said total platform independence was impossible!

Nonsense! For years Java apps have been producing platform-independent error messages on all platforms equally. Fortunately, the exploit will probably error out too!

Re:Great interoperability

[sootman]

Am I the only one who first read that headline as "Mac OS X Users Vulnerable To Major Lava Flow"?

Re:Chipset independent?

[EvanED]

FTFA, looks like what it allows is arbitrary execution of Java code. So it wouldn't be architecture-specific at all, unless you started using architecture-specific stuff in said code. If you've got the JVM to exploit, then you've got the JVM to run stuff on.

Re:Why am I not surprised?

[SoupIsGoodFood_42]

Yeah, Snow Leopard was really just an excuse for the programmers to sit around doing nothing all year. Slackers...

Instructions for turning off Java...

[Anonymous Coward]

In case you don't have OS X but want to pass on the instructions to relatives, etc:

In Safari (version 4 beta):

Safari->Preferences->Security->Web Content: Enable Java (uncheck)

In Firefox (3.5 beta, probably the rest):

Firefox->Preferences->Content->Enable Java (uncheck)

I don't have any other browsers (opera, different versions, etc.) on hand, but it might be nice to add instructions in a reply...

Re:Instructions for turning off Java...

[Ash-Fox]

It would be nice if there was a way to disable it for all sites but blah.com

Try Noscript.

Re:Instructions for turning off Java...

[vertinox]

I notice most sites don't like it when you turn javascript off, but don't care about java.

The question I would have is that does Javascript on OSX have the same vulnerabilities?

Perhaps the best solution is to install NoScript and white list only the sites needed.

Re:Instructions for turning off Java...

[FictionPimp]

I use noscript on firefox. But I would like this option in safari.

Really why should disabling javascript and java with a white list be a feature that requires a 3rd party addon.

Re:Instructions for turning off Java...

[hplus]

The question I would have is that does Javascript on OSX have the same vulnerabilities?

No.

Java:Javascript::Ham:Hamburger

Re:why specify Mac OSX

[Draek]

If you had read the very first paragraph of the summary, you'd know that it's "a vulnerability in Java that has been patched by everyone but Apple."

For all the other platforms, architectures and browsers the fix is "use a version of Java that's less than 6 months old". For OSX users, however, the only solution is to stop using it altogether.

Pick and choose your quotes much?

[Animaether]

Very well...

I choose this one...
FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple.

So essentially... All Apple users who have left JAVA enabled, and all -other- users who have not yet patched their JAVA installations. Yes, that does include Microsoft Windows, flavor-of-the-month Linux, etc. users who decided to disable auto-updating - if any - of their JAVA installation.

Design or implementation flaw?

[pwilli]

I'd really like to know if this was/is a flaw in the structure/design of the JVM or just happened to be some kind of pitfall every major JVM-implementor fell into.

The articles and bug reports are light on detail, I could only find out it is related to "Deserializing Calendar Objects" and allows the applet to execute stuff with the users rights (or probably more correct, the rights of the webbrowser who started the applet)., which sounds like an implementation problem to me. Was there some reference implementation all JVM-developers used for this specific functionality?

Re:Design or implementation flaw?

[Draek]

This, gotten from the comments at TFA, has a bit more details on it.

Apparently it's a mix of both, a structural problem with the fact it needs to grant the Calendar class special priviledges to access ZoneInfo objects, and merely a common pitfall in that nobody had thought to limit those priviledges before to *just* accessing the calendar.

Beautiful stuff they used in the exploit, though, it's as if they actively tried to use every OOP-derived feature in Java on it at the same time ;)

Re:Design or implementation flaw?

[QuoteMstr]

technical details here.

The gist of it that the Java Calendar code temporarily elevates its privileges in order to deserialize a ZoneInfo object. If you substitute your own object's serialization for the ZoneInfo, you can get the Java runtime to create any object you want. Some questions:

1. Didn't anyone realize how dangerous arbitrary privilege elevation is?
2. Didn't anyone think that it might be overkill to elevate privileges in order to read a timezone?
3. How many other similar vulnerabilities are lurking in the standard library?

Re:Design or implementation flaw?

[bay43270]

Good link. It should have been in the summary. It seems like a fairly obscure bug though. Here's an interesting quote:

"I've mentioned that this was a class of vulnerabilities: the reason is that with this design, every time Java code deserializes an attacker-controlled input in a privileged context, it's a security vulnerability."

Maybe it's just lack of imagination on my part, but I can't think of a good reason for a privileged app to deserialize objects from an untrusted source.

Re:Why am I not surprised?

[MobyTurbo]

You've kinda just proven the OP's point. Snow Leopard is just prettying up what already exists.

Snow Leopard is mainly a beneath-the-hood architectural upgrade. http://www.apple.com/macosx/snowleopard/ "Taking a break from adding new features..."

That having been said, there's nothing on there about added security. I can tell you there are some rumors that things like more complete code page protection and address randomization will be in Snow Leo, but Apple's priorities concerning security are rather low; they rely heavily on security-through-obscurity, and one day if they're not careful it's going to bite them.

To be expected

[Shrike82]

The (untrue) assumption that many people seem to hold that Macs are just invulnerable to anything bad happening has finally spread to Apple itself, and they're the last to patch this exploit. Since a lot of Mac advertising used to be based on "Macs don't get Viruses" you'd think they'd have been the first to patch this to maintain their reputation.

Yes I know I'm probably going to get modded down immediately for saying this, but hell, it's the truth.

Re:To be expected

[perryizgr8]

The (untrue) assumption that many people seem to hold that Macs are just invulnerable to anything bad happening has finally spread to Apple itself, and they're the last to patch this exploit. Since a lot of Mac advertising used to be based on "Macs don't get Viruses" you'd think they'd have been the first to patch this to maintain their reputation. Yes I know I'm probably going to get modded down immediately for saying this, but hell, it's the truth.

yes, you were correct about ONE thing,

Re:To be expected

[oDDmON oUT]

"The (untrue) assumption that many people seem to hold (is) that...", patching actually is a "best practice", when it's not.

Marcus Ranum has a interesting and humorous take on patching that spells it out much better than I could.

The short version:

• Patching is a substitute for good design
• Patching exists for the simple reason that there is a rush to get products out the door, rather than take the time to ensure that they are secure

This is true of 99.9% of software in use.

Re:To be expected

[Hal_Porter]

Usually it's like this

Release 1.0 is shipped. Testing is very extensive and a huge list of bugs are found. The most critical ones are fixed, the rest are scheduled for Patch 1.0. The experienced part of the team moves onto their next project or takes a vacation. Now a load of new people are handed copies of Release 1.0 and assigned a bug. Most of them will manage, but a minority of them will make chages with severe side effects - e.g. their code will corrupt the stack or heap. They module test, missing the corruption and check the code in.

So now Patch 1.0 contains a lot of fixes, some very badly coded. Possibly they will cause problems on their own, or possibly when combined. There are bugs that were missed in the big release too. A lot of the new people will get assigned off the project. Usually the amount of system testing on pathces is not as much as Release 1.0

The other issue is that the commercial pressure on the company is dropping - bugs introduced by a patch when people have already paid are less serious commercially than bugs at release when they're still thinking about paying.

So it's quite possible that updates will actually make a product worse.

Re:To be expected

[foo fighter]

Frak, someone always has to make this post, don't they?

Of course OS X has security flaws: it's a modern, general purpose operating system.

The fact remains that by many metrics it is much more secure than Windows. For one, there are no where near the number of malware in the wild targeting OS X as there are for Windows. Most people who run OS X have never, ever had to worry about contracting a virus, trojan, or worm. That is not the same thing as saying they never will, but it is a remarkable track record.

I am concerned about Apple's slow response to newly identified flaws. Their lack of candor in discussing vulnerabilities, their potential impact on the platform, or details of its remediation in patches' release notes is also worrisome. They need to pick up their game if they want to keep that track record as the platform expands.

Re:To be expected

[oDDmON oUT]

"I don't get WTF you're saying here. It's best not to patch, and just to keep having a security hole?"

Not all. I'm saying the features are possible, and so is security, if the companies involved would *take*the*time* to make them a priority, rather than making the public the largest unpaid beta-test pool on the planet.

Part of the problem is there is no liability to them for *not* doing so, the standard EULA ensures that.

"I mean, you could run an entirely proven OS... have fun with Hello World!"

If you'd taken the time to follow the link I provided, you would have read that Ranum coded a fully functional OS/web server combo for a porn site a decade ago that's never been successfully hacked, because it was designed with security and a feature set from the very beginning.

BTW, "Hello World!" is not a entirely proven OS that I know of.

Re:To be expected

[d-signet]

the best thing about this exploit...."it just works" :o)

Also disable Safari's 'Open"safe" files.

[landonf]

In addition to disabling Java support, Safari's 'Open "safe" files after downloading' must also be disabled to prevent websites from automatically loading a Java WebStart application via a JNLP file.

I've also posted a demonstration of the vulnerability at http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html

Re:Now patched?

[landonf]

No patch is currently available -- a fully patched 10.5.7 system remains vulnerable. See also http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html

Not all OS X users at risk

[oDDmON oUT]

For the record, those running Firefox as their default browser, with NoScript installed, won't be affected* unless they *choose* to execute an unknown, untrusted binary within the browser.

*At least the sample exploit at the top of the thread didn't execute for me, YMMV

Re:Now patched?

[oDDmON oUT]

Nope. Patched to 10.5.7, with all updates, and the sample exploit would still run. Of course I use FF with NoScript so I had to allow it to run, which just goes to show that sometimes faster is not better

Oh I don't know...

[Shivetya]

after meeting some Mac newbies I am think I can already see the iceberg. Two are friends, one of which called me out of the blue to tell me that he just bought his first Mac (an iMac actually). Well needless to say I get calls from both since I am the "mac expert" (Read: I had one longer than them).

The simplest way to say it, they are more than happy to key in their password for anything that asks, even if they don't know what they are doing. After all, they are on a Mac, they don't have virus protection because it doesn't need it, so how is something bad going to get on the system. These are not normally dense people, well maybe they are proving me wrong.

So I figure that someone out there will rely on this type of stupidity to get key loggers, bots, and the like, on Macs. The number of people out there who buy one because they think it makes them cool or smart cannot be underestimated.

I do know one of these two did ditch firefox because they didn't like clicking the ad-block button to allow some sites. So it is just a matter of time.

(and no, I do not run a AV or worry about it on either of my Macs)

Re:Oh I don't know...

[x2A]

In "the oldun days", computers used to come with books, instruction manuals, telling you how to use them. Nower days, OS vendors will jump through hoops to try and ensure that their users Do Not Have To Learn A God Damn Thing(tm)... and in some instances, inconsistent user interfaces actually prohibit learning (although I wouldn't call this common case). And this is the result.

I'm not suggesting people should have to know all the nuts and bolts of the internals, but I'm sure there's a middle ground so this culture of "our users are stupid, we must protect their tiny brains" can be vanquished.

(this is not limited to Apple/OSX by any means, although they do appear to me to be worse for it, this gap is closing fast)

Re:Oh I don't know...

[jimicus]

As an agriculture monoculture, PCs were an easy infection target because of their uniformity and number. I wonder if, in an imaginary world where Win, Mac & Linux were split 30/30/30, you would still see 1/3 of the Windows malware? Hopefully not. Hopefully it'd be less.

I hate to break it to you but I remember the days when there was no Windows monoculture and data was usually passed with floppy disks.

Malware existed on all common desktop platforms back then. It couldn't spread as fast, but it certainly existed.

Re:Oh I don't know...

[_Sprocket_]

In "the oldun days", computers used to come with books, instruction manuals, telling you how to use them.

Yup - and we ignored them for the most part. They did look nifty on the shelf. I've still got a few.

Having said that - I agree with the general premise of what you're saying. Back then, we respected the microcomputer for the complex little beastie it was. These days people are being told that their computer is as simple as a toaster. They're buying in to a whole case of snakeoil.

What makes it even more difficult is an almost willful ignorance from end users. I've talked to some very intelligent (in one case a literal rocket scientist) users who will disengage their entire critical thought process once they get behind a keyboard. I'm not entirely sure why.

Part of the problem is probably because people really do believe computers are still hard to work with. Quite a few years ago, I saw one of the more distinguished news casters interviewing someone and making the claim to be completely ignorant about using computers. It struck me as odd - could you imagine Dan Rather breaking in to his series of questions with a Federal economist to note that economics completely baffles him?

When people think computers are hard but are being told they're "just works" easy, and worse they have some personal experiences that exposes the lie, there's got to be a cognitive dissonance kicking in. No wonder they put hand to mouse and freeze.

Of course - that might be a somewhat dated outlook. These days you don't see newscasters talking about how "computers are hard." Now they're trying to get you to subscribe to a Twitter feed. Maybe we've made a leap over that freeze response and are now blindly clicking away; still lacking critical thought but giving in to the heady promises of the snakeoil.

So how much damage can this do?

[Viol8]

So it can arbitrarily execute java code in a browser. Well hold on, arn't browser VMs rather crippled anyway in their functionality? And thats after you take into account it'll only have the priviledges of whichever user launched the browser in the first place. So what exactly could you do with this exploit? Steal some cookies, bring up some annoying windows? Or is this about it being able to escape the sandbox? I don't really get it.

Re:So how much damage can this do?

[oDDmON oUT]

A *lot*.

Consider. Many, if not most, Mac users run with admin privileges (though this is a not solely a Mac problem), so having an untrusted binary, able to execute whatever the hell it wants, accessing everything from / on down... well... I leave it to your imagination, but nuking your home directory would be the least of your problems.

Re:So how much damage can this do?

[epee1221]

Strictly speaking, it's sudo privileges, not root privileges. If someone's willing to type his admin login password into a Java applet, there's probably no saving him anyway.

Re:So how much damage can this do?

[DrgnDancer]

Actually virtually no Mac users run as "admin", they run on admin enabled accounts, but those accounts require you to enter your password (either in the GUI, or in sudo depending on the function) to perform any admin tasks. It's actually a bit of a chore to actually login as "root" on a Mac, it's a disabled account by default. Trivial for an experienced Unix user or admin to get in and activate it, but in theory that's not our worry here. My last couple of Macs I reactivated root, but on my most recent one I decided it was silly and use sudo when I need root access.

Having said that, you can still do plenty of damage as a "regular" user. I'd hate to lose my home directory, it contains more or less everything I use day to day. It's backed up, but I doubt everybody's is (Though Time Machine makes it pretty easy, so maybe more people have backups than I think)

Re:Now patched?

[iwein]

try the 'say' invoking applet by Landon Fuller: http://is.gd/BpBp. That scared the crap out of me... what if it had invoked 'rm -rf ~'?

Re:Chipset independent?

[Anonymous Coward]

Does it matter? If the JVM has access to the filesystem and the network, that's all a virus writer needs.

apple letting down java users..

[Anonymous Coward]

Steve Jobs, JavaOne Keynote 2000:

"We want to bring Java back to the desktop in a really big way. Iâ(TM)m here today to personally tell you we are working hard to make Mac the best Java delivery vehicle on the planet. The biggest thing we are doing is we are going to bundle Java 2 SE into every single copy of Mac OS X that we ship later on this year."

WWDC 2006

When is the next Java coming? We are following Sun's releases of Java SE 6 betas and other Java updates very closely.

Steve Jobs, January 2007 (iPhone related):

"Java's not worth building in. Nobody uses Java anymore. It's this big heavyweight ball and chain..."

2008/05/01

Apple (finally!) releases JDK 6 with 64 bit support only. Most apps won't run due to the lack of cocoa 64 bit libraries. 1 y/old notebooks left in the cold without 64bit support.

Re:apple letting down java users..

[cshbell]

I don't see the point you're making. You might as well have contrasted nine-year disparate statements about RAM size. Over nine years, Apple's stance towards Java has changed; what's wrong with that? In 2000, Java seemed to have a wider path on the desktops than it does in 2009. Other languages and runtime environments have grown up around Java in the subsequent nine years, and to Apple's thinking, the other languages (such as Objective-C 2.0) allow for building better software than Java allows.

Apple's stance appears to be, right or wrong, that Java on the desktop and mobile devices is no longer the best way to develop and deploy software, and thus, they've allowed the Java implementation in OS X to grow long in the tooth, and have outright declined to port it to the iPhone/iPod Touch OS.

Re:apple letting down java users..

[foo fighter]

Obviously Apple is doing this so app developers must use the Cocoa libraries and internal devs can focus on improving Cocoa.

I don't know why any platform developer would devote resources to Java support. That should be up to Sun and the Java community.

Bitch and moan at Apple if you want, but it is Sun who signed an agreement with Apple promising not to release a OS X version of Java from Sun.

Re:Why am I not surprised?

[MobyTurbo]

Snow Leopard is mainly a beneath-the-hood architectural upgrade. Then how are they planning to market it to the Great Unwashed? They're never going to pursuade the fan-base to shell out dollars and cents if they can't see something new and shiny.

All of those people with Macbook Airs (no pun intended) and any upcoming Apple netbook who's systems could use a more svelte OS would be in the market for it. Think Vista vs. Windows 7, except less of a difference in speed and interface. If you don't believe me, check out the site I linked earlier - Apple's own marketing copy says the new features are on "pause" and the feature of Snow Leo is performance and smaller footprint.

Re:There is no reason to have Java enabled

[Ash-Fox]

CERT has been telling users to disable Java in your web browser for years. If you haven't done so already, give it a shot. You probably won't miss it.

First things I noticed after disabling it, restarting Firefox with my saved tabs:

• Can't use my bank anymore
• Citrix from the web doesn't work
• Akamai download manager doesn't work
• Website IRC chat no longer works
• Dragon court no longer works

At this point I got annoyed and turned Java back on.

Customized JVMs

[PincushionMan]

Speaking of liking only one version of the JVM, I worked for a CLEC (a small phone company) that had to interface with the RBOC (The Phone Company - SBC/AT&T) via a Java applicaton for provisioning phone numbers and the like. The application ran on a specific version of Java 1.4.2 (like j2re_1.4.2_01 or something), and the JVM had to patched by SBC software so that the application would run. The name escapes me... Oddly enough, I think LENS (Bell South's Java interface application) used the exact same version of the JVM. And this was before there was even talk of them merging.

Re:Why am I not surprised?

[Ash-Fox]

Although this situation is clearly unacceptable, I would not have called your remark insightful. Apple has been pretty busy with the security updates:
http://support.apple.com/kb/HT1222

That's not really busy in my opinion. 3-5 security updates a month is nothing to be impressed by and it doesn't tell me if they fix all their vulnerabilities, which as we all know, they haven't.

As a whole, I would say leopard is pretty secure (when compared to linux, compared to windows it's ironclad).

You know, I've managed an OS X server before, you can't fool me. Considering how they almost don't issue an security update for the entire duration of the server release is pretty scary.

I've also had OS X on my desktop before and I've seen how Apple pretty much just ignores low profile security issues with the opensource software they use, from Samba to CUPS. Often including the updates in the next 'major' version of OS X. Meanwhile, Linux distributions get it patched practically next day.

No, I'm not impressed.

Same "Stuff", Different Vulnerability

[sqlrob]

Apple took more than a year after Sun patched it to patch an exploited buffer overflow in the JVM. They'll take forever to fix this too.

Re:Why am I not surprised?

[singularity]

Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.

Posts like yours are the reason that Slashdot needs a "-1, Factually Incorrect" moderation.

I agree that Apple should have patched this a long time ago, but your argument that Apple does not care about security is just plan asinine.

Re:Why am I not surprised?

[stuntpope]

He agrees that Apple does care about security - read again. But he argues that they are not open about the details of what they fix, which as you point out, is incorrect.

Re:Why am I not surprised?

[jesser]

Could it be that Apple does have security improvements in Snow Leopard, but isn't talking about them yet because they don't want people shouting "OMG Leopard is insecure"?

Can't disable Java at work

[dn15]

I'd like to disable Java but I work at a school district where...
- Our Internet filter keeps you authenticated with a popup that embeds a Java applet
- Our Internet filter admin interface is Java
- Our wireless network login uses a Java applet to authenticate your username and password
- Our student record database runs on Oracle with a Java interface

Basically if I disabled Java I could only access one or two superfluous file servers on the LAN, and only using an Ethernet cable. Not gonna happen, unfortunately.

Re:why specify Mac OSX

[Sandbags]

That of course 1) assumes someone actually writes a virus targeting the Mac platform, 2) you are somehow redirected to a site that hosts the vulnerability, or launch an attachment that is a java applet itself that contains malicious code, 3) the virus doesn't violate other UNIX security rules that would stop it from running on the Mac platform, and 4) that there's actually data stored on your mac in unencrypted form in a directory the virus can get to to steal information from you, or some way the Java app can infect your machine with other code that can steal your input and passwords.

If all 4 are not true (and they're not yet), then apple users are currently safe. Apple engineers do not rush "emergency" patches out for vulnerabilityies when no ITW code has yet been discovered. They'll also assess what a virus could actually be capable of, and determine the complexity of code required to pull off a hack on their platform, and they'll assign a priority to the code work.

This, I'd gather, is a low priority risk for Mac as I've not actually heard, other than the proof of concept, of an ITW virus for ANY platform exploiting this viln, let alone a targeted mac virus. They'll release a patch, but 6 months in, and with everyone else already having it patched, Apple is likely just waiting to apply it with other patches. Kind of surprised it was not in the 10.5.7 patch recently... must be really low priority. This isn't exactly something they need to invent a fix for...