Slashdot Mirror
Apple Finally Patches Java Vulnerability
macs4all writes "Apple has finally addressed the Java vulnerability that nearly everyone else patched months ago. Available now for OS X 10.4 and 10.5, and through Apple's Software Update service, this update patches a flaw in the Java Virtual Machine that could potentially allow a malicious Java applet to execute arbitrary code on the machine. Apple had previously advised users to turn off Java temporarily in their Web browsers."
...and this means that we can expect Vic20_love to come along any moment now and complain that his OS X 10.1 machine from 19-dickity-6 doesn't have a patch out yet, so Apple sucks.
Apple sucks for different reasons:
Apple PREVENTS Sun (by contract) from releasing java patches. Mac users get their java patches whenever Apple feels like it and gets a round to it.
They've been apple's problem since they took over porting java to the mac, and prevent sun from writing their own java for mac.
...Its not like Sun needs Apple in order to produce Java for the Mac.
Sun did a JVM for the Classic Mac OS, and by all accounts it sucked. As in, it was barely usable. This is why Apple (contractually) locked Sun out of delivering Java on OS X. At the time, Apple was bullish on Java, and invested some considerable resources making OS X's JVM integrated into the rest of the OS.
Unfortunately, Apple no longer gives a shit about Java, and it shows. But Sun is still locked out, as far as I know.
Or is this like the graphics drivers where only Apple has access to the "secret bits" necessary for a JVM to do all the things that the current Mac JVM does?
How hard would it be to just port OpenJDK/IceTea/whatever to Mac and be done with it?
There already is. It's the only way to get Java 6 on PowerPC and 32-bit Intel Macs, or on 10.4.x
Unfortunately, it relies on X11 for its GUI, which is generally a big non-starter on the Mac. Also, I don't believe it's possible to use it as the JVM for Java applets in a browser, probably for the same reason.