Why You Can't Dump Java (Even Though You Want To)

snydeq writes "Since so many recent exploits have used Java as their attack vector, you might conclude Java should be shown the exit, but the reality is that Java is not the problem, writes Security Advisor's Roger Grimes. 'Sure, I could opt not to use those Java-enabled services or install Java and uninstall when I'm finished. But the core problem isn't necessarily Java's exploitability; nearly all software is exploitable. It's unpatched Java. Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of. Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty. They almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.'"

Comments

Accountability

[amginenigma]

Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.

Re:Accountability

[icebike]

Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.

The criminal justice system, and the police are scaled just big enough to keep people from murdering each other and running off with with other people's property on any grand scale. It was never intended that this level of policing should be 100% fool proof. Even in those countries where there is totalitarian control, petty crime is rampant and tolerated simply because you can't lock up everybody.

I doubt you or the author of TFA would want to live in a society so tightly monitored that it was impossible to commit ID theft or internet crime (he seems to equate the two).

There was an opportunity, and actually some proposals for a non anonymous internet once upon a time. Also for absolutely verifiable Email senders. That path wasn't chosen, and would likely have been impossible anyway, with the side effect of turning a lot of petty internet activity into internet crimes, merely because you posted without a license, or made a name up.

Re:Accountability

[gman003]

There was an opportunity to try. It may even have been an opportunity to succeed, but we will likely never know, as we collectively took a different option.

Re:Accountability

[CajunArson]

The Internet is not and never was designed to be "anonymous" despite the popular myths online. People confuse "anonymity" with the fact that the Internet does not provide any good mechanisms to verify who you are actually dealing with (SSL certificates are a semi-useful additional layer designed to fix that issue).

Go back to the earliest days of the Internet and the WWW and you'll see that it was actually the opposite of anonymity. It was a bunch of physicists who wanted people to actually read their papers and give them grants ;-)

Re:Accountability

[SScorpio]

You might want to move then. There are 28 states with no duty to retreat there is a break-in your home. And another 17 states where you can stand your ground no matter where the attack takes place.

http://en.wikipedia.org/wiki/Castle_law#States_with_a_Stand-your-ground_Law

About three weeks ago there was an guy in his eighties that killed a robber with a shotgun and two other ran off. The media report his heroics in defending his property, and sleeping wife. Doesn't sound like he was considered a criminal.

Shooting fleeing suspects in the back when they are outside your home may bring about criminal prosecution, but it's up to a judge and jury if there was immediate threat at the time.

Re:Accountability

[Grishnakh]

The whole idea of accountability is utterly stupid as long as you have a single data network that spans multiple countries. If someone in Nigeria sends you a virus or does something else illegal, WTF are you going to do about it? Nothing. There's absolutely no way you're going to make people entirely accountable for their actions as long as there's multiple governments, and worse different laws in different places. The only rational thing to do is to protect yourself.

Re:Accountability

[Grishnakh]

The Trayvon Martin case is a little weird, because it looks a lot like the guy sought the kid out and picked a fight with him and then shot him. That's not legal, even under the Stand Your Ground laws. We have the same kind of law here in AZ, but it's not going to protect you if you go out of your way to start a fight with someone; it just means you're allowed to defend yourself where you stand. However, you better be able to convince people that you really were physically threatened, and that (this is the key here in the Martin case) that you didn't provoke the threat in the first place. That means you can't go pick a fight with someone, punch him, wait for him to punch you back, then pull out your gun and shoot him dead because you were "afraid for your life". Anyone can see that's a BS line of reasoning. Because of this, if you're in public, you really need to have witnesses or some other evidence that you were in the right, and didn't instigate the conflict, or else anyone could just go shoot someone and claim they were threatened. It's much easier inside your home; if some stranger is inside your home and you shoot him dead, it's pretty hard for prosecutors to argue that you instigated it or whatever; your story that the person broke in and threatened your life is hard to argue with. If it's your brother-in-law, however, expect some trouble.

Re:Accountability

[Surt]

I think this may be coming from the death throes of reddit. A similar phenomenon happened as digg imploded. Desperate to stop the hemorrhaging of users, they started spamming slashdot relentlessly in an effort to drive users back to digg. When digg finally went belly-up, it stopped, and there was a relative peace for quite a while. Now that reddit is going through a period of user flight, we seem to be getting a lot of angry reddit users posting odd stuff.

Re:Accountability

[Samantha Wright]

De minimis non curat praetor!

Re:Accountability

[RobbieThe1st]

Better yet, all it does is encourage people from other countries - If you eliminate all local "hacking", you've effecively removed a number of controllable break-ins that can be learned from(controllable as in if a US person copies a thousand CC numbers, there's a decent chance he can be found and the data removed from his hands. If the person is in china or russia, no way).

I'd argue there should be a national program rewarding kids for hacking into publicly-facing company systems, provided they follow certain rules(no DDOS or undue load, for example) and report it immediately -- The company targeted then gets fined proportionately to the data available to be copied - do that, and suddenly you have a lot of people who are out for the reward instead of the data's value, companies would invest a lot in decent security, and it'd make it signifigantly harder for people *outside* your sphere of influence to break in to the systems.

Juat my 2c.

Re:Accountability

[lightknight]

Therein lies the rub. The argument goes like this: a man's life (man here meaning men, women, and children) is his own, and cannot be owned by anyone else (anything else is tantamount to slavery, which I do not feel the need to point of the evils thereof); a man is free, in so far as life without freedom is death (a slave has no right to his own property, as it is supposed to be ultimately his master's property); finally, a man's thing are his own, in so far as he is free to pursue his happiness as he likes, provided it does not violate the former two items (life and liberty) of others. To steal a man's thing is to deny him the happiness that comes with pursing such things, as well as the liberty associated with it (by stealing his things, you are effectively profiting from him, ergo you have made him your slave, if only in this manner). As the life of a slave is one of death, you have sent the man into a state that is considered quasi-death. As such, a man, having gotten his wealth through no ill-means, is free to kill another man in defense of that wealth, as he would his life or someone who wished to rule him.

That's the 5-minute argument, of which I am very hastily making. Do not consider it the authority on such thinking, as anyone can find holes or points I have oversimplified; however, it does provide some understanding into the ideas behind defense of property. If you wish to understand more about this concept, I'd point you to the history of every major civilization, with a note that as property laws degraded, those civilizations fell. Finally, the irony of these words is not lost on me, as despite their inclusion in a very important document (as an American), they were summarily discarded when others felt a desire to be rulers of what where considered less-civilized men. Men != property, under any interpretation of the law. And yet, I get the feeling that civilization is about to test that law once again, to see if it still holds; I do not think this country will survive such a test.

Re:Accountability

[dutchwhizzman]

The Internet was set up in such a way that administrators/owners of infrastructure were supposed to make sure their users wouldn't abuse facilities. As long as all admins and abuse-departments were upholding Internet rules (nothing about laws of any specific country) things would be marry. The whole problem started when local law enforcement started happening and disconnecting hosts/networks that were misbehaving wasn't an option anymore due to commercial interests.

Re:Accountability

[gutnor]

I doubt you or the author of TFA would want to live in a society so tightly monitored that it was impossible to commit ID theft or internet crime (he seems to equate the two).

There must be a middle ground between no law enforcement and a totalitarian regime. You made the point earlier: you can steal, but it is very difficult to make a decent living out of it, that is the target for software/internet scams.

Well there is a solution: curated platforms like Apple IOS Store. If you use only apps from store, you have a lot more chance to be safe than on a "free" platform like a computer. If a decent solution is not found, there will be some day a company like Apple selling a curated internet for a profit and people will flock to it. (we had that before in the time of Compuserve and cie)

Re:Accountability

[Kalriath]

Jokes on them. Slashdot went through its user haemorrhage years ago. Not sure where the users went though.

Re:Accountability

[Kalriath]

I hate to point out that one of the largest failing civilisations right now is the one with the most ridiculously overbearing property rights laws. Yours. Most of us civilisations who refuse to accept the premise that any replaceable material object can be worth more than a human life are doing quite well thank you. Any argument that tries to claim that property can be worth more than life under any circumstances is inherently logically and morally flawed.

Re:Accountability

[roman_mir]

You have all the facts wrong it looks like. Zimmerman didn't attack Martin, he was backing off, returning to his car when Martin attacked him. Zimmerman fell, Martin jumped over him beating Zimmerman's head against the ground, Zimmerman then shot him.

The cops who didn't throw Zimmerman into a holding cell right away obviously thought that it happened this way, that Zimmerman was protected with that 'Stand your ground' law, that it was self defence.

The media is being used though to create a narrative among the public that there is this splurge of white on black crime, when actually that is not the case in USA, and nobody makes a federal case out of crimes like this for example.

Re:Accountability

[mr_gorkajuice]

Well, duh. Several lives are more valuable than a single life. To me, my life is worth more than yours, though I'm sure you'd disagree.
However, every life is worth more than a flat screen TV.
Btw, capitalism is doing just fine over here, despite lethal violence not being legal means for protecting property.

Re:Accountability

[Anonymous Coward]

There was at least one eye witness who saw Martin sitting on top of Zimmerman. There was physical evidence that Zimmerman was laying on his back on the ground (the back of his shirt was wet and covered with leaves and grass clippings). Zimmerman has a freshly broken nose and lacerations on the back of his head. All of the evidence publicly presented tends to confirm Zimmerman's version of the story.

Re:Accountability

[jellomizer]

Well for things like you need to make sure your software up to date who are you going to blame if it goes wrong. Do you blame the IT workers who know about the problem, but their bosses don't give them permission to run the update and work on higher priority product. Do you blame the Bosses who get heat from the key users every time the system is down for maintenance, and if there is an issue they will get more heat for it. Do you blame the Key Users for not willing to pay the extra money to follow IT suggestions on keeping a better up time. How about the vendor who didn't put out the Check list to say that new version work. Or if your new version doesn't work they won't support you. People go into IT because they like technology. People in IT end up not using technology because they are too busy running the company because they are the only department that talks to other departments.

Re:Accountability

[parkinglot777]

Regardless what happen between Zimmerman called and the boy was killed, Zimmerman had no reason to ignore the police advice to stay where he was but followed the boy. When he didn't listen and the consequence is a dead of someone who is not him, there are always questions and this doesn't sound good for him anyway.

Re:Accountability

[serviscope_minor]

Any argument that tries to claim that property can be worth more than life under any circumstances is inherently logically and morally flawed.

Well, that's a logical fallacy if there is one.

Let's start at the absurd end of the spectrum to demonstrate the vapidity of your claim.

If the property is necessary for survival of its owner, then it is certainly worth more than the life of the person trying to steal it.

This could be necessary medical equipment, or even clothes in a suitably exposed setting. Stealing that property is tantamount to murder, since it will directly cause the death of its former owner.

Do you still claim that the property is worth less than life?

Let's now swing to a wild other extreme.

If you believe that no property is worth more than a human life, then why don't you give away everything you own towards the cause of saving lives? If you refuse to do so, then you are valuing your property more than human lives.

Your argument is absurd, and you don't even believe it yourself.

Re:Accountability

[ldierk]

It's much easier inside your home; if some stranger is inside your home and you shoot him dead, it's pretty hard for prosecutors to argue that you instigated it or whatever; your story that the person broke in and threatened your life is hard to argue with.

So should I be afraid to be invited to someone else's house, because he could decide to "stand his ground" and shoot me? This argument is BS.

Re:Accountability

[emho24]

I simply cannot understand the position some people take "it's just stuff, it's not worth a life!". You broke into my *home*. This is where I live with my wife and child. I am not going to spend one nanosecond pondering your motives, whether you are here to steal my tv or the life of my family. I'm going to shoot center mass (no, *not* in the legs), and I am not going to stop shooting until the threat is no more. Period. My state has a castle doctrine, but I don't care. It was my doctrine long before it was state law. No one is going to tell me that my life and my family’s lives are worth less than some criminal that broke into my house.

Re:Accountability

[hairyfeet]

Not to mention you would literally need a "New World order" style government because the Internet is planetwide. This is why when you look at maps of cybercrime you have certain countries with more of the pie and others with less, such as Nigeria and the classic 419 and the USA with spam and Eastern EU tends to go for money laundering schemes and I hear is big on skimmers for ATMs.

The only way to stop a planetwide crime problem is a planetwide police force with the authority to go into any country and pretty much do any damned thing that they wanted in pursuit of criminals. Yeah....I don't really see that going over so well, especially when I can just not include Java in my new builds and not have the problem.

That also doesn't explain why Java sucks when it comes to exploits whereas other languages haven't been nearly as badly affected. Hell Java has had an autoupdate mechanism for HOW many years? Yet its still at the top of the pwned charts? Flash frankly has had less pwning and they only just recently gave the users an easy autoupdate so I think there be something wrong with Java. Maybe its sandboxing sucks, maybe its given too high a permission, not a Java guy so I don't know, but what I do know is its even easier than ever simply not to include it at all. Hell I haven't included Java in new builds in over 3 years and can't remember a single person asking me about it, and if it weren't for LO/OO.o frankly Java wouldn't ever be seen on any boxes coming in so I'll be glad when the LO guys remove Java dependencies.

Re:Accountability

[jafiwam]

They may "win" the first few times.

The problem is, if you keep getting in gunfights due to your actions, eventually you get hit and incapacitated and caught, or just killed.

So that's a self-correcting strategy that only works for a little bit.

And your argument is that it's "mentally hard to kill someone" only applies to a decent citizen. Go Google the essay "Street Robberies and You" (it's all over the place now). There's no reason for a homeowner to not assume the person is there to kill them. (At least, a smart homeowner should assume that.) Which negates your argument.

Feel free to decide what to do yourself. However, your right to tell me what to do stops at the edges of my property.

Re:Accountability

[jythie]

Assuming you are talking about the US, this is mostly a myth. In general (in pretty much any state) shooting an intruder will get the police talking to you to make sure the story checks out. While the details and requirements of Castle Doctrine vary from state to state, I do not know of any that criminalize use of deadly force in a life threatening situation within your own home.

Re:Accountability

[King_TJ]

Well, actually, yes - someone *is* likely to tell you, in such a situation, that the criminal who broke into your house has a life worth "more than yours". That person is likely to be another family member of the criminal in question.

We see it on the news all the time... the crying mom with the story of how "Junior was always such a good kid." after he's arrested on charges of theft, assault, etc.

The point here is, most people think their own lives, and those of their own friends/relatives/family are the "most important" to protect at all costs. I agree with you, that the "It's just stuff. It's not worth a life!" thing often gets taken way too far. But I think the "value of a life" question itself has an answer that ALL human lives have equal value. In extreme cases, some individuals have managed (IMHO anyway) to reject their humanity and live as animals instead. Those are the ones who tend to wind up as candidates for death row in our prison system. But usually? The only difference between you and the criminal who steals from you is that the criminal made some bad life choices that led to his perceived need to stoop to that level to obtain something he wanted out of life.

Really though, Castle doctrine isn't about the idea that your stuff in your house has more value than the life of someone who wants to take it. It's about the idea that a person wiling to break into your occupied residence is presumably willing to do bodily harm to you, and you have the right to defend yourself in such a scenario. (If they only wanted the stuff in your home, why wouldn't they wait until you weren't home and burglarize it instead?)

Re:Accountability

[Grishnakh]

Bullshit. The USA only extends its laws (or attempt to) to industrialized countries, or to countries with lots of oil or other resources. I don't see the USA messing around with Somalia, Nigeria, Zimbabwe, etc. Nigeria is infamous for scammers, and I certainly don't see the USA doing anything about that situation. That's because the scammers there only prey on middle-class Americans, not on any well-connected industries with lobbyists. If the Nigerian scammers were somehow scamming the MAFIAA, then we'd probably see an invasion.

Re:Accountability

[Grishnakh]

Sorry, but it's true. Here is AZ and most such states, it's pretty much open season on anyone who breaks into your house. So if someone invites you into their house and you think they're nuts or out to kill you, you'd better turn down that invitation. How is anyone going to know they invited you in and then shot you, when they claim you were an intruder, and there's no witnesses to say otherwise? I imagine the problem of someone using it as a method to get away with murder isn't a big deal because no one ever bothers to do it; if someone hates you enough to kill you, you're probably not going to go in their private home.

Re:Accountability

[shutdown -p now]

There were other witnesses whose testimony contradicts Zimmerman's story. And lacerations etc would still be consistent with Zimmerman pulling the gun and verbally assaulting Martin, who, upon seeing the gun pointed at him, may have decided to fight for his life (which is perfectly legal - SYG applies when you're unarmed, too), and got shot in the process.

Re:Accountability

[shutdown -p now]

SYG is not about shooting someone to defend your stuff - that's illegal in an of itself. E.g. if the thief pickpockets your wallet and starts running away and you notice him, it is not legal to shoot him on order to stop. SYG only applies where there's imminent threat of bodily harm.

However, there are certain crimes - such as burglary or robbery - which are assumed to carry an inherent threat of bodily harm, and so anyone in the process of committing such a crime is a fair target - not because they're stealing someone's stuff, but because it is considered highly likely that they might hurt someone in the process. I mean, seriously, if a guy breaks into your house in the middle of the night, are you going to ask him if he's just here for your TV?

Re:Accountability

[Rakarra]

The cops who didn't throw Zimmerman into a holding cell right away obviously thought that it happened this way, that Zimmerman was protected with that 'Stand your ground' law, that it was self defence.

The correction I would make is that "Stand Your Ground" has no bearing on this case, despite everyone talking about it. When you get jumped and are getting beaten, then shooting your attacker falls under regular self-defense laws, and would apply whether the Stand Your Ground law was in place or not.

Re:Accountability

[dgatwood]

This could be necessary medical equipment, or even clothes in a suitably exposed setting. Stealing that property is tantamount to murder, since it will directly cause the death of its former owner.

If another copy of said equipment is available, then no death occurs, so the only reason you are perceiving the property as being valuable is because of the circumstances under which it was obtained. By stealing it, you cause someone to die, which makes you guilty of killing that person. That secondary crime, caused by the act of committing the first crime, is a large crime. However, the value of the item itself is still less than the value of a human life. For a slightly more illustrative example, if you are dying of hunger, a loaf of bread is still not more valuable than your life. If someone were going to kill you over it, you are better off starving and trying your luck at finding other food than dying immediately (and still losing the food). And more to the point, if the loaf of bread were more valuable than your life, you would be better off keeping the bread rather than consuming it to save your life. Clearly this is not the case.

If you believe that no property is worth more than a human life, then why don't you give away everything you own towards the cause of saving lives? If you refuse to do so, then you are valuing your property more than human lives.

That's a flawed argument. First, if I give away everything I have, I will likely die of exposure and hunger, therefore what you are essentially saying is that I should give my life to maybe save other people's lives. Second, there's no guarantee that even if I did so, even one other life would be saved.

Re:Accountability

[toddestan]

That's a flawed argument. First, if I give away everything I have, I will likely die of exposure and hunger, therefore what you are essentially saying is that I should give my life to maybe save other people's lives. Second, there's no guarantee that even if I did so, even one other life would be saved.

As the poster said, that's an extreme. But you could take the money you spend on luxuries you don't need to survive (video games, cable TV, smart phone, whatever) in and donate it to a cause that will use the money towards saving lives.

Re:Accountability

[Mana Mana]

Man! You're a badass in a teacup, in your hypothetical state. Come to NYC, here you can't own a gun without submitting to police supplication, to a police inquisition, to a police in vivo interrogation, to a police life-excavation, to a police fee application of several hundred dollars, to a police mandated ~1 year anticipation on whether a non-concealed gun permit assignation will be your reward for being so patient. Fuck them!

Re:Accountability

[CexpTretical]

People with little or no property do not care about property rights. And then groups of opportunists come along and tell them that they should take from those that have instead of working for it themselves. The scheme is as old as civilization, use the masses to do our biding by inciting them to take from those that have, pass it to us, and we will distribute equitably with a little extra for ourselves for their trouble since some pigs are more equal than others.

less risk?

[Anonymous Coward]

but we can still remove java and have less risk right ?

Re:less risk?

[Tough Love]

but we can still remove java and have less risk right ?

Indeed. I will have to disagree with "security advisor Roger Grimes" and point out that complexity breeds bugs; bugs breed security holes; Java's JIT and supporting libraries are just way too complex for their own good. This problem is made way more severe by Java's closed development model.

Java can be made secure, just not any time soon, not until Oracle gets a clue and opens up the development process.

Re:less risk?

[errandum]

You can also not use windows and opt for linux. But is it worth it? For some, yes, I'd say that for most people it isn't.

Java runs some cool software that most have no idea it actually is Java (it can copy the look and feel of your OS). The only way to mostly fix java is to have chrome like updates. Silent, forced on you but safe.

Re:less risk?

[DarwinSurvivor]

Or a package manager that keeps ALL your software up to date like Linux has had for years!

Re:less risk?

[happymellon]

Package managers are not a silver bullet, because it still requires a diligent maintainer. There are plenty of software packages for the various distros, which are older versions. Running the update mechanism won't fix that.

Re:less risk?

[Anonymous Coward]

No it won't. Since Oracle pulled the license there is nobody left to update Java.
And no, OpenJDK doesn't count since it works with far too few Java prpgrams.

Re:less risk?

[errandum]

Package managers still require you to manually click them and update.

Windows update is the worst kind of nagware and I've seen people not updating windows for months in a row (and the more time went by, the less likely it would be for them to update). Unless it is silent, automatic and in the background, it won't happen.

Re:less risk?

[Kalriath]

Also, OpenJDK is on some seriously shaky legal ground unless Google can overturn the Android copyright infringement ruling.

Re:less risk?

[characterZer0]

OpenJDK6 has some issues, but OpenJDK7 is the reference implementation.

Re:less risk?

[owlstead]

Humbug. The article even says there are few zero day exploits in there. Real security issues are fixed in orderly fashion (well, mostly, nothing's perfect).

And look at the other option: implementing it yourself. Do you think that companies performing all the memory management and security implementations would be doing a better job? Less visible maybe, but I'm pretty sure that the relatively few bugs that affect Java deployments weigh up against that? My bet (and my experience with "seasoned C++ programmers") says that they don't.

Java is doing pretty well regarding security. Yes, it could still be a *lot* better, but I think it does pretty well compared with most other languages or web frameworks. Or do you have a better alternative?

Re:less risk?

[dgatwood]

And look at the other option: implementing it yourself. Do you think that companies performing all the memory management and security implementations would be doing a better job? Less visible maybe, but I'm pretty sure that the relatively few bugs that affect Java deployments weigh up against that? My bet (and my experience with "seasoned C++ programmers") says that they don't.

That's not the other option. The other option is using services that the OS or browser provides.

For application programming, Java is a giant abstraction layer that may provides a benefit in terms of being able to write once and run (debug) everywhere, but the OS provides most of those services in some form underneath you already. If you use them directly, you're cutting out a huge layer of bloat with a huge layer of complexity and replacing it, generally speaking, with much simpler code specific to your app. This means that A. the amount of code is less, which usually means fewer bugs, and B. the code is specific to your app, and thus a much less tempting attack surface.

And in the browser, things like Java and Flash make even less sense. The browser already provides a built-in programming environment and runtime, complete with garbage collection, etc. You're just adding a second runtime environment, and the flexibility this gives you comes at the expense of a huge increase in total systemic complexity. Remember that the attack surface of a web browser, at least where compromising the user's system is concerned, is the browser's native code itself. The web frameworks are irrelevant because anyone in control of a malicious page can add any web framework that they want to add in order to achieve the desired goal; your site's choice of web frameworks affects only the security of your site, not the security of the user's machine. However, by adding Java applets (and thus forcing the user to enable Java support), you're effectively forcing the browser to increase the size of its native code by a large margin, and thus increasing the browser's potential attack surface dramatically. By definition, doing so can only result in a reduction in security, never an improvement.

Re:less risk?

[owlstead]

The Java API is generally considered a very well written and documented API. Many functions are not directly present from an OS. Stating that the OS functions are easier to program against is certainly - well, actually just wrong. Generally they are much more complex and much less documented than the Java API. The tool support tends to be much worse too, with a steep learning curve (in general), never mind trying to compile for another platform with different libraries and drivers.

I'm not a big fan of using Java or Flash in web browsers, although I think the access controlled Java is at least a lot less vulnerable - if updated from time to time - than flash. Unfortunately, it is also pretty shitty for web applications/games compared with flash.

Re:less risk?

[DarwinSurvivor]

Almost all distributions have an option for automatic updates (you can select from auto-download or auto-install) and the rest can be done using cron (those are usually more advanced distros anyways such as arch). In fact many novice-level distributions (where this would be an issue) have automatic updates set by default (or at the very least a prominent notice telling you they are now available).

Package managers only require manually clicking them to update if you set them up that way.

Can't stop crims, can fix holes

[Anonymous Coward]

He may be right, but he's also totally unrealistic. Nothing you ever do will stop the "underlying problem". But we can fix security holes, and pressure companies to release more secure code.

No point hoping for what is "right", or "best". Aim for something realistic instead.

Re:Can't stop crims, can fix holes

[jhoegl]

seems more like he is building a case for rules to govern the internet, justifying "big brother" tactics, and random stealing of servers from server racks by the FBI.

Re:Can't stop crims, can fix holes

[ChunderDownunder]

'We' can't do anything to fix security holes in "Java", unfortunately.

Only core virtual machine and class libraries have been released under the GPL + Classpath Exception. The installer, auto updater, javafx, java web start, browser plugin are proprietary Oracle.

OpenJDK might be free but Java (TM) isn't. My bet, [citation needed], is that many of these Java security holes occur in unreleased code.

Re:Can't stop crims, can fix holes

[icebike]

You are right of course.

Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. With a few thousand more eyes on that source code its quite possible it could be much more secure than it is now, especially since Grimes himself points out it was originally designed with security in mind. But as long as vendors and bloggers can claim that popular platforms fall to attack simply because they are popular, we will never see much pressure for improvement.

Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed.

The idea that we will ship code, vetted by nobody in particular, for execution on some remote machine, and then expect a software sandbox to contain that code successfully, forever, with zero maintenance is just begging for trouble. To do so without publicly vetting the platform in all of its details is foolish.

Re:Can't stop crims, can fix holes

[sjames]

Really, both are necessary. If you leave your front door wide open while you go on vacation, you'll be robbed. If you put in a steel door and door frame, bars, etc but the police just smile and wave to the nice man with the cutting torch, you will be robbed.

"The authorities" seem to be pretty good at persecuting^wprosecuting 13 year old "uber hackers" but somehow can't seem to see the urgency in chasing after the less dangerous to society entities such as the Russian Mafia.

Re:Can't stop crims, can fix holes

[msobkow]

We could spin accountability around and provide people and companies absolutely no insurance coverage nor liability when they have a break-in due to out-of-date software. You'd have to provide an exemption for those who can prove they couldn't upgrade, transferring the liability to the software providers who aren't keeping up to date.

But we'll never be able to do anything to completely prevent attacks, force people to be responsible about upgrades, nor to ensure there are never any holes in software in the first place. Software defects are a fact of life.

Re:Can't stop crims, can fix holes

[Anonymous Coward]

"Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed."

    Or employ the Goldfinger option. Drop a Nuke on Oracle, and another on on Microsoft just for giggles, and thus make all your alternate code much more valuable.

Re:Can't stop crims, can fix holes

[Shoten]

You are right of course.

Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. .

Here, you hit the nail on the head...but it isn't about open- versus closed-source. It's about the real problem...patching. Most exploitation involves Flash, Java or Adobe Reader vulnerabilities largely because these don't get patched as easily. Microsoft became the gold standard in patch deployment over the past several years, and as a result the time in which a Microsoft-based vulnerability can be counted on to produce botted host after botted host from a compromised website is far shorter. On the other hand, Java and Adobe both tend to lag a bit in their patching, and their systems rely upon a reboot to even look for the latest version. When Microsoft pushes a patch, within 24-36 hours I usually have it installed. I don't know how long it takes between when the latest Java engine is out and when I happen to reboot and, once my machine comes back up...ah, look! A new Java version!

Criminals will always exist, and they will go after the easier targets. Vulnerabilities will always exist. The key is to patch the vulnerabilities quickly enough and frequently enough that criminals look for lower-hanging fruit.

Re:Can't stop crims, can fix holes

[colinrichardday]

Can we get Odd Job to throw his hat at Larry Ellison?

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Microsoft became the gold standard in patch deployment over the past several years

I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again. Until then all the Linux users will just shake their heads at your ignorance.

Re:Can't stop crims, can fix holes

[Grishnakh]

There's a few differences. First, it's fully possible to make a "door" on your computer that really is extremely difficult to open, sort of like a steel door made with a special kind of steel that requires 100 years with a cutting torch to open. This can be done by writing very secure code.

Secondly, the police can't do anything about criminals located in other countries. What are the police going to do about a Nigerian or Russian hacker trying to break your system? Nothing. Laws are only effective inside a country, and in more extreme cases between countries with extradition treaties (where the crime has to be sufficiently grievous for prosecutors to bother with going through all the expense and hassle of an extradition). So on the internet, the only rational thing to do is build yourself a better "door". Complaining about the police not "chasing after" the Russian Mafia makes no sense; your local police have no jurisdiction in Russia, and that country is so corrupt that pursuing diplomatic channels isn't going to get your anywhere either.

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Apt, yum, pacman, etc are all used by thousands of users to update and patch their systems every day. What more could you possibly want?

Re:Can't stop crims, can fix holes

[DigiShaman]

Excuse me! If MS ever pulled a stunt like that, it would be published on Slashdot with thousands of readers keel hauling Microsoft for pulling a reckless stunt like that! Microsoft has no business nor responsibility for patching a 3rd party application that may break existing functionality. Not even Apple does this in their walled garden. At least not to my knowledge as a MacBook user myself.

I wouldn't mind if Microsoft provided warnings and notifications to users to seek out their respective 3rd party vendor for updates. But to actually hold Microsoft accountable for updating someone elses applications is ludicrous! No wonder shit breaks under Linux when an update rolls along. In fact aside from a hardware failure, 99% of the Linux horror stories involves updates breaking shit. That update policy sucks ass!

Re:Can't stop crims, can fix holes

[Shoten]

They can. It's called Systems Management Server. And it works. The reason Microsoft doesn't do it for free is because then they have to deal with all the headaches of any oddness of the software or installer. Oh, and they would also be paying for the integration and deployment costs too. This is not what businesses do for free.

Re:Can't stop crims, can fix holes

[drkstr1]

What is stopping people from writing similar software for windows? This is not an engineering problem. Those repositories exist because someone was able to convince a bunch of developers to publish their work on it. The programming is trivial.

Re:Can't stop crims, can fix holes

[sjames]

Again, we've been known to bend over backwards to get our laws imposed on people in other countries when the FBI's lords and masters (the *AA) want them to. Perhaps they should use some of that to go after actual criminals rather than autistic UFO nuts and Megaupload.

Most of the Nigerian scams could be handled by insisting that U.S. banks clear checks once and for all with foreign banks (as in no take backs) before they claim that a check has cleared. That won't help people who are determined to be ripped off, but it will help a lot of people. "Identity theft" could be killed dead by making banks take responsibility when they hand wads of cash over to strangers and letting credit agencies know that if they continue repeating gossip and hearsay as if it was somehow verified information, they WILL be on the hook for libel.

Re:Can't stop crims, can fix holes

[sjames]

Sorry about the double reply, but I just saw a perfect example. Completely within U.S. jurisdiction. Made $20M, paid $100K fine. I guess we showed them!

Re:Can't stop crims, can fix holes

[Dr_Barnowl]

OpenJDK 7 is now the reference implementation, including the Java plugin.

I'm not sure whether the Oracle version still contains secret sauce, but I wouldn't be surprised.

Re:Can't stop crims, can fix holes

[Jeremi]

"The authorities" [...] can't seem to see the urgency in chasing after the less dangerous to society entities such as the Russian Mafia.

There's a bit of jurisdiction issue there, unless you are referring to the Russian authorities... who are probably getting paid more by the Russian Mafia than they are by the Russian government. :^(

Re:Can't stop crims, can fix holes

[cbope]

You obviously do not understand the *nix updating process. In a vast majority of cases, it's not the OS vendor patching other software. The patches/updates are created and submitted by the owners (or more likely, maintainers) of the software that needs patching/updating. The patches/updates are pushed to the various distribution servers and are pulled in using a common updater process depending on the OS in question such as yum, apt, etc.

Yes, from time to time something breaks but that is pretty rare in my experience. MS has broken plenty of stuff from time to time with their updates, so what you propose does not prevent something from being broken and only keeps an additional hole open and available for attackers.

Re:Can't stop crims, can fix holes

[ChunderDownunder]

I don't see that announcement includes the Java Plugin.

the Sun JDK contained quite a few features that were not part of the standard, such as the Java Plugin

I take that to read that the OpenJDK as the new reference implementation excludes features not part of the standard - NOT that Oracle has since added the Plugin to the OpenJDK open source project.
Certainly it was never the case and folks from Red Hat substituted IcedTea components for the plugin and javaws.
Further, the release notes for Oracle JRE 7x4 mention command line options to launch 'secret sauce' such as javafx and special hooks into proprietary JRockit/Weblogic features.

Re:Can't stop crims, can fix holes

[sjames]

Tell that to Kim Dotcom and Gary McKinnon!

Meanwhile, not all Russian Mafia is in Russia, some are in the U.S.

Re:Can't stop crims, can fix holes

[Kalriath]

It's actually called System Center Configuration Manager. But WSUS (Windows Server Update Services) can also update third party software if you configure it correctly (may require third party addons though).

Re:Can't stop crims, can fix holes

[cerberusss]

Not even Apple does this in their walled garden.

I'd say that Apple does exactly that with the Mac App Store.

Re:Can't stop crims, can fix holes

[Kjella]

I agree, but I'm rather surprised there isn't a software update infrastructure where applications register themselves so you can easily see the status of all your software. Each application would still provide their own updates, digitally signed with a key that was stored when you installed it of course. You install $foo 1.0, it registers the update URL http://foo.com/updates.xml and it'll be signed with $foo's key. The XML contains something like "Version: 1.1, installer: http://foo.com/$foo1.1-installer.exe" that is run provided the signature is good.

You'd probably want to work a little on the format of that XML since some software has multiple supported versions like 3.0.2 and 2.7.2 and you want to able to pull in a security update 2.7.3 without upgrading to the latest version. You probably want a support status like "Latest version", "Maintained version", "Extended support", "Unsupported version" etc. and if there's a new versions you have to pay for then a link to the store. To me this seems a natural extension to the add/remove software list in the control panel. The add/update/remove list...

Re:Can't stop crims, can fix holes

[umghhh]

in some cases when change in quantity turns into change in quality of the situation some more robust action may be needed. In other words it is no point of fixing the small whole in the wall if the whole construction is about to fall on you.

Re:Can't stop crims, can fix holes

[arth1]

What is stopping people from writing similar software for windows? This is not an engineering problem. Those repositories exist because someone was able to convince a bunch of developers to publish their work on it. The programming is trivial.

What's stopping them is getting it distributed. Unless you have the package manager system in place, you can't push it.

Re:Can't stop crims, can fix holes

[arth1]

I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again.

Um, it can, and it does. It often tries to install old outdated nVidia drivers on my systems...

The problem with Windows Update is that there is no sane or timely way for producers of other software to get a patch in. And when they do, by the time the patch becomes available through Windows Update, it's already going to be several versions behind.

Re:Can't stop crims, can fix holes

[micheas]

While in theory the programming may be trivial, in practice the QA is far from trivial.

How do you convince Adobe that they need to conform to you packagemanager?

Re:Can't stop crims, can fix holes

[KlomDark]

"Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed."

You aren't going to succeed because all the money in Fort Knox has been gone for decades.

Either the Annunaki have harvested it, or mistaken for tungsten and made into light bulbs. Dominique Strauss-Kahn was jailed and humiliated simply because he discovered it was gone...

Re:Can't stop crims, can fix holes

[SQLGuru]

I like the way Apps on my Windows Phone get updated. I suspect with Windows 8 and the marketplace there, it will be similar. When the developer pushes out a fix, I get a notification and I can install it if/when I choose.

Re:Can't stop crims, can fix holes

[tibman]

mmm, i read the second link and some of the sub-links. It's some way out there conspiracy theory stuff. The cia (always former or rogue) seems to popup all the time to keep the story moving along.

Re:Can't stop crims, can fix holes

[dgatwood]

Why would Adobe need to conform to anything? An ideal automatic update system would involve the application, upon first launch, registering for update support. By registering, it would provide a URL to an RSS feed. If it uses the standard system package format, this is all that it would need to do; if it uses its own package format or if its installation requires some additional hand-holding, the registration request could provide an optional helper (as part of the app bundle or whatever) that knows how to install the update.

When the RSS feed shows an update, the update manager asks the user if they want to install the update. If the user says yes, the update manager runs the tool that Adobe provided when its app registered for updates, and that tool takes whatever arbitrary binary blobs were attached to the RSS feed entry and does whatever it needs to do to extract them.

Re:Can't stop crims, can fix holes

[micheas]

So everyone runs their own updater? How is that different that what happens today? Ok, there is one screen, but all the updaters have to becareful not to step on each others toes when doing reboots, killing processes, etc.

The little update icon in the task bar is close enough to what you are asking for.

Re:Can't stop crims, can fix holes

[drkstr1]

This was exactly my point (granted, I suppose an unanswered rhetorical question is not the best way to make a point).

The problem is not an engineering one, it's a political one. The development eco system in Linux is much more conducive to a repo than the windows eco system. Developers of proprietary windows apps are used to having full control over their application's deployment, and I think it would be difficult to get them to change, short of an Apple-esque ban hammer on apps loaded from outside a centrally controlled repo. OSx Isn't there yet, but it seems like that's the direction they're going. iOS is already there. I don't know if that's necessarily a good thing.

Re:Can't stop crims, can fix holes

[Zaelath]

Was this modded up so we could laugh at it?

Re:Can't stop crims, can fix holes

[dgatwood]

No, no one runs their own updater. Some vendors may run their own update installer. This means:

• One user policy governs the frequency of checks, not one policy per app.
• The app can be updated even if the user infrequently runs the app (without adding a bunch of timed jobs that randomly piss off the user).
• Developers who do not already have an update mechanism would not need to create one.

As for updaters killing processes or doing reboots, that could easily be part of the check-in mechanism. The installer would be allowed to kill and relaunch daemons that it owns; if it needs to restart a daemon that it does not own, a message requesting such a restart would need to be part of the protocol, but this shouldn't be a common occurrence.

As for reboots, When finished, each installer would report back to the actual software update app to indicate completion. When the last installer finishes installing, if any of the RSS feed entries indicated that a reboot is needed, the main updater application would handle that. Otherwise, it would check for additional updates, and quit if there aren't any.

Re:Can't stop crims, can fix holes

[uninformedLuddite]

Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security.

You don't really believe that there's anything more than gold plated titanium(if that) in Forty Knox do you?

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Actually, open source is in no way a requirement for package managers. Most package managers handle pre-compiled binary packages just fine. In fact, accessing source files is usually an *extra* feature of the package managers. Most distributions perform the compiling themselves for all the open-source software (to ensure sane compile flags and lack of excessive warnings), but even ubuntu distributes various closed-source packages in their official repositories (flash, etc).

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Sorry, I should have been more specific. I was mostly talking about 3rd party applications (firefox, autocadd, WOW, etc) and libraries (QT, OpenGL, etc) not drivers (which Microsoft usually signs anyways).

The other problem

[MrEricSir]

Security is one problem -- the other being that you'll get sued for using it. Just ask Microsoft and Google.

Re:The other problem

[Anonymous Coward]

Nobody got sued for using Java. Microsoft got sued because they called something that wasn't Java Java. Google got sued because they used the elements of Java, but not Java itself.

Re:The other problem

[binarylarry]

Google got sued because they made a lot of money selling a Java platform to consumers.

Which Oracle/Sun failed horribly for years at doing. (Java ME anyone?)

Fuck Oracle!

Re:The other problem

[marcosdumay]

To be fair, Google also didn't get much money selling it. They got nearly all the money from searches.

On nearly all cases, Android is free. The only exceptions are when it comes bundled with a Google product.

Re:The other problem

[Dr Herbert West]

These posts bear a startling similarity to some of the work of the late, great Michael Kristopeit, whose shadow you would probably cower under.

You're completely pathetic.



That was fun, let's do it again sometime.

Re:The other problem

[caywen]

Don't know who's right, but I do know that the Android developers I know basically call it Java. "Hey, how do you program apps for Android?" Answer is usually: "It's Java." "What's Dalvik?" Answer: "Oh, it's Google's own Java VM that runs on handsets."

Really. Programmers call it what it is.

Trying to get developers to get developers to differentiate between the Java platform and Java the language is asking us to put on legal hats that we don't want to wear.

And please don't misread this post. This isn't meant to at all say that what Google is doing is illegal. Just that when you make something that looks like A, acts like A, people tend to call it A, even though you tried to call it B.

Re:The other problem

[shutdown -p now]

You can compile Java to .NET bytecode with IKVM - does it mean that .NET is Java?

Re:The other problem

[binarylarry]

Does that magically make the .NET platform based around the Java language, Java's tooling and the greater set of Java's libraries (stdlib and beyond)?

If so, genius, you have your answer! Yay!

Re:The other problem

[tibman]

I judge in your favor and award you this point.

This is a stupid article

[rgbrenner]

Java isn't insecure, criminals just aren't being punished.

That applies to EVERY piece of software. Why should Java get a free pass?

Re:This is a stupid article

[mark-t]

Why not? Or rather, why pick on Java when every other piece of software has its own problems? The primary problem isn't the software... it never has been. The major attack vector for such malware has always been users who are not practicing diligence in being informed about what packages their computer is really running, when and where to get the latest security updates on software that they require, and whether or not some other programs should ever even be there.

Re:This is a stupid article

[rgbrenner]

Users not installing patches has been an issue for as long as I can remember. That is why we have Windows Update, Mac Software Update, RHN, etc.

So it's a problem with an obvious solution: add an auto-update feature to the JRE and enable it by default on desktops.

Refusing to implement a time-tested solution does not allow them to wash their hands of the problem.

Re:This is a stupid article

[GIL_Dude]

Well, in the enterprise space you have a huge catch-22. I deal with this at work all the time. Since Oracle / Sun Java doesn't actually do patches (they just do full versions that introduce new features, break existing code, and deprecate other features), you can't deploy it. You have this trade off of known security vulnerabilities vs. enterprise software that won't work with the new versions. You have banks that require you to run Java versions that are a year old in order to move money. You have vendors whose code won't work with the current version of Java - ever (since they take longer to get their code working on new versions that it takes Oracle to release the next new version). We try as hard as we can to get app owners to test - but every last time we ship a new Java versions apps come out of the woodwork with emergency requests to "stop the push". You can't win. Bust people's critical apps and you lose. Allow machines to get owned by insecure versions of Java? Yeah, you lose there too. Oracle needs to figure out how to do security patches that just fix the vulnerabilities and don't introduce (and remove) features. Until they can do that - yes, it is their fault.

Re:This is a stupid article

[Sarten-X]

You mean the "java update" icon in the taskbar? The one that wants to update every few months?

Yeah, I ignore it, too... It seems every update is a few hundred megabytes, and I don't really want to pay attention to it long enough to tell it to install, then come back to follow up on it. Between all of the "time-tested" self-updaters for Windows, Adobe, Apple, Google, and a dozen more I could track down if I cared to, I'm sick of the whole self-updating thing. Why the hell don't we use RSS (or equivalent) for this yet, and be able to group all the updates together in a single interface, with a single "update now" button?

I guess that'll still be a Linux-only thing for another decade or so...

Re:This is a stupid article

[Tharsman]

This article was brought to you by your friendly neighbor Oracle!

Re:This is a stupid article

[Anonymous Coward]

I'm unaware of any JVM since at least 1.3 that failed to execute code correctly that was compiled for an earlier release. Yes, the migration from 1.0 through 1.1 and up to 1.2 was problematic, but after that there was no backward compatibility issues that I am aware of. What's your excuse for using an old JVM again?

Re:This is a stupid article

[Tharsman]

I pick the same way on all third party run-time environments. Flash, Silverlight, Java, heck the browsers get a bit of slack because:

1) They get updated very often
2) I would be a Luddite if I don't have at lest one installed.

I don't need third party run-times. Java is not on my system anymore. Nor is Flash. Thanks to the wonders of standardization (sarcasm), every time a website requires flash I launch it on my phone to get a standard HTML version that does not.

Re:This is a stupid article

[PCM2]

Yeah, I think the bigger problem is that the updates are weird. It's been a while since I've had Java installed on my main machines, but the way I remember it, you'd end up with a long list of updates in your Programs and Settings panel, even when they all have the same major version number. Like... you could keep Java 1.6.19 even when you uninstalled Java 1.6.12. And they don't seem to be patches, either... like, each one adds another 350MB subdirectory to some folder in your system disk, and they all just sit there like turds.

Then there was the time Oracle tried to bundle a McAfee "security scan" in the Java updates. That really inspired confidence. "Hey, I know -- let's interrupt this vital security procedure to push crapware from our marketing partners."

No, I think Roger Grimes is wrong -- folks can and will uninstall Java. I've been avoiding it just fine, and those bespoke Java applications that we're told all these Fortune 500 companies are sitting on will eventually be replaced with Web applications.

(None of this is to say Java doesn't have a strong future in the datacenter, though.)

Re:This is a stupid article

[elfprince13]

OS X has the App Store, which is moving heavily in that direction...

Re:This is a stupid article

[SplashMyBandit]

FYI: The Oracle/OpenJDK JRE is around 14 MB. There is no real excuse for not keeping it up to date, especially when Java Update prompts you to update when there are remote-exploits on your platform. All you have to do for Java is click "Ok" once and let the damn thing update - how hard could that be?

Re:This is a stupid article

[Anonymous Coward]

In Apple's case, they had a perfectly good update mechanism, they just never released the patch.

Re:This is a stupid article

[mlts]

Don't forget the toolbar that usually wants to come for the ride, so one has to be very careful when clicking on the Java update icon, or else one's Web browser may have a little companion with it...

Yes, it is removable, but a security update shouldn't come with crapware.

I wish Oracle would start looking for the future. Java is a gem, but eventually it will be passed up for existing solutions (C#, Flash, HTML5 on the client end, ASP on the server end) unless Oracle does something.

For example, Java updates on Windows should automatically use MS installer files and if the user sets the option, checks the update server, fetches the MSI/MSP file, makes sure the signature is intact, and go from there. If a JVM is open, prompt the user to close it, then kill all active processes.

Yes, it would cost Oracle something for development and packaging, but they really should look long term -- Java has a lot of advantages, from being able to be used in embedded controllers, to being good sandboxes for apps (assuming proper security testing is done.)

Maybe Oracle can actually expand Java. Oracle owns silicon, so why not make a processor that is designed from the ground up for Java bytecode? Perhaps even build it into the SPARC architecture [1].

It may not be short term good, but long-term, if Oracle kept maintaining Java and kept it relevant to both consumers and IT departments, they will make money in the long run.

[1]: Of course, there are issues, but having Java be able to natively execute in hardware would help things server-side.

Re:This is a stupid article

[Nimey]

One of our old packages required Java 1.5 to execute certain Crystal Reports queries but would otherwise function, and there's one still in use elsewhere that requires JVM 1.4_03 and nothing else; not _02 or _04; it will refuse to run with anything else.

Re:This is a stupid article

[jackbird]

A ninite.com auto-installer will continue to grab and install the latest version of whatever it's set for - just keep the icon around instead of trashing it at the end of your system build.

Re:This is a stupid article

[Anonymous Coward]

IBM's java-based remote console for their blade center. The older version (black/white interface) required java 1.4 or something like that. If you had 1.5 or 1.6 you'd get problems with the drop down menus being empty and such.

They fixed this in the newer AMM though (blue/white interface).

Write once, run anywhere.. my ass...

Re:This is a stupid article

[Billly Gates]

It is not insecure at all. Perfect solution is here! Many IT departments are lazy, overworked, or are incompetent to the point that they have no clue old java is bad. Here is a way to never get hacked by java exploits again

Steps:
1. Only use IE and setup zones with a group policy. I know the Internet Explorer haters will want to mod me down faster than goatse but there is a good reason in my other steps if you read 2 $& 3 before modding me down.
2. Disable Java on the internet zone and enable only in the intranet and custom zones.
3. Add Bank of America, Royal Canada, ADP, etc, and other financial institutions or HR processing sites that require ancient java and probably IE 6 & 7 to the custom zone for java.

Optional
4. If the browser requirement sucks use Chrome for regular browsing that has GPO and doesn't support java at all. Or have IT put a script for FireFox that has java disabled by default if you have a really old version of IE that can't be updated. IE 9 is decent and modern and IE 8 is ok. It is only IE 6 that sucks and if your employer uses that then BOY Java is the last of your security problems.

Done. Java no longer a security threat. The last time I used java was in 2001 for some java chatrooms. I have never seen it in action besides for a few JavaFX demos on Sun's old website. No one needs at besides corporate intranet/banking websites.

I use Java unfortunately as I love Netbeans as a GUI and recommend it to slashdotters. I also have the Android SDK with Eclipse and I just do not have it in my browser on purpose. Java was so awesome 10 years ago and bad management ruined it and pains me to even write such a post. With proper IT procedures you can still use the older stuff fine and every single client site I have been to does not do this and it boggles my mind.

Re:This is a stupid article

[dumael]

> Maybe Oracle can actually expand Java. Oracle owns silicon, so why not make a processor that is designed from the ground up for Java bytecode? Perhaps even build it into the SPARC architecture . ARM tried it with Jazelle in earlier cores which they've replaced with the ThumbEE and successor. JIT compilers (and in ARM's case simpler+compact instructions) seem to have been more economical than implementing a (partial) second instruction set in a processor and requiring to be at least as fast the JIT competition.

Re:This is a stupid article

[knorthern knight]

> Write once, run anywhere.. my ass...

Write once, write anywhere... that has Java 1.2.3.4.5 installed. Not 1.2.3.4.4 or 1.2.3.4.6. It *MUST* be 1.2.3.4.5.

That's Java's main problem. Back in the days of DOS, a BAT or COM or EXE file that worked on DOS 1 would work on DOS 2 and 3 and 4 and 5 and 6, unless it did some really braindead version checking. The vast majority of Windows apps survive service pack security updates. But many Java apps seem to break with each sub-minor version bump.

Re:This is a stupid article

[Grishnakh]

Step 3 sucks. I have a better idea: don't bank with Bank of America.

Re:This is a stupid article

[jbolden]

Why the hell don't we use RSS (or equivalent) for this yet, and be able to group all the updates together in a single interface, with a single "update now" button?

Remember to make this comment next time you hear people complaining about the Linux distribution centered model for software. In any case Apple is moving towards this with the App store.

Re:This is a stupid article

[jbolden]

First off it sounds like you can't have a central Java policy but rather need multiple Java's that are department specific.

Oracle needs to figure out how to do security patches that just fix the vulnerabilities and don't introduce (and remove) features.

There are two things here:

1) Bug for bug compatible. Which is something that enterprises want but in general most software vendors don't want to provide.
2) Minor vs. major vs. bug fix version numbers, which I wish people would go back to.

Re:This is a stupid article

[Belial6]

Java on silicon was Sun's original plan. They announced the JavaOne processor long before the JavaOne conference. It turned out that emulating java on x86 was faster than running java natively.

Re:This is a stupid article

[Billly Gates]

I am referring to corporations who still use Java. Average Joe's should disable it.

Bank of America is very nice and great to work for if you have money if you are a millionaire or a large corporation. They will rob you and I blind and treat us like cattle as they view anyone who is not wealthy a risk and a target to prey upon.

With lines of credit it is not an option to be picky if you are a business. Profits do not pay your paycheck. Its credit as cash belongs to the shareholders so it can raise the stock price which is the ultimate goal of the company. Not to make money.

Re:This is a stupid article

[PCM2]

Bank of America doesn't use Java. I bank with them and I don't even have Java installed. They have a second-factor authentication app on their online banking site, but it's implemented in Flash (which a lot of people probably don't want installed either, but at least using the app is optional). And I'm not rich either, and they've never robbed me or "treated me like cattle" -- I don't understand views like that.

Re:This is a stupid article

[Billly Gates]

They robbed me of thousands of dollars. My exwife was 1 day late with a payment and my interest went up to 38%! The second mistake I made with them was a line of credit where I had a guaranteed paycheck waiting but needed money for Christmas. They looked me in the eye as I probbed them for a gotcha. They assured me the 50% interest was only if I did not pay for 1 month. It was literally free!! Hmm ...

I went in 2 weeks later with a check to pay it and they informed I COULD NOT PAY IT! I had to pay all of my exwife's credit bills first. It took 2 years to pay those at 38% interest and 50% more interest on the cash advanced over 2 years created $10,000 of interest fees for $700. MAY THEY BURN IN HELL.

I dumped the wife. :-)

Still, I was not responsible I do admit and we both lost our jobs during the financial crises when this hit and couldn't pay back easily. BOA robbed us both blind. I hate them and view them no different from the mob. I would view Oracle and Microsoft as saints compared to them. Anyway I will never use a credit card again nor a line of credit unless I have some serious cash coming in. I learned my lesson and yes it is my fault so do not blame me on this but where I am from anything above 6% is considered loan sharking. I was the cattle and they made me into their goatse guy.

It should be illegal to charge more than 10% interest. If they did this the economy would be recovering now as debt is the reason it is not recovering with 1 trillion in CCs and another trillion in student loans. ... back to my point. Businesses have different portals than you and I have for lines of credit, acquisitions, and moving money around subsidaries. Java is used for these in offices.

Re:This is a stupid article

[PCM2]

I learned my lesson and yes it is my fault so do not blame me on this but where I am from anything above 6% is considered loan sharking.

I actually have a credit card with an interest rate below 6 percent ... but it sure ain't from BofA. I have one or two of their cards but I literally never use them. I just use them as a bank.

Re:This is a stupid article

[cbope]

Obviously, it has been a while since you installed Java. They fixed the multiple installed version issue some time ago. When a new update comes down, the old one is removed, assuming it is from the same release version (e.g. 1.4 would be left installed since it is a legacy version needed by some apps, but the previous 1.5 version would get removed during the update process to the latest 1.5 release).

Re:This is a stupid article

[eennaarbrak]

Oracle needs to figure out how to do security patches that just fix the vulnerabilities and don't introduce (and remove) features.

AFAIK, the only feature of Java that was ever "removed" was when Sun introduced the assert keyword somewhere around 1.4, breaking existing code that used "assert" as a variable name. This caused so much hassle that Sun (at the time) vowed to never ever do anything like that again. Backwards compatibility has always been (and remains to be) a major concern for the Java language, for better or for worse.

Of course new JDK releases introduce bugs, but in general, my experience is that upgrading your JVM is one of the lower risk undertakings you can do. If you can't even do that in a controlled fashion with acceptable turnaround time (like say a few days from test to deployment), you have to ask yourself about the quality of your release and deployment processes.

Re:This is a stupid article

[Your Average Joe]

Use your Swiss Army Knife...

Time to add more tools to your tool belt. Yes you are going to have to think OUTSIDE the box. Yes you are going to have to use some product other than Microsoft and you are going to have to pay the Enterprise licensing fees. They are really not that bad. VMware View with the ThinApp option.

You make think apps of your web browsers with the version of Java needed and only allow that thin app to work with that one site. You need to have AD and group policies and a license of thin app for every machine. It seems odd that VMware can sell a solution to the problem while Microsoft buries their head in the sand and works on stupid projects like the Surface Coffee Table PC....

And no you cannot use any other OS, you are still tied to Windows with VMware.

Re:This is a stupid article

[Nimey]

Not quite. 1.6 update 7 was the last one before the new regime of uninstalling the old versions when you update to the new, so if you still have any 1.6u7 or earlier they'll be left in place even though you're running the latest version. You have to get rid of the old ones manually.

This process was IIRC never put in place for the 1.5 series, so you're wrong there as well - you'll hang on to all the 1.5s and 1.4s etc. unless you manually remove them.

Re:This is a stupid article

[jackbird]

In a centrally-managed environment, I would hope the admins are pushing down Java patches to the machines already.

Re:This is a stupid article

[msobkow]

People claim new versions of Java break their code all the time, but I've never encountered the issue except when shifting major Java releases (e.g. Running Java 6 SE code on a Java 7 VM.) I've been coding Java since 1.0.

Until I actually encounter the issue myself, I'm inclined to believe the problem is incompetent programmers abusing the API contracts or taking advantage of bugs in the APIs to "save time."

I am primarily concerned with business applications, after all. Typical business applications are not exactly exercising the bleeding edge of technology -- they're usually written by experienced people who use the same tricks and tips they have for several years, and who rely on APIs that are not the "latest and greatest features."

Maybe the problem these companies are having is hiring too many fresh-out-of-school junior programmers who picked up bad habits and design methodologies from their school cohorts rather than a problem with the Java APIs themselves.

The only case where I've found the issue to be valid is complex tool bundles like the Eclipse/Glassfish bundle, and even then, the issue seems to be Eclipse compatability in the stack, not the JVM.

Re:This is a stupid article

[owlstead]

Then you should take a careful look at your source code, because it is *broken*.

Re:This is a stupid article

[Nimey]

HAHAHAHAHAHAHA

What makes you think we have the source for either of those? Vendors don't typically give that unless you pay the big coin.

Re:This is a stupid article

[owlstead]

You should look at another Vendor, because it is *broken*.

Re:This is a stupid article

[Nimey]

Sonny, have you ever done any IT work?

Get off my lawn.

soo..

[Anonymous Coward]

We should legislate away our technical problems?
No thanks. It's been shown time and time again that not only doesn't it work, but it tends to make the technical problems worse.

If everyone thinks "i can just sue them later" them attention to security will drop even farther.

There are very good security systems out there that very few people and organizations bother to implement or continue.

Re:soo..

[Billly Gates]

Actually I think legislation wouldn't be too bad for everyone ... well except the beancounters.

We legislate clunkers with rags for a gas cap due to public safety. XP should have automatically disabled port 80 after its EOL. Old browsers are an issue too as well as flash and java. The issue is always costs and corporations love externalizing things on other other people like having us write IE 6 hacks in 2011 to keeping XP around and costing the insurance and banking industry money from exploits and claims.

Robbing someone is not a technical problem. The issue is no one gives a shit in Russia as the mob is good buddies with Putin and his puppets and they do whatever the hell they want. It should be a crime.

Getting rid of obsolete platforms to the internet would great help and so would prosecution.

Invalid argument...

[wbr1]

We punish drug dealers and users... they keep on pushing and using.
We punish robbers and gangsters... stores get robbed and people gangbanged every day.
We punish rapists and other sex offenders...new ones crop up.
We punish murderers and and wife beaters... people still get killed and wives beaten every day.

Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.
And somehow Grimes thinks that punishing crackers (not hackers.. I am proudly one of those), is going to make a difference. Even if you did manage to snuff it out in one place (highly unlikely), the internet is worldwide and you will have places with less lax laws or corrupt officials where those of a criminal bent can launch whatever they choose.
Most crime (not all)is cause by real or perceived poverty or other social disparity. Spending billions to incarcerate the underprivileged does nothing but further this disparity and create -more- crime.
Try looking at the world with empathy instead of greed and anger and try to lift people up. You may be surprised what a difference it makes.

Re:Invalid argument...

[SCPRedMage]

If I had been drinking something when I had read that line, I'm betting a spit-take would have been the inevitable result.

Re:Invalid argument...

[Concerned Onlooker]

Well, it's not necesarily about deterrence. It's about accountability and keeping a criminal from doing the same thing again. That shouldn't be that hard to figure out.

Re:Invalid argument...

[dkleinsc]

Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.

What is a strong deterrent, though, is a high risk of getting caught. For instance, if you put your criminal justice resources into hiring police, training them to be more effective at tracking down crimes, and building trust with the citizens (so they'll be more likely to volunteer information), that gives you a lot better results than putting your money into keeping people in prison longer for having a bag of weed.

Re:Invalid argument...

[wbr1]

It doesn't work at that either though. Many criminals would like a better life and a better chance, and don't want to make the same mistakes again. Not all, of course there are exceptions. But you take a man, put him in prison for 5 or 10 or 15 years at the prime of his life, give him some opportunities to learn, but most are bogus, and most of what is learned is -more- criminal mentality, and more hatred of -the system-. Then you put him out on the street with strict rules, little money, most of his family and friend have probably deserted him (if he had much to begin with) during his time in prison so he has little if any healthy support systems in place. No add to the fact that everywhere he turns he cannot get a job. If he owes court fines he may not even be able to get a drivers license until he can pay part of his fees, further limiting his chance of employment. Is it any wonder if he goes back to robbing stores or dealing drugs? It is what he knew and all he has left.
And even if you made him a ward of the state forever, now the state has weakened whatever family he had, and made it more likely for others in his family to follow the same path. And there will ALWAYS be more criminals to replace him.
So no, it is not about deterrence. It is not about accountability even. In the United States it is about making victims feel better, and about making money for the government. Bringing in tax dollars through fear.

Re:Invalid argument...

[Anonymous Coward]

Actually, most crime is the result of opportunity, not poverty. It's not so much class psychology or class deprivation (in the Western world real deprivation is uncommon), but that lower income people tend to live in communities where crime is easier because of 1) underfunded enforcement and 2) cheaper targets. Crime is an evolutionary strategy, and there's no reason to think that the genes aren't evenly spread throughout the society, especially considering how the lower and upper classes mix so readily through the generations. Place groups of rich and poor people in a 7-11 with the understanding that there's no surveillance and in fact no repercussions whatsoever (not even peers) if they steal, and the same number of people from each group are likely to shop lift eventually. Others will never shop lift, because they're reciprocity instinct is just too strong, and still others will fall in between.

That's why punishment is ineffective. The supposition held by a perpetrator is that he would not get caught. You don't need harsher penalties (no matter what the economists say); you just need better policing and fewer opportunities (in the software case, safer software).

Re:Invalid argument...

[C3ntaur]

In the United States it is about making victims feel better, and about making money for the privatized prison industry.

FTFY

Re:Invalid argument...

[SnapaJones]

Ridiculous. The government isn't here to permanently injure its own citizens. That is the difference between actual criminals and the government, and that is why we have due process. If the government hurt its own citizens left and right, people would lose faith in it and it would undoubtedly be a government that isn't for the people.

The government punishing someone isn't the same thing as criminals hurting others, and you'd be foolish to argue that.

"It's better that 100 guilty men go free than one innocent man suffer."

As much as possible, I subscribe to that notion. Especially when talking about things such as the death penalty.

Re:Invalid argument...

[PCM2]

There are some countries in the world where the punishment for some crimes is physical torture. It is incredibly painful, and in our western culture, it's considered dehumanizing, but it's worth nothing that those countries don't really have a serious repeat offender problem.

FTFY. I think we've found a solution to America's problems right here.

Re:Invalid argument...

[wbr1]

I agree.. look at my reply to What? below

Re:Invalid argument...

[SnapaJones]

So I guess people shouldn't be imprisoned then either, because they might be innocent?

Again, a stupid argument. Obviously we must, to the best of our abilities, prevent innocents from being imprisoned. But sometimes it will happen anyway. No system is perfect.

But that can be fixed. If we merely imprison someone, they can later be let out (and perhaps somehow compensate them). If we kill them or inflict permanent damage upon them, that absolutely cannot be fixed. There is a difference, and to anyone even trying to argue honestly, that difference should be plainly obvious.

Re:Invalid argument...

[cdrguru]

Why do poor areas have more crime than more affluent ones? Simple: taxes pay police and when there are low, low, low property taxes there is less police activity. Also, affluent areas have alarms, guard dogs, and people that feel they have something to protect. Poor areas have people that think (wrongly) they can't lose anything because they have nothing.

Of course, when a poor person discovers much to their suprise that someone will hold them at knifepoint for $1.46 in change they suddenly realize they might actually have something to lose.

Also, a lot of businesses cater specifically to cash transactions in less affluent areas. Think corner liquor stores - lots of cash in the register, not much in the way of security. Compare this to a well-lighted busy store in a strip mall with a working video system and you can understand why the corner liquor store is the one robbed every week whereas the strip mall location has never had a problem.

It has nothing to do with people's mindset about their being poor. It is all about grabbing something that they want, someone else has and can be made to give it up. It is well known among criminals today that few crimes actually result in jail time. You have much less than a 10% chance of going to jail today no matter what you do. That means unless you are incredibly unlucky you can rob a store or a person four or five times without ever facing any sort of punishment. And to most people in a crime mindset this means they are blessed and can get away with anything forever. Sure, they might get caught after 20-30 crimes but after 10 they are feeling invincible.

Re:Invalid argument...

[DudemanX]

Now who's making a stupid argument? No one is talking about permanent damage. We're talking about turning someone's ass red and making it uncomfortable for them to sit for a few days.

Re:Invalid argument...

[SnapaJones]

I could only assume they were talking about something worse (with that just being an example), since that wouldn't deter crime. In fact, compared to spending time in prison or jail, that would be quite a bit better. At any rate, the person certainly didn't correct any supposed misunderstandings.

Re:Invalid argument...

[Grishnakh]

I'm sorry, I don't see the difference. Imprisoning someone for years inflicts permanent damage on them: it robs them of their lifetime. Moreover, it inflicts mental anguish on them; imprisonment is a form of torture. Here in the US, before we were a country, during Colonial times, it was considered cruel and unusual punishment to lock someone up in a jail cell for any more time than necessary. Hence, they had no prisons; those were considered cruel. They only locked people up before their trials, to keep them from running away or causing more harm, and a swift trial was generally considered a right. If they were found guilty, they were given a punishment that was supposed to fit the crime, and was swift, whether it was execution (usually by hanging, which is normally pretty quick), or branding, or having people throw fruit at them for a day. After the punishment, they were released. It was considered more humane to brand someone than to lock them in a cell for 10 years. Many prisoners serving such sentences today would likely agree.

Just like death or permanent physical damage cannot be fixed, robbing someone of a decade or three of their short time on this Earth also absolutely cannot be fixed, and it is galling that you suggest it can be.

Re:Invalid argument...

[SnapaJones]

It was considered more humane to brand someone than to lock them in a cell for 10 years. Many prisoners serving such sentences today would likely agree.

I don't much care what was considered humane at the time, or how many prisoners would agree.

and it is galling that you suggest it can be.

I didn't suggest that time can be reversed. However, I do believe that death is the worst of them all, with permanent physical damage being second. Permanent physical damage could keep you from doing things you'd normally be able to do (although I'm not aware of the government doing this). Forever.

Re:Invalid argument...

[Belial6]

30 years in prison will also keep you from doing things you'd normally be able to do. Forever.

Re:Invalid argument...

[gl4ss]

and we throw kids in jail for hacking.

the article is invalid reasoning fully, if there's a hole allowing for some shenigans some people will sooner or later exploit it. maybe they're going to jump off a roof anyways so wtf is going to work as deterrent then.

Re:Invalid argument...

[petman]

If I am ever wrongly convicted for something, I would rather get caned and then go free than spent years in prison.

Re:Invalid argument...

[Threni]

Crime in the US:

http://en.wikipedia.org/wiki/Crime_in_the_United_States
http://www.economist.com/node/18775436

etc

story summary != story

[circletimessquare]

Title:

Why Elephants Are Large

Story:

An Elephant's trunk is very flexible. Even more amazing are the flexible snakes in the grass. Click this link to learn all about why bird's eggs are shaped the way they are.

Re:story summary != story

[robot256]

Why is this modded funny? It should be modded insightful. I was thinking the same thing about the summary.

Re:story summary != story

[catmistake]

Every time I read one of your modded up comments I think, "why can't all slashdot comments be like this one?"

Re:story summary != story

[circletimessquare]

thank you

Get away with crime?

[Toe, The]

Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty.

Beloved, this is not being true! I have sure-fire way to stop crimes and makes you not being victims of many internet crimes ever. Alls I needs is your passwords to your accounts, and I makes them very secures. Especially yours banks passwords accounts numbers, I very much promising. I extra interested if you been scammed before. I help most much.

To show I most sincere, I also give you free 500 Viagra pills extra-effective man-stick for your every account you wants me protect! Your woman moan against your amazing he umbrella many time.

The problem of accountability

[c0lo]

They (cyber criminals) almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.

Hang on... what about the accountability of the software producer? Oh, yeah, the DISCLAIMER in the copyright/license legalese... it passes the responsibility to deal with the effects to the users. So why are the users complaining?

Before you jump on my throat: I reckon the "social cost" of going after hackers would be higher than the cost of the "war on drugs" (even if only because a running software is intangible and the attack vectors are easier to anonymize).
Even more, the "cost of discovering/deterring/preventing the cyber criminals" will be supported from taxes, even if the bug allowing the exploited is caused by the software producer... feels like a great incentive to reduce the cost of quality assurance stages in a software project, by externalizing them to the society... that's what corporations are excellent at, ain't it?

Re:The problem of accountability

[Sir_Sri]

Well maybe the issue is more about making it obvious to the user that they need to install updates, making that process as unobtrusive as possible, and providing incentives to companies to do this well. God forbid, maybe even government regulations (although I don't think we're at that stage yet) on how these things have to behave, so that my java updates, my adobe updates my windows updates, my firefox/chrome/ie updates all come in roughly the same style and roughly the same way and with an ease of understanding that if this is to address a 0 day exploit that's made clear.

You're right, making it about going after hackers isn't going to work. Murder is illegal, people still get murdered. I would venture to say that it's hard to find a law on the books some people don't violate. Hacking adds a layer of complexity because the hackers need not even be in your country. So systems should be more secure, and more easily secured by design, that doesn't mean you ignore attempts at hacking but it may mean that the government (or more likely government funded universities) have to interact with companies to help them either be more secure, or face consequences for willfully disregarding secure practices. You know, the same way there's an NTSB in the US for travel accidents. Mistakes happen, but if you're upfront about trying to deal with them, fix the issues (recalls in the case of cars) that's one thing, if you willfully ignore a problem, hide evidence from investigators and generally refuse to be a positive participant in the process then expect to not be allowed to do business in whatever country it is.

Re:The problem of accountability

[Anonymous Coward]

Hang on... what about the accountability of the software producer? Oh, yeah, the DISCLAIMER in the copyright/license legalese... it passes the responsibility to deal with the effects to the users. So why are the users complaining?

Well, java has been a steaming pile for many years, but the recent mac java viruses are entirely due to Apple.

Apple made a deal with Sun (and later Oracle) that only Apple could release java for the mac.

So when yet another enormous security hole is discovered in java and made public, Sun/Oracle releases a new version of java for every platform except the mac. Apple then takes many months to release a patched version of java.

As a result, exploiting java on the mac is very easy, all because Apple is full of control freaks.

Re:The problem of accountability

[cdrguru]

The biggest "bug exploited" is allowing unqualified people to install random software on a computer. This means that anything can be installed if it promises some kind of result - install this for a bigger dick, etc. You don't think there are things out there like that today?

Unfortunately, the direction you seem to be going towards is the licensing of software developers and requiring huge liability insurance policies. There is also the problem of where the blame lies - it is an exploit in Quickbooks that it will display a bank account number so a user can give it out over the phone? Or is this a user error? How about the encryption of data to prevent the user from gaining access to it without the proper credentials? If the user installs a product and misuses it - with the result being they lose all the money in their bank account - how does anyone assign blame?

If you compare this with civil engineering it is very simple - in order to build a program you need a license and a huge insurance policy. If you have lots of experience and are generally successful the insurance policy isn't very expensive but for a beginner it is very expensive. This would make it a lot simpler for the courts - if someone falls out a window of a 15 storey building, the engineer that signed off on the windows is to blame pretty much no matter what the user did. Could we really live with that in the world of software?

Re:The problem of accountability

[c0lo]

Unfortunately, the direction you seem to be going towards is the licensing of software developers and requiring huge liability insurance policies

Not at all... The direction I'd (at least intended to) be going is one in which the govt and other agencies keep away from preemptively hunting "0day exploit crackers", because:
1. I'm already having enough of "if you have nothing to hide...", "think of the children", "... otherwise the terrorists will win", "piracy is a crime" as reasons of dropping the privacy on the net. I don't want to reach a point where the use of encryption is outlawed for yet one the more reason of "think of the dumb-ass users installing random software" (when even the list above brings enough of this risk already).
2. as I said in my original post - not only my privacy risks being invaded, but I'm paying for it on taxes.

Anything but the above situation is bearable.

If you have lots of experience and are generally successful the insurance policy isn't very expensive but for a beginner it is very expensive.

You see a funny thing: software is "speech" (copyrightable). If I wouldn't want to pay the insurance policy (for various reasons, not only because it might be expensive), I can still write software: I'd only need to distribute it in the source code and (if the free speech right is still in place) nobody should be able to stop me doing it. The secondary benefit of doing this: unqualified users will not suffer because of me.

On the side note: the above is a mechanism by which one can also write and distribute programs that use software patents the author does not own and one should not be able to stop you distributing them - in source code, the "free speech" must beat patents (I swear I'll start doing it on purpose sometimes).

And Java's not patched because...

[Anonymous Coward]

... it can't be patched.

I run a Windows 7 computer with auto-updating turned on for both Windows and Java. Every time I boot, I get a message telling me there are Java updates to apply. I click 'Yes' to apply them, and nothing happens. No update, and no error message to give a clue as to why.

Maybe it's an admin privileges thing. But most processes give options to get around that requirement. Java Update doesn't.

So there it is, an unpatched Java installation. I've tried to uninstall it, and that's a similar usability nightmare but long story short, that doesn't work either.

Re:And Java's not patched because...

[Nimey]

Someone's doing it wrong, then. Java Update will normally pop up a UAC window to execute, then possibly another if a new version exists to install.

If your admin has disallowed it, then they should be using Active Directory to push out .MSIs for each new release of the JRE.

We're now up to Java 1.6 update 32 or 1.7 update 4, with the former recommended for production use.

Incompatabilities...

[linatux]

I'm sure Java would be kept a lot more up to date if version 'x' could still run software built when version 'n' was current.

Re:Incompatabilities...

[owlstead]

Require correct Java applications next time. None of the software I have *ever* written for Java had problems after an update. Sometimes you use deprecated methods (which tend to be supported for about forever before disappearing) but that's it.

I had one or two problems with Eclipse, but that had to do with the SWT, not so much with the Java update itself either.

Java Update for Windows sucks; Java's fault.

[Anonymous Coward]

The Java Update notification shows up in the tray (on Windows Vista and XP), you click on it and get an error message to the effect of Java couldn't be downloaded or installed. What I have to do is logout and log back in as the Admin. Now, it would be nice if there were some program in the Programs list were I could click on it and just do an update, or easily bring up the java console - like Windows Update is easy to find and run. With Java, I have to search the web or better yet, bring up a page with a java applet which then brings up the Java console and then I can update - because the auto update sucks.

Now, I understand about the permissions and all that because I have a similar problem with Firefox and other Mozilla programs BUT I can do a "Run As" and run them as an admin and continue with the install - not really a problem. Java, on the other hand, requires an entire new download and then installing - only from the Admin account and digging for the damn Console in the control panel. BTW, the Java icon can only be found in the "Classic" view. And if I, an ex-programmer IT person thinks this is a pain, I wonder how many people get the error and then forget about the update?

tl;dr Updating Java is a pain in the ass if you run your machine under a user account. Java needs an easier way to bring the Java console. And this security problem is Java's fault.

Re:Java Update for Windows sucks; Java's fault.

[DigiShaman]

As a network admin, I despise JRE being installed on workstations. For one, users don't have local admin rights. Second, because of the first, JRE doesn't get updated. That leaves me with no choice. Either grant the user local admin rights to perform the JRE update (which they wont, too much of a PITA) only to hose their system with some form of malware. Or, let the version of JRE fester never being updated and eventually exploited by some nasty drive-by. And yes, I've personally witnessed an employee with non-administrative rights root a box. Obviously, the entire security paradigm within Windows and how applications interact at this level is fundamental flawed. Sandboxing should be enforced.

Not just unpatched Java

[Hentes]

The big security problem with Java software is that you can't differentiate between them since they all run on the jvm. For example, you can't block net access from a Java program in a firewall, because you would have to block the whole jvm.

Re:Not just unpatched Java

[Anonymous Coward]

The JVM has its own firewall. It is called the security manager. Indeed, this is the reason why Java security is so hard to get right. It implements a whole other model atop your OS. And in the Java 1.2 days, this was the main selling point of that release, so the people at Sun cared, and so it worked. But as Java suffered from more feeping creaturism in later releases, the security (like a lot of other things) broke. And not a lot of people cared. Indeed, in my experience a lot of programmers were happy about, because most of the time they spend trying to escape the sandbox. Signed applets anybody?

Re:Not just unpatched Java

[caluml]

You are wrong. There is a fine-grained security manager that can limit most stuff.

http://docs.oracle.com/javase/1.4.2/docs/guide/security/PolicyFiles.html
and http://docs.oracle.com/javase/1.4.2/docs/guide/security/permissions.html

Re:Not just unpatched Java

[Spliffster]

My firewall blocks ports/ips/protocols not programs!

Zero day exploits sure...but zero month??

[optimism]

Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes.

I'd like to see a reliable reference for this.

Would also like to know the impact of "zero month" exploits. Much more relevant, since Java's auto-updater pings once a month.

Personally I only use Java for a handful of local applications, and I always disable the auto-updater attack vector.

DEP and ASLR.

[vistapwns]

Now, it's been a while since I looked into this so don't bite my head off if my information is not current, but last I checked Java had problems with DEP and ASLR and did not opt into them (on Windows). Even if a flaw is not 0-day, it's much easier to attack without DEP and ASLR, so in my opinion that's another reason to heap a high level of scorn upon it. Found this from June 2010: http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf - not sure if anything has changed with java but I know some of the other apps have switched on DEP and ASLR.

Does anybody still run Java applets?

[Animats]

I haven't had Java installed on my desktop machines in years, and don't seem to be missing out on anything. Some of the less important OpenOffice functions didn't work, but that was about it.

Re:Does anybody still run Java applets?

[SplashMyBandit]

Depends what you are doing and what machine you are running. On Macs and Linux machines Java is slightly more prevalent, on Windows not so much. For example there are excellent Java applications (not applets) such as Visual Paradigm (a UML/system modelling tool) that are best-of-breed IMHO (nb: I hate the Windows native Enterprise Architect). So yeah, there are plenty of Java Applications out there (I've built some of them and they've been fine for users).

Re:Does anybody still run Java applets?

[Nimey]

I help manage a BlueCat Adonis and this requires a Java application (not an applet) to run. Our Cisco AnyConnect VPN uses Java to install the client unless you're using Internet Explorer, which uses ActiveX.

At home I will sometimes use the DBGL front-end for DOSBox, which is Java-based.

Other than the Cisco thing, I can't think of the last time I had to run Java in a browser.

Re:Does anybody still run Java applets?

[Prosthetic_Lips]

I know exactly when the last time I ran a Java applet. I was browsing a comic site, and his ad server really served me well ... a virus / trojan. This called for a multi-step response:

• Step 1: Notify artist (who changed ad providers)
• Step 2: Turn AdBlock on (I had disabled for his site)
• Step 3: Send him $10 for a beer or two
• Step 4: Uninstall Java

Problem solved!

Was I fully patched? You bet; current version of Java, mainly to eliminate that annoying popup, current Windows updates, etc.

Re:Does anybody still run Java applets?

[Nimey]

I've been eliminating Java from my supported computers unless absolutely necessary for that very reason: exploits, exacerbated by a crappy updater. Not a one of them has complained about not having it since I started.

That's an odd conclusion.

[SeaFox]

But the core problem isn't necessarily Java's exploitability; nearly all software is exploitable. It's unpatched Java. Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of. Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty. They almost never get caught and punished.

This conclusion doesn't really seem to follow the premise. If the security issue is already-patched exploits being used for attacks, isn't the real issue people not keeping their Java up-to-date with security fixes. We're always quick to jump on Joe Sixpack for not keeping their Windows installation current on hotfixes, or the webserver team for not keeping PHP/Apache/etc behind, how is this any different?

You know what would make this a lot less of a problem? Silent automated updates The Java updater appears often enough to be a nuisance for some (me included), yet Java itself is obscure enough to the end user some don't know what it is, unlike Flash. "What? A new version of Java is available? What's that? Don't click 'install' dear, I've never heard of it, it might be spyware!" I'm sure this happens more often than Oracle thinks.

Re:That's an odd conclusion.

[Prosthetic_Lips]

First, the last time I got hit with an exploit I was fully patched (Java, Windows, etc.). See response to commenter up above if interested. So that's not really the real issue.

Second, Windows has the same "feature", and every time I get asked to help people with their computer problems, the first thing I notice is all of the various "New version available" messages: windows updates, java, flash, etc. Regular users are aware of these things, they just don't click on them. Why?

Third, enough users have upgraded some seemingly small piece of their system, and the entire computer stops working. I upgraded Kaspersky (back when I used it) once, and my entire Internet connection went down. Something weird with the firewall and it blocked everything. Of course, from a perverse standpoint, their firewall did its job -- I wasn't going to download any viruses! Once bitten, twice shy.

Blame the developers...

[pkinetics]

The problem isn't applying patches. The problems occur when applying the patch causes a mission critical application, or a very critical application to the end user to stop working. The end result is the IT department ends up fielding a ton of phone calls from irate users, and / or getting blamed for the patch, even if they have nothing to do with it.

It is no wonder IT departments are always behind on getting patches rolled out. They need / want to test them.

And if an individual or department have some sort of 3rd party software that is not well defined and IT does not know about, there is no guarantee that they include it in testing.

Basically, patching is strongly needed. But end users get incredibly leery when patching the blasted stuff breaks the application, especially when the patch does not address the end user's prioritization of problems.

Re:Blame the developers...

[SplashMyBandit]

In this case the problem is that not all Java developers know how to build portable applications, or they do, but they sometimes feel they need to use non-portable libraries/imports when under pressure by management to "just get it done". Then I've also seen code where the developers were clueless with regard to file-names, assuming that every system the software would be run on was case-insenstive like Windows (when I fixed this, the software in question worked perfectly on Linux).

My point here is that there are bad Java developers just as much as there are bad developers in any other language. The software these people make can break with any update (although if they knew what they were doing it wouldn't). Unfortunately the poor IT department gets hammered after an update and they blame Java - when in fact it is the shitty developers who do not avoid non-portable Java libraries (eg. internal classes that are even documented that they should not be used for portable applications; where portability means between different JVM implementations and versions, as well as different operating-systems).

It simply isn't Java's fault that some developers are incompetent - although not everyone knows enough to make this call. Consider if a product wasn't written in Java, say if it was written in C++ or C#.NET then portability is a non-issue, there is no real attempt at true portability across operating systems, platform implementations [MS.NET vs Mono libraries]; or library versions [try replacing your libc or msvcrt.ddl with a different major version and see how much software still works]. That product would very often break if your environment (C library, O/S version) changed, yet people understand this. Most often Java applications don't break when you make major changes to their environment (if they are written properly), they can break 'for no good reason' when you update the JVM and have been badly written. Expect better from your Java developers/Java application suppliers!

Wrong!

[forgottenusername]

I dump java all the time. Try kill -3 `pidof java`

Re:Wrong!

[marcosdumay]

Do you have any religious aversion to the 'killall' command?

Also, what is the difference between SIGTERM and SIGQUIT?

Re:Wrong!

[ghn]

Try killall on solaris just for fun.

Re:Wrong!

[colinrichardday]

Also, what is the difference between SIGTERM and SIGQUIT?

15 - 3. I'm guessing 12.

On a more serious note, the man page for kill(1) lists the action for SIGTERM as exit and that for SIGQUIT as core.

Re:Wrong!

[marcosdumay]

Thanks. On my PC the kill man page didn't explain SIGQUIT at all.

Re:Wrong!

[marcosdumay]

Yep, on Solaris it is fun!

Penalties

[PPH]

Because we can't do anything. We're helpless (never mind keeping up to date on Java patches). It's all hopeless. We need authority to trace the criminals and possibly take preemptive measures to shut them down and seize their servers.

And then all you do is chase down people sharing Lady Gaga MP3s. Yeah, right.

Re:Penalties

[Billly Gates]

Or as my other post mentioned, disable it on the browsers and keep it IE only in intranet or a custom zone with 1 or 2 websites.

Java is obsolete on the net today except for legacy ecom sites. Keep it off port 80 WWW and the issues go away. This is why firewalls exist for everything except the webserver.

Re:Penalties

[PPH]

Actually, my post, and TFA are about: There's something wrong with Java. So we (Law Enforcement/RIAA/MPAA/whoever) need more authority to hunt down the 'bad guys'.

The Java problem has been fixed. If you can keep your system up to date. Its no worse than much of the other s/w out there. Or social engineering attacks. You don't see people calling to disable gullible users on port 80.

Re:Penalties

[Billly Gates]

Java can't be updated at work where it is still used.

As a personal user I have not used it since 2002 on the web. Many sites like ADP for HR processing and banks all use java to move money around similar to activeX controls for corporate users. Many have strange rules like not java 1.4, 1.4.1 or 1.4.3, but only 1.4.2 etc. PS that is over 6 years OLD!

My other post basically says your IT department is incompetent if it allows IE to use Java over the web outside of intranet and trusted zones for only a handful of sites.

Old, unupdated software should not be on the web! Hell, even Windows 7 has 160 updates from my OEM disk which is a stock 2009 version of Windows 7 to today before that and Office is up to speed. Many corporations refuse updates as they must fill out paperwork and test it for each release etc.

It is a terrible mess and certain software requires Windows XP/IE 6 to be locked at updates up to April 16th 2007 on Tuesday and no more or the software is not supported. Hey the CIO so that POS in a magazine on his flight to Rome! It can't suck ...

Enough ranting but that is my point. Most people get infected through a rogue ad in flash or java with old obsolete operating systems, ad-ons, or retarded IT policies I outlined above. Windows 8 takes care of this automatically and IWndowsRT wont have compatibility issues with security fixes thank GOD.

The only way the beancounters will allow sanity is to have things break. Corporations are happy using that frozen IE 6 no update after 2007 because it would cost money to have staff test and do more than put out fires and upgrade. Java is part of that mess with intranet apps that only output IE 6 HTML and a whole lot of other nasty things. Disabling port 80 on XP would be great!2

Re:Penalties

[PPH]

It is a terrible mess and certain software requires Windows XP/IE 6 to be locked at updates up to April 16th 2007 on Tuesday and no more or the software is not supported.

Right. But that's not only a Java problem. That's a problem of corporate IT having an app written and then refusing to fund necessary maintenance. So they freeze their platform in the last configuration that they know will work.

similar to activeX controls for corporate users.

And that's where everyone gets tweaked by the Java update problem. Because, unlike corporate intranets, Java is in use on The Internet. And that makes people become aware of configuration issues. Corporate can ignore the problem (and many have) by standardizing on some old, broken activeX version for their developers as well as their captive users. And that keeps the maintenance problem invisible. Not so for Java, or other widely used platforms. Your boss can't tell the world to freeze its JVM version where he wants to keep his desktops. So you (the user) see the result.

The real answer

[rabtech]

As much as it sucks to have a vendor pushing patches without explicit dialogs/permission, I would argue that the global damage from lack of patches far outweighs the downsides at this point.

This is one area Chrome gets right. Java (along with Firefox, Windows, et al) should automatically download and apply all security patches without prompting or notifying the user in any way unless you go in and manually disable it.

I've seen people see the Windows Update dialog and immediately click cancel. They just see it as another annoying useless dialog box and dismiss it.

Re:The real answer

[shutdown -p now]

Windows actually does download & apply system updates by default, at least if you leave the default setting chosen while installing it. It'll show a balloon notification in the tray when it's going to do it, but if you ignore it, it'll eventually just install them and reboot the system (if needed) overnight.

Yes, but very few

[MtHuurne]

I have Java installed on my systems, but have the Java plugin disabled in the web browsers I regularly use. I came across exactly one site that required a Java applet to run in the last year or so: a system to book appointments at the local government office. Maybe it's different in the enterprise; the last big company I worked for had some kind of SAP front-end as a Java applet. But for home use Java is no longer necessary on a daily basis.

Re:Yes, but very few

[SplashMyBandit]

Some of this is the typical 'use cases' that differ between a home user and an enterprise user.

A home user mostly passively gets stuff over the web. When they do interact with the web it is in very, very simple ways that are easily implemented with simple page-oriented forms or even some AJAX scattered around for a more dynamic experience (eg. using the excellent Google Web Toolkit, which you program in *gasp*, Java!).

Some enterprise users need a lot more complicated interfaces than that of a simple (or even AJAX) web page. This is because many of these users are actually *creating* things. Mostly a web interface is good enough but for specialized applications the web is woefully short (yes, even HTML5). Examples where the web doesn't cut it in the enterprise space: UML modelling (VisualParadigm is a an excellent Java product); Computer Aided Design/Drafting; anything graphically intensive; anything with high bandwidth requirements for feedback.

So, Java makes perfect sense on the desktop, especially in enterprises that have varied operating systems (eg. design department uses Macs; logistics with SAP on Unix; banks on UNIX; plebs and management on Windows etc) but need to have common applications. Java makes sense at home for products that must support Macs and Windows. Java rarely makes sense for business that are targeting the Windows-only market, which are the budget home users (except of course where Java is running reliably and where it is hidden away from ordinary folks; your DVD/BluRay player; inside your car; your Android phone; running your microwave; etc).

Re:Yes, but very few

[MtHuurne]

Oh, I'm not arguing against Java in general, just that Java applets have fallen into disuse. The niche of applications that are too complex to implement in HTML + JavaScript but are still a good idea to run inside of the browser has shrunk to nearly nothing.

Re:Yes, but very few

[SplashMyBandit]

... for home users. Yes, you are correct in this with the "home user" proviso.

Re:Yes, but very few

[MtHuurne]

Are new enterprise apps still being written as Java applets, or is the lifespan for enterprise apps just longer than consumer apps?

Re:Yes, but very few

[SplashMyBandit]

> Are new enterprise apps still being written as Java applets,
Not usually. There is a mostly a move to webapps instead (for many of our clients we do stuff in Google Web Toolkit, which you program in Java). We do have some existing applets that are still worked on - mostly because we have a niche that displays road video surveys and engineering features and existing video players simply don't cut it (the players and even video formats are designed for playing movies in a forward direction, not the complexities of single stepping of video forward and backwards).

> or is the lifespan for enterprise apps just longer than consumer apps?
Yes. The enterprise life cycle is usually much longer than the consumer cycle. Consumers think they have a big home network if they have more than a couple of machines on them, and updating and patching them manually is possible and tolerable. Enterprises usually have a lot of customized business stuff in house that makes economic sense to wring the maximum amount of use of (given the high capital investment in developing them). In big enterprises a lot of this stuff is Java (applets or applications) or Java-based webapps or webservices - but consumers never hear or see this - mostly because the enterprises want to keep their 'secret sauce' secret (because it gives them efficiencies and competitive advantage over rivals) or simply have no need to publicize their custom software (publicizing requires effort and costs time/money, and if they aren't selling it to you then there is no point telling you about it). This is why Java is still massively used according to the Tiobe Index (http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html) yet it is invisible to most ordinary folks who see the entire scope of computing as their little Windows desktop. The fortunes of Java have dipped in recent years thanks to enterprises trying to save money by deferring development projects. As the economy improves I would expect the enterprise use of Java to increase again.

I dumped Java a while back

[93 Escort Wagon]

At least in my web browsers. Can't say I've noticed that anything useful has been affected. Heck, I'm not sure I've seen any affect at all.

Besides, understanding what the real root cause of these Java exploits is has very little bearing on whether I can dump Java. I can choose to dump it regardless of its relative security. On the web, client-side Java tends to make Flash look light and nimble - so I said no thanks to Java some time ago.

Re:I dumped Java a while back

[locopuyo]

Same for me. My newest PC that I built about 2 years ago never has tasted Java. Things that require Java either get put on my old PC or I just find a Javaless solution.

If I could dump Java, I would

[billybob_jcv]

But that isn't going to happen as long as we have $600K of Oracle ERP software running in the company.

Re:If I could dump Java, I would

[catmistake]

But that isn't going to happen as long as we have $600K of Oracle ERP software running in the company.

dooooood.... don't you know it instantly loses the better half of its value the moment you drive it off the lot? Oracle software is like an oversized RV, or a boat, even a really nice expensive boat. It doesn't matter that it cost $2.4 million to build it, the day you bought it for that, it was really only worth half that, and after its been in the water, its often worth negative fortunes.

It doesn't matter if they are innocent

[tlambert]

Swift public punishment of convicted offenders is intended to act as a deterrent for the rest of society. It's not to reform the offender, and it's not to provide justice for the victim or the victims family.

I don't necessarily agree with taking Rousseau's Social Contract to that extreme, but that's the theory in practice in these situations.

-- Terry

what?

[circletimessquare]

there are people who grow up in grinding poverty who would never do anything unethical

then there are assholes like this:

http://en.wikipedia.org/wiki/Leopold_and_Loeb

very intelligent, very rich, and they decided to kill a 14 year old just for the hell of it. why? because evil is real in this world, and it exists independent of poverty, neither as cause nor effect, and independent of stupidity, neither as cause nor effect

class != morality != intelligence

there are poor people who are good

there are dumb people who are rich

there are smart people who are evil

mix and match to your heart's content and please get your simpleminded idiotic way you think about your world out of your head

we punish criminals on PRINCIPLE. it's not about deterrence. it's not about revenge. it's about morality

you'll get it some day, i hope

Re:what?

[wbr1]

The examples you claim are exceptions to the rule. I agree that you can mix and match those categories. You can find evil rich people (just look at the heads of the banks and most of congress).
But by and large, walk into any prison in America and take a census. You will find that at a minimum 70%-80% grew up in poor, broken homes with dysfunctional families.
If this country spent as much effort and resources in helping to fix families, in making sure children had proper role models, in truly ending poverty as it does on punishment, then the number of new prisoners would drop by half or more in 18-20 years.
However this is not in the interest of the powers that be. Both federal prisons, and most state prisons have contracts with private corporations where prisoners are employed for extremely low wages, in often unsafe and unmonitored and unsanitary conditions, with almost non-existent medical care, and the government gets a cut of the profit. Look at models like Virginia Correctional Enterprises.
In addition, in many states, prisons are a boon for state legislators of poor districts. Build a prison in their district and create jobs, and business to support the prison and it employees, get tax dollars to improve infrastructure, and more. It also has the effect of lowering the welfare rolls in the district where it is built.
I know the prison industrial complex from two different sides, and it is a corrupt, stinking beast whose purpose is not about PRINCIPLE, and if you think it is, you need to take a closer look around you and stop living in fear.

Re:what?

[Concerned Onlooker]

"You will find that at a minimum 70%-80% grew up in poor, broken homes with dysfunctional families."

There's another possible reason for that. They're the ones who can't afford spiffy lawyers.

Re:what?

[circletimessquare]

ever hear the phrase "those with the best intentions can do the most damage?"

i don't know about this very common meme about the usa having such a large prison population: i think if you go to some poor country rife with petty corruption, you'd find most poor people in favor of increasing the prison population

the greatest perpetrator of poverty is criminality. behavior, not socioeconomics. so you stop poverty most effectively by cracking down on criminal behavior. this can occur independently and at the same time as other poverty mitigating measures you mention. it's not an either/ or

i really believe this: the usa's outsized criminal population, except for the drug offenses (marijuana should be legal), is a model for the world, not an exception. other countries should crack down on their criminals more

but don't ask some bleeding heart rich suburban asshole's opinion about what i just said, ask a poor person actually living in the slum of a poor country, dealing with constant criminality. i'd wager they'd agree with me, and ask for more prisons

Re:what?

[Billly Gates]

Majority of crimes are committed by poor people on average. I like to think the majority of people are not evil and have some compassion and empathy. However, when I worked minimum wage at retail I had an immigrant worker explain like this, he said he likes people but if he can't feed his kids, and his wife is crying for food, he would rob me. Nothing personal as he liked me but he said people have to do what they have to do.

In a poor country like Russia and the old Soviet State people wanted out or needed money and gradually turned dark. I think no one wants to be evil but once you justify it then it becomes easier to go darker and darker and change. The hit Breaking Bad shows just that.

Re:what?

[circletimessquare]

no one is going to say a guy shoplifting bread to feed his family is like a guy home invading to steal jewelry in order to feed his coke habit

so i don't really understand what the point of your comment is. because people sometimes break the law for good reasons then therefore we can think of everyone who breaks the law the same way? that seems to be your point. then your point sucks

i love the show breaking bad. you do understand the guy is manufacturing poison, right? have you lost perspective? you vaguely empathize with his cancer diagnosis and economic plight in life so you understand and condone his metamorphosis into an evil bastard? what?

we punish criminality. all the sob stories in the world do not and should not change that

some people i think just have a surfeit of empathy and a deficit of reason

when you start empathizing with criminals you've kind of lost all perspective. how about you empathize with victims of crime

Re:what?

[arose]

ever hear the phrase "those with the best intentions can do the most damage?"

The one that everyone (or so it seems) parrots and no one actually believes? If you did the only logical choice would be to vote for those with the worst intentions. If you do not, you don't believe that best intentions cause the most damage, if you don't believe it you should stop saying it.

Re:what?

[circletimessquare]

you're right. it's not the good intentions that is the problem. it's the good intentions combined with naivete and failure to understand how malicious people really can be in this world

nice people very often wind up being manipulated by truly vile individuals by appealing directly to their good intentions and lack of sophistication

good intentions are just a good start. wisdom and reckoning and perception count more when actually trying to do good in the world

Re:what?

[Grishnakh]

It's more than that. They're generally not as smart or well-educated. Smart people don't usually commit violent crimes because they have better impulse control, and know that there's a significant chance of going to prison for it, and also because they know they're not going to profit much by it. So instead, they get a college education and a law degree and become lawyers or politicians or businesspeople, where they're extremely unlikely to go to prison for any crimes they commit, and can even find fully legal ways of screwing people over and profiting handsomely (like the banksters did).

Poor people don't have access to higher educational opportunities and better upbringing to show them how to get into these "professional criminal" professions, so the sociopaths in that population resort to violent crimes or other petty crimes, and those have a much higher chance of being caught by police and prosecuted.

Re:what?

[Billly Gates]

I do not condone it.

Just explain it. He was broke and came into the business with good intentions to partner selling drugs for a one time deal and then leave after securing money so his wife and kid can keep the house after he dies. After killing someone he has great remorse and then 3 seasons later his wife is turning bad with extortions and he kills left and right without conscious as he becomes used to it. It all started as a man with a conscious who did one thing and it set his course.

No one in my opinion who is not a psychopath would willingly do bad. They do it for financial reasons and then become desensitized and their values change after they get some good money and power and grow more evil.

Re:what?

[circletimessquare]

it's an interesting story, but the guy who starts off stealing bread to feed his family and graduates to home invasion to steal jewelry for financial gain and winds up murdering a home owner... there are no gray areas here. you've passed from understandable to prosecuteable

my problem is with people who say "well, there are gray areas in life, so we can't rightfully talk about black and white"

certainly, people who only see black and white are wrong too, but those who hesitate to condemn anyone at all, or worse, empathize with criminals, is disgusting to me. i'm not making these people up. someone commits a heinous crime, and you'll find someone talking about how the perp is a victim of society. ridiculous

Re:what?

[LilLilDaddy]

If you did the only logical choice would be to vote for those with the worst intentions

Uh... no. The quote said that those with the best intentions can do the most damage, not that they absolutely will.

Re:what?

[arose]

If the quote doesn't mean anything, then it equally shouldn't be used. But speculation that used the quote as support for bad things happening as a result of good intentions followed as well.

Oracle v. Google is why I want to dump java

[Qubit]

One of the reasons that I can't dump java is because I still use a bunch of software written in java like, say, apps on Android. And don't forget that there are pieces of software like LibreOffice that still have legacy dependencies on java. Sure, LO is working on rewriting those pieces, but it won't happen overnight.

Even if Oracle loses regarding copyright and patents on the Java language, the Java APIs, etc.., they have shown that they regard the Java language as a business bargaining chip and not as an unrestricted computer programming language. Why take the hassle and risk? Just go use someone else's language like Python or Ruby.

With all of the shit that Apache has gotten from Sun/Oracle re: the JCP, Harmony, and the TCK, I'm surprised that they haven't just said that they're going to fork Java. I guess the problem is that (1) Apache doesn't think that they have enough clout to make their fork dominant (or at least viable), and (2) Oracle could just go after the fork with their patents. At this point, I'm not even sure that Apache could get Google onboard for a fork, as that might hurt all of Google's need-for-compatibility claims in the current litigation.

Re:Oracle v. Google is why I want to dump java

[PuZZleDucK]

Second that, the only reason I have Oracles Java on my machines is because it was a requirement for Android/App-Inventor. I find it funny that Oracle is suing Google over the very reason that me and hundreds (I'm assuming) if not thousands of other developers have Java installed and in use every day. Way to shoot the community in the foot *again* Oracle.

The Reason Why You Can't Dump Java...

[Xarun]

...because you need it to run Minecraft. Or am I missing something?

Old Java

[silas_moeckel]

Unfortunately a lot of us have to keep old versions of java around and apps are free to ask for old versions and get them. Java for being "portable" is far far from it every java app only seems to works on a specific range of java versions. You know those fun apps networking kit seems to love. Work with a few different vendors and different version of there firmware and quickly you need a half dozen outdated versions installed.

Re:I thought this was going to be about the langua

[skids]

I don't think the OP's primary concern was with exploits, but with the general ugliness of java.

Unpatched Java? Blame the patching process!

[Wrath0fb0b]

Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of.

And so the appropriate thing is to see why in the heck we don't have all software always patched up to date. And the reason for that in Java is that it's bloody stupid updater takes 5 minutes and 10 clicks. Change it to be like Chrome -- background auto-update itself silently* with zero user input (or one click) -- and you'll have 99% of the installs up to date without issue.

To be clear, for the control-freak BOFHs, enterprisey people and hobbyists that actually enjoy computer maintenance, there should be a checkbox in options that says "Disable All Automatic Updating until I uncheck this box". If the user checks it, turn on the webcam and require them to raise their right hand and swear "I AM RESPONSIBLE FOR KEEPING THIS SOFTWARE UPDATED, ANY ILL THAT BEFALLS ME FROM NOT PATCHING IS MY OWN DAMNED FAULT AND I DESERVE IT". Make sure that preference persist between installs.

IOW, I'm not saying everyone has to do automatic silent updating, I'm saying that it should be the default setting unless the user expresses a desire to maintain it updated himself and is appraised of the risk of doing so. Let the user decide, but provide a better default behavior that's appropriate for most users.

Re:Unpatched Java? Blame the patching process!

[GoodNewsJimDotCom]

They need the box for no updates, because sometimes an update on a production computer = the automation shuts down. Microsoft's forced updates has halted my automations before.

Updates are like inoculations, it helps you even if you don't use them yourself. A virus that can't hit a larger amount of computers might not be pushed as hard as a juicy one which means your unpatched box is safer for the more people with a safe box. It is like Macintosh, it is as vulnerable as Windows, but since less people used it, less viruses were written for it. Macintosh was safer because it had less targets.

Re:Unpatched Java? Blame the patching process!

[MDSExpro]

To be precise, ideal environment should looks like that: 1. OS installation & update framework, bundling all installators and updates in one place. No gazillion bad-written installers and update services. 2. User accounts divided into two types: Standard User and Administrator, but understood differently that in modern OS's. If Standard User is assigned to any Administrator, then Administator is responsible for managing update policy (this way production environments with if-updated-everything-explodes applications wont break suddenly), but if Standard User isnt administrated by any of Administrators, all updates are delivered with mentioned zero input policy (Chrome style). We can't expect non-technical users to manage computers on their own, so if OS detects there is noone with technical knowledge looking after Standard User, then OS take role of Administrator and cover his ass, even if something may stop working till application is adjusted to new update.

Mod parent up

[WD]

One could argue that Java had a place in the horrible 1997 web, with its ridiculous fphover.class FrontPage sites. Everything was awful there, and it fit in nicely. However, it's only a liability these days with respect to browsing.

Java can be quite useful in other forms, like stand-alone applications, but stay the F away from my web browser!

Re:Mod parent up

[owlstead]

I'm a really big proponent of Java, but I'll be the first to say that it failed to make an impact as web-plugin. I don't know how they could screw up so badly (I do have a few pointers such as the horrible AWT / Swing idea) but I'll be the first that applets and - in lesser form - webstart completely and utterly sucks. And you could say that for many Java GUI applications, if only for the horrendous, evil, completely useless file chooser dialog box that should somehow reassemble the OS provided one.

I'll make a small exception for Eclipse and Eclipse based applications, which does have a pretty good (underestimated) application framework.

Yes I can

[Megane]

Tools -> Add-ons Manager -> Java Plug-In -> Disable

Sure, that only disables it in the browser, but the interwebs is where this crap is coming from.

Now shut up and let me get back to Minecraft.

The Solution

[FilthCatcher]

Add signed 3rd party software repositories to Windows Update and remove the need for all these programs to add their own, often intrusive update processes.

Don't want java? Fine. Don't install and don't add the repos & key.
Want java? No problem add keys and repo and get it updated in a sane manner not an obtrusive installshield app that always seems to fire up when I;m right in the middle of doing something.

This is an area where pretty much every Linux disro wins.
Failing that, an alternative would be an open-source package manager for windows. Bit of a nightmare to make though - as I assume every windows software developer would want you to run their install executable so they can make you accept EULAs etc.

java/Linux or Windows?

[Billly Gates]

What if I want something more professional than simple PHP?

I am starting a business and was planning on going to Java next year when I need scalability and would host it on Linux. My only other choice is Windows and a IIS/.NET solution and $100,000 in Microsoft licensing fees.

That is a terrible choice if you ask me. Dumping Java? What gives if the alternatives need 3x the amount of hardware and do not work as good? ... and please do not tell me Mono is somehow a serious enterprise solution with no downtime.

Could IBM Java be a way out? Would Oracle go after them or me next?

Re:java/Linux or Windows?

[rubycodez]

eh? java/j2ee is the bloated crapware that needs 3x the hardware to get a job done as other languages. I worked for a VAR, java/j2ee sells hardware. There are mature software stacks in plenty of languages, pick one. Python is a well designed language, runs from a VM, has mature frameworks and libraries: Flask, Django, Pylons or Pyramid. Note python also can run in the jvm.

Re:java/Linux or Windows?

[owlstead]

Right.

Point me to the mature crypto library for those frameworks. The static code analyzers. The parsing IDE's. The tools. The extensive libraries. The up to date unicode handling. I've seen many many claims about "mature" frameworks that simply aren't. Actually, I make a point of trying out frameworks. Many don't even make it into the first week, and I have met none that are as mature and maintainable as Java.

In my spare time I have thought of many many ways of creating a more mature language than Java, fixing many of it's mistakes. I *know* it can be done. Unfortunately most languages seem to focus on sparsity and features instead of readability, security and maintainability. I'll happily switch if I can find one that does a better job (and isn't SmallTalk).

Re:java/Linux or Windows?

[rubycodez]

PyDev for IDE, and there are others. you can call any C, java, common scripting language crypto library from python, what's the big deal?. There are static code analyzers, consult search engine. Java isn't maintainable long term, the language changes too much. write once, run for a awhile on the same version JVM or crap breaks. and god help you if you used IBM websphere or similar bloatware cesspool. Python has supported Unicode for over a decade

Re:java/Linux or Windows?

[owlstead]

PyDev is an Eclpise plugin, which is build using Java. I find it a bit ironic you are immediately pointing to a very successful Java IDE.

Crap should break. Otherwise, if you spend just a bit of time making sure that your application has been created using Java rules.

Java is well known to be a pretty conservative language regarding new features, so I really don't know what you are talking about there.

And *any* language has it's crap API's or bloatware, Java is certainly not an exception there.

Java and IT are to blame

[medv4380]

Java's main drawback has been it backwards compatibility and the resistance of IT to actually do system updates consistently. It is under the belief that if they update java every java app will break. So they run old outdated version of Java. Patching shouldn't be optional on machines that are exposed to the internet, and yet may IT shops do just that. Java is the problem because it's a single point of failure shared by many systems. If you have 5 java apps they all have the same exploits, and IT fears updating because they don't want things to break. No matter how hard Java works to maintain backwards comparability IT will still be the sniveling update cowards they are.

Re:The Solution: 100% Bug-Free Software

[mark-t]

True... but most exploits are *NOT* zero-day.

Re:The Solution: 100% Bug-Free Software

[retchdog]

then, please, do generate this wondrous model which we simpletons cannot... and also please note that whatever your model is, a turing machine will be almost surely be able to simulate it anyway. although i am open to the idea that a different model can emphasize certain aspects which may be useful, i would certainly like to see even a prototype, rather than a lot of hot-air insults of "academics."

I got rid of it 2 years ago

[rs79]

and blackholed the domain even as it loves to reinstall itself. You absolutely don't need it. Maybe 1 thing out of a thousand doesn't work (usually some lame video thing) and nothing is that critical. And the problems you don't have by eliminating it?

Forget the security stuff it's the part where it takes ages to load then hangs is what did it for me. And on a 4-way scsi raid should it really still be slow?

Worthless garbage. Always was, and now it's way way worse.

To me its not Security risk: I can't stand Java

[tyrione]

I prefer C/C++/ObjC/ObjC++ family of programming languages to work with and have in my 3rd party apps. I would really like LibreOffice to dump the need for Java all-together. I don't mind C# with Mono apps but if GNOME switched to Mono and C# for GTK+/GLib I'd dump GNOME all together.

Accountability...

[Bert64]

You will never have the accountability dreamt of by the article's author...

Not only are most cases of internet crime so petty that it would be a complete waste of resources to pursue them, but you have a global network with lots of different countries, all with their own set of rules. If someone in a non extradition country is attacking you, what can you do? What if someone is launching their attack from a country where their actions aren't illegal at all? If that's the case then they haven't actually done anything wrong, they are fully complying with the laws that apply in their jurisdiction.

The reason java is a good target is a combination of:

1, it's ubiquitous.. installed everywhere and on 99% of installs its the same code (eg unlike the browser market where there are now 3 major codebases to target)...
2, it's often not updated

the same reasons apply to flash and acrobat..

Issue 1 can be eased by opening up the market to have multiple implementations, much like what happened with web browsers...

Issue 2 is actually microsoft's fault for not providing a decent centralised update system. When i encounter linux or mac users, their java installs are almost always up to date (and if not, theres either an explicit reason or nothing at all is being updated) yet when i encounter windows users that is rarely the case, especially in corporate environments.
Windows encourages kludges like the "java updater", a binary program which runs in the background checking for updates. Such a system is error prone, highly inefficient since you end up with lots of bloated background update checkers for all the different apps you have installed, and utterly useless in an environment where the logged in user doesn't have the necessary privileges to actually apply the update.

One word why I can't quit Java

[isecore]

Minecraft.

And how do you know who picked a fight?

[SmallFurryCreature]

The big question in the case is who picked a fight with who. The person who called the police and campaigned on behalf of a black homeless person against a white sheriff OR the self proclaimed gangsta nigga (his own nickname). I wouldn't trust the bleeding heart side with this one, they also make much that the HISPANIC guy lived in a gated community, but so did the black guy. Apparently white guy in gated community, racist. Black guy in gated community, victim.

I think it is even odds that Travor wanted to go crazy n* on the dudes as, thinking he could scare him off. In holland a group of youth immigrants formed a gang called the "crazy foreigners" operating on the same method, trying intimidation, knowing any white victim would be wary of standing up to them for fear of racist charges.

We shall see in the court case what both sides claim really happened.

Re:And how do you know who picked a fight?

[Rakarra]

There's a reason why police are told to shoot to kill, it's because if your shot doesn't incapacitate (and "shooting in the leg" is pretty damned difficult unless you're shooting point blank range) you are screwed.

I don't particularly feel the need to put my life in much greater risk just to shoot an aggressor in the leg.

That's not how it works

[jcupitt65]

MS wouldn't be patching 3rd party software (you're right, that'd be crazy). MS would provide a general framework for maintaining installed software which 3rd party vendors could hook into.

Instead of every package implementing its own updater with its own background service and configuration system, they'd be one updater that everyone used which presented updates to the user in a central place. Instead of 10 badly implemented updaters, you'd have one good one.

This is what all linux distributions do and it works pretty well. I expect the win8 app store will do something like this.

Re:That's not how it works

[Waccoon]

MS would provide a general framework for maintaining installed software which 3rd party vendors could hook into.

Given that some of these updaters use 20MB of memory, require background processes and services, and try to force some stupid browser search plug-in on every update, I'm not sure the vendors would really care about doing things properly through a framework.

Hell, I remember when Windows tried to detect USB devices first and then ask for a driver. Vendors said, "screw that", and insisted that you install their 200+MB bloatware before plugging the USB device in, or else the USB port would be locked and the device wouldn't even be acknowledged, let alone identified.

So, Firefox, got that MSI installer, yet? No? Oh, I see you now have an updater that runs continuously as admin. That's a good start!

Windows programmers are about the least cooperative people in the world. An update framework would be nice, but I think there's a reason Microsoft is paranoid about making one.

Re:That's not how it works

[jcupitt65]

Ah, true. Though I'm sure most non-evil win devs would like to use it. And all software available via MSI could use it too. Fingers crossed for the win8 app store! I've not seen the small-print yet, hopefully win32 programs that are installed this way have to pass some pretty strict criteria.

Re:That's not how it works

[gbjbaanb]

This is what all linux distributions do and it works pretty well. I expect the win8 app store will do something like this.

for a fee.

Aren't you already there?

[Kergan]

The US hosts a fourth of the world's inmates. How are you not there already?

Java APPLETS

[brunes69]

I wish articles like this would clarify what they are talking about, to avoid sensationalist headlines like this. This article, and all recent articles bashing Java, are all talking about java APPLETS and web-browser based Java - which is the INCREDIBLE MINORITY of what the language is used for.

Java is a perfectly fine platform for developing secure, stable, enterprise-grade applications. And really it is one of the only such platforms that is both cross-platform and production ready (no I do not consider .Net + mono to be production ready)

Autoupdaters suck, all of them!

[wye43]

One exception: maybe the Chrome one is decent.
But most of them start updating - making your system/app unusable - exactly when you need the system/app the most (because nobody keeps the computer running at 3am).

So people set it on manual. Additionally, a thousand vendors make a gazillion background auto updater services that run all the time, wasting memory, CPU and IO. Then we find ways to take down those pesky background services too.

And then we forget(or low prioritize) to update. And we are vulnerable.

Lets stop pointing fingers and fix the update system - find ways to make autoupdate smooth, viable and with ZERO disruption to the running system. And make it not optional anymore. Then everyone will be forever up to date.

No, the problem is the infrastructure!

[Marrow]

There should not be a -different- way of updating every different software package I have. There should be one system for doing updates, and each software package hooks into it. I dont care if java has to pay to get distributed by windows update or if we force windows update to cater to java. But these little toolbar popups are crap and everyone knows it. They are a joke, and advertising opportunity that no one believes in. Was that a real update, or did they just want to install their toolbar again? And that goes for Mac update too.
Fix the god damn infrastructure.

And viciously disparage ANY security update

[Marrow]

That includes offers of new software, or requests for handouts. These are important. And software developers should be apologizing for not getting it right the first time. Not asking for handouts or advertising data. Just fix the damage they did to YOUR computer.

Poll

[synapse7]

On a scale of 1 to 10(1 least creditable, 10 most) how much does the use of the word "cyber" affect the credibility of the article and/or author with you?

Previously I would stop reading any article that used "cyber", aside from government articles where I was attempting to get a feeling for their train of thought. Now I feel I'm forced to consider that the article may be meaningful and possibly persuasive even with the use of "cyber" which the opera spell check continuously tells me is incorrect.

Signed by whom?

[tepples]

Add signed 3rd party software repositories to Windows Update

Then what CA would sign the certificates of individual developers of free software for Windows? The only qualification to get Ubuntu to trust the keypair associated with a PPA are that the PPA's operator can 1. receive e-mail at a non-webmail address and 2. operate OpenPGP. Microsoft, on the other hand, has tended to insist on paid certificates from a commercial Authenticode CA, and most major Authenticode CAs that I've investigated issue certificates only to corporations and LLCs, not individual developers.

I assume every windows software developer would want you to run their install executable so they can make you accept EULAs etc.

I thought accepting terms was one of the things that could be done in the debconf step of a dpkg.

How to make voice or video chat in HTML?

[tepples]

every time a website requires flash I launch it on my phone to get a standard HTML version that does not.

From standard HTML and standard JavaScript, how should a web page access the camera and microphone of the machine that the browser is running on (with the user's permission)? For example, how would a JavaScript VoIP app or barcode scanner app work? I've read rumors of a "device API" or "media capture API", but I haven't seen it implemented.

I/O that Oracle forgot

[tepples]

they sometimes feel they need to use non-portable libraries/imports when under pressure by management to "just get it done".

The last time I checked, accessing a USB joystick from a Java program required the use of Jinput, a third-party library containing native code, because Java provides no portable way to access common home PC input devices other than a mouse and keyboard. Libraries to do some form of I/O that Oracle forgot are by their nature non-portable, even if the native back-end is provided for all popular platforms.

Re:I/O that Oracle forgot

[SplashMyBandit]

I'm using JInput in one of my own projects (a modern jet air combat simulator, works great and very fast with Java/JOGL/JOAL/JInput [yes, Java is more than fast enough for games if you know how to utilize the GPU!]). Turns out that JInput *is portable* among Windows, Linux and Mac (because that is where I'm using it). It isn't truly portable (you'd have to do porting work for Solaris, BSD etc but who uses those anyway ;) ). More importantly (and more relevant to this discussion) is that JInput doesn't expose you to dependencies that break with minor revisions of the JVM, which is what the IT admin guys fear - at least to no greater extent than patches to the O/S breaks the USB access layer (which does happen with big O/S revisions, but then all programs break, not just the JInput-using ones).

Microsoft again

[jjohn]

Look, Java has issues, just as all software and development tools do. However, when I search for "java exploits" I see *a lot* of microsoft blogs running posts with this them. Is this just astroturfing?

Pluralses

[tepples]

Your pluralses are showing. Are you a Selkie fan?

Security by getting rid of useless crap

[WaffleMonster]

Back in the day java applets were everywhere.

Today everything is flash or html5. By not having java installed you are not missing out on anything. Hopefully in the not too distant future the same will be true for flash.

Flash and all adobe products are a horrendous failure from a security POV however we still tend to use them because they provide VALUE.

No website in their right mind requires java anymore. By not having it installed I am not missing out on anything. The value to having java installed for me is nill.

Andriod platform is Javas last remaining "killer" app.. Oracle is hard at work doing its level best to kill even that. Nobody wants to use a closed "copyrighted" programming environment. From a technical perspective .NET is superior to java. It has all but erased any inrodes Java had in the enterprise.

This leaves java with what? telecom, academia and niche verticles?

Finally. It's been said!

[Fuzzums]

"Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty."

Why do you never hear about covert CIA flights from China, Russia and Nigeria with a shit load of spammers / scammers / other scum on board?
THAT'S the real problem.

non sequitur

[luis_a_espinal]

but we can still remove java and have less risk right ?

Indeed. I will have to disagree with "security advisor Roger Grimes" and point out that complexity breeds bugs; bugs breed security holes; Java's JIT and supporting libraries are just way too complex for their own good. This problem is made way more severe by Java's closed development model.

Java can be made secure, just not any time soon, not until Oracle gets a clue and opens up the development process.

What exactly is closed about it? You can see the libraries' code, and I'm not sure how the JIT has anything to do with the vulnerabilities being discussed.

Don't get me wrong, I do believe an open development process *can* (not necessarily will) ensure more desirable safety qualities. But what you are doing here is creating an argument for openness with a conclusion that does not follow the premise in a "is/ought" fallacy fashion. Unless you put some tangible "meat" in it, it simply does not follow.

JDownloader

[tommy8]

JDownloader is too usefull for me to dump java

Re:Accountability - no, it's featuritis

[bolthole]

The REAL problem, is that there is this culture-of-inertia acceptance of an "update" button, which almost always brings security "fixes".. COMBINED WITH MORE "features", I mean bugs.

Until vendors start offering more options, there's almost no point in updating, from a security standpoint. You're just posponing your hackability.
Your safest means of protection currently, is to only run java from trusted sites.

Vendors need to offer a "just security patches, NO new feature code" auto-update button.
*especially* the java vendor(s)

the source of the issue

[recharged95]

"so many recent exploits have used Java as their attack vector, "

You guys are sure the increase exploits are not because of the hatred of Oracle in Oracle V. Google? Hmmm... Last year is was /. trolling with Flash since Apple made it's argument. Before that it was AVC (vs Ogg or WebM, cause of Apple, Google, FOSS).

This year it appears to be Java.

Even not considering those politics, most attacks, in Java and all frameworks are due to poor implementation by the appdev.

I can an did and won't go back.

[TheSkepticalOptimist]

I pulled Java off of all my systems because of the incessant nagging of updates and the fact is would add 16 versions to the computer rather then updating a single version. I found that anything using Java on a desktop was not useful or missed anyways.

I've also gotten rid of Adobe (service) products for the same reason, ridiculously annoying install nagging and update process and yet another security hole with not much benefit. Silverlight too.

The only reason for a website to use Java technology these days is because "the fossil" a company hired 20 years ago refuses to learn something new.
The only reason for a website to use Flash is because they got a bunch of graphic designers who will crap their pants if they see an actual line of code.
The only reason for a website to use Silverlight is because Microsoft wanted fossils and graphic designers to use their platform instead.

As for updating, FTW would companies please adopt Google's model in Chrome of constant BACKGROUND updating rather then nagging "You have an update!" popup's or explicitly requiring to manually update. I love the fact that the software I am running is known to be current, relevant, stable, and secure without having to do anything but simply use the product.

The best way for a company or technology to become irrelevant is to constantly announce your failures and expect people to invest time and effort to fix them.