Why You Can't Dump Java (Even Though You Want To)

snydeq writes "Since so many recent exploits have used Java as their attack vector, you might conclude Java should be shown the exit, but the reality is that Java is not the problem, writes Security Advisor's Roger Grimes. 'Sure, I could opt not to use those Java-enabled services or install Java and uninstall when I'm finished. But the core problem isn't necessarily Java's exploitability; nearly all software is exploitable. It's unpatched Java. Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of. Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty. They almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.'"

Comments

Accountability

[amginenigma]

Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.

Re:Accountability

[icebike]

Good luck with that, we humans have entire criminal justice systems which are supposed to bring accountability... pretty sure you know where I'm going with this one.

The criminal justice system, and the police are scaled just big enough to keep people from murdering each other and running off with with other people's property on any grand scale. It was never intended that this level of policing should be 100% fool proof. Even in those countries where there is totalitarian control, petty crime is rampant and tolerated simply because you can't lock up everybody.

I doubt you or the author of TFA would want to live in a society so tightly monitored that it was impossible to commit ID theft or internet crime (he seems to equate the two).

There was an opportunity, and actually some proposals for a non anonymous internet once upon a time. Also for absolutely verifiable Email senders. That path wasn't chosen, and would likely have been impossible anyway, with the side effect of turning a lot of petty internet activity into internet crimes, merely because you posted without a license, or made a name up.

Re:Accountability

[gman003]

There was an opportunity to try. It may even have been an opportunity to succeed, but we will likely never know, as we collectively took a different option.

Re:Accountability

[CajunArson]

The Internet is not and never was designed to be "anonymous" despite the popular myths online. People confuse "anonymity" with the fact that the Internet does not provide any good mechanisms to verify who you are actually dealing with (SSL certificates are a semi-useful additional layer designed to fix that issue).

Go back to the earliest days of the Internet and the WWW and you'll see that it was actually the opposite of anonymity. It was a bunch of physicists who wanted people to actually read their papers and give them grants ;-)

Re:Accountability

[SScorpio]

You might want to move then. There are 28 states with no duty to retreat there is a break-in your home. And another 17 states where you can stand your ground no matter where the attack takes place.

http://en.wikipedia.org/wiki/Castle_law#States_with_a_Stand-your-ground_Law

About three weeks ago there was an guy in his eighties that killed a robber with a shotgun and two other ran off. The media report his heroics in defending his property, and sleeping wife. Doesn't sound like he was considered a criminal.

Shooting fleeing suspects in the back when they are outside your home may bring about criminal prosecution, but it's up to a judge and jury if there was immediate threat at the time.

Re:Accountability

[Grishnakh]

The whole idea of accountability is utterly stupid as long as you have a single data network that spans multiple countries. If someone in Nigeria sends you a virus or does something else illegal, WTF are you going to do about it? Nothing. There's absolutely no way you're going to make people entirely accountable for their actions as long as there's multiple governments, and worse different laws in different places. The only rational thing to do is to protect yourself.

Re:Accountability

[Grishnakh]

The Trayvon Martin case is a little weird, because it looks a lot like the guy sought the kid out and picked a fight with him and then shot him. That's not legal, even under the Stand Your Ground laws. We have the same kind of law here in AZ, but it's not going to protect you if you go out of your way to start a fight with someone; it just means you're allowed to defend yourself where you stand. However, you better be able to convince people that you really were physically threatened, and that (this is the key here in the Martin case) that you didn't provoke the threat in the first place. That means you can't go pick a fight with someone, punch him, wait for him to punch you back, then pull out your gun and shoot him dead because you were "afraid for your life". Anyone can see that's a BS line of reasoning. Because of this, if you're in public, you really need to have witnesses or some other evidence that you were in the right, and didn't instigate the conflict, or else anyone could just go shoot someone and claim they were threatened. It's much easier inside your home; if some stranger is inside your home and you shoot him dead, it's pretty hard for prosecutors to argue that you instigated it or whatever; your story that the person broke in and threatened your life is hard to argue with. If it's your brother-in-law, however, expect some trouble.

Re:Accountability

[Kalriath]

Jokes on them. Slashdot went through its user haemorrhage years ago. Not sure where the users went though.

Re:Accountability

[Kalriath]

I hate to point out that one of the largest failing civilisations right now is the one with the most ridiculously overbearing property rights laws. Yours. Most of us civilisations who refuse to accept the premise that any replaceable material object can be worth more than a human life are doing quite well thank you. Any argument that tries to claim that property can be worth more than life under any circumstances is inherently logically and morally flawed.

Re:Accountability

[roman_mir]

You have all the facts wrong it looks like. Zimmerman didn't attack Martin, he was backing off, returning to his car when Martin attacked him. Zimmerman fell, Martin jumped over him beating Zimmerman's head against the ground, Zimmerman then shot him.

The cops who didn't throw Zimmerman into a holding cell right away obviously thought that it happened this way, that Zimmerman was protected with that 'Stand your ground' law, that it was self defence.

The media is being used though to create a narrative among the public that there is this splurge of white on black crime, when actually that is not the case in USA, and nobody makes a federal case out of crimes like this for example.

Re:Accountability

[Anonymous Coward]

There was at least one eye witness who saw Martin sitting on top of Zimmerman. There was physical evidence that Zimmerman was laying on his back on the ground (the back of his shirt was wet and covered with leaves and grass clippings). Zimmerman has a freshly broken nose and lacerations on the back of his head. All of the evidence publicly presented tends to confirm Zimmerman's version of the story.

Re:Accountability

[parkinglot777]

Regardless what happen between Zimmerman called and the boy was killed, Zimmerman had no reason to ignore the police advice to stay where he was but followed the boy. When he didn't listen and the consequence is a dead of someone who is not him, there are always questions and this doesn't sound good for him anyway.

Re:Accountability

[serviscope_minor]

Any argument that tries to claim that property can be worth more than life under any circumstances is inherently logically and morally flawed.

Well, that's a logical fallacy if there is one.

Let's start at the absurd end of the spectrum to demonstrate the vapidity of your claim.

If the property is necessary for survival of its owner, then it is certainly worth more than the life of the person trying to steal it.

This could be necessary medical equipment, or even clothes in a suitably exposed setting. Stealing that property is tantamount to murder, since it will directly cause the death of its former owner.

Do you still claim that the property is worth less than life?

Let's now swing to a wild other extreme.

If you believe that no property is worth more than a human life, then why don't you give away everything you own towards the cause of saving lives? If you refuse to do so, then you are valuing your property more than human lives.

Your argument is absurd, and you don't even believe it yourself.

Re:Accountability

[emho24]

I simply cannot understand the position some people take "it's just stuff, it's not worth a life!". You broke into my *home*. This is where I live with my wife and child. I am not going to spend one nanosecond pondering your motives, whether you are here to steal my tv or the life of my family. I'm going to shoot center mass (no, *not* in the legs), and I am not going to stop shooting until the threat is no more. Period. My state has a castle doctrine, but I don't care. It was my doctrine long before it was state law. No one is going to tell me that my life and my family’s lives are worth less than some criminal that broke into my house.

Re:Accountability

[dgatwood]

This could be necessary medical equipment, or even clothes in a suitably exposed setting. Stealing that property is tantamount to murder, since it will directly cause the death of its former owner.

If another copy of said equipment is available, then no death occurs, so the only reason you are perceiving the property as being valuable is because of the circumstances under which it was obtained. By stealing it, you cause someone to die, which makes you guilty of killing that person. That secondary crime, caused by the act of committing the first crime, is a large crime. However, the value of the item itself is still less than the value of a human life. For a slightly more illustrative example, if you are dying of hunger, a loaf of bread is still not more valuable than your life. If someone were going to kill you over it, you are better off starving and trying your luck at finding other food than dying immediately (and still losing the food). And more to the point, if the loaf of bread were more valuable than your life, you would be better off keeping the bread rather than consuming it to save your life. Clearly this is not the case.

If you believe that no property is worth more than a human life, then why don't you give away everything you own towards the cause of saving lives? If you refuse to do so, then you are valuing your property more than human lives.

That's a flawed argument. First, if I give away everything I have, I will likely die of exposure and hunger, therefore what you are essentially saying is that I should give my life to maybe save other people's lives. Second, there's no guarantee that even if I did so, even one other life would be saved.

less risk?

[Anonymous Coward]

but we can still remove java and have less risk right ?

Re:less risk?

[Tough Love]

but we can still remove java and have less risk right ?

Indeed. I will have to disagree with "security advisor Roger Grimes" and point out that complexity breeds bugs; bugs breed security holes; Java's JIT and supporting libraries are just way too complex for their own good. This problem is made way more severe by Java's closed development model.

Java can be made secure, just not any time soon, not until Oracle gets a clue and opens up the development process.

Re:less risk?

[errandum]

You can also not use windows and opt for linux. But is it worth it? For some, yes, I'd say that for most people it isn't.

Java runs some cool software that most have no idea it actually is Java (it can copy the look and feel of your OS). The only way to mostly fix java is to have chrome like updates. Silent, forced on you but safe.

Re:less risk?

[DarwinSurvivor]

Or a package manager that keeps ALL your software up to date like Linux has had for years!

Re:less risk?

[happymellon]

Package managers are not a silver bullet, because it still requires a diligent maintainer. There are plenty of software packages for the various distros, which are older versions. Running the update mechanism won't fix that.

Can't stop crims, can fix holes

[Anonymous Coward]

He may be right, but he's also totally unrealistic. Nothing you ever do will stop the "underlying problem". But we can fix security holes, and pressure companies to release more secure code.

No point hoping for what is "right", or "best". Aim for something realistic instead.

Re:Can't stop crims, can fix holes

[jhoegl]

seems more like he is building a case for rules to govern the internet, justifying "big brother" tactics, and random stealing of servers from server racks by the FBI.

Re:Can't stop crims, can fix holes

[ChunderDownunder]

'We' can't do anything to fix security holes in "Java", unfortunately.

Only core virtual machine and class libraries have been released under the GPL + Classpath Exception. The installer, auto updater, javafx, java web start, browser plugin are proprietary Oracle.

OpenJDK might be free but Java (TM) isn't. My bet, [citation needed], is that many of these Java security holes occur in unreleased code.

Re:Can't stop crims, can fix holes

[icebike]

You are right of course.

Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. With a few thousand more eyes on that source code its quite possible it could be much more secure than it is now, especially since Grimes himself points out it was originally designed with security in mind. But as long as vendors and bloggers can claim that popular platforms fall to attack simply because they are popular, we will never see much pressure for improvement.

Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed.

The idea that we will ship code, vetted by nobody in particular, for execution on some remote machine, and then expect a software sandbox to contain that code successfully, forever, with zero maintenance is just begging for trouble. To do so without publicly vetting the platform in all of its details is foolish.

Re:Can't stop crims, can fix holes

[Anonymous Coward]

"Some popular things, like Gold Ingots, are just harder to steal because Fort Knox has better security. Even with a map, a tour, and three corrupt ex-guards on your payroll you aren't going to succeed."

    Or employ the Goldfinger option. Drop a Nuke on Oracle, and another on on Microsoft just for giggles, and thus make all your alternate code much more valuable.

Re:Can't stop crims, can fix holes

[Shoten]

You are right of course.

Further, Grimes falls headlong into the punch-bowl of the "Its popular, therefore, its attacked" Koolaid that Microsoft has been serving up for years now. .

Here, you hit the nail on the head...but it isn't about open- versus closed-source. It's about the real problem...patching. Most exploitation involves Flash, Java or Adobe Reader vulnerabilities largely because these don't get patched as easily. Microsoft became the gold standard in patch deployment over the past several years, and as a result the time in which a Microsoft-based vulnerability can be counted on to produce botted host after botted host from a compromised website is far shorter. On the other hand, Java and Adobe both tend to lag a bit in their patching, and their systems rely upon a reboot to even look for the latest version. When Microsoft pushes a patch, within 24-36 hours I usually have it installed. I don't know how long it takes between when the latest Java engine is out and when I happen to reboot and, once my machine comes back up...ah, look! A new Java version!

Criminals will always exist, and they will go after the easier targets. Vulnerabilities will always exist. The key is to patch the vulnerabilities quickly enough and frequently enough that criminals look for lower-hanging fruit.

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Microsoft became the gold standard in patch deployment over the past several years

I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again. Until then all the Linux users will just shake their heads at your ignorance.

Re:Can't stop crims, can fix holes

[Grishnakh]

There's a few differences. First, it's fully possible to make a "door" on your computer that really is extremely difficult to open, sort of like a steel door made with a special kind of steel that requires 100 years with a cutting torch to open. This can be done by writing very secure code.

Secondly, the police can't do anything about criminals located in other countries. What are the police going to do about a Nigerian or Russian hacker trying to break your system? Nothing. Laws are only effective inside a country, and in more extreme cases between countries with extradition treaties (where the crime has to be sufficiently grievous for prosecutors to bother with going through all the expense and hassle of an extradition). So on the internet, the only rational thing to do is build yourself a better "door". Complaining about the police not "chasing after" the Russian Mafia makes no sense; your local police have no jurisdiction in Russia, and that country is so corrupt that pursuing diplomatic channels isn't going to get your anywhere either.

Re:Can't stop crims, can fix holes

[DarwinSurvivor]

Apt, yum, pacman, etc are all used by thousands of users to update and patch their systems every day. What more could you possibly want?

Re:Can't stop crims, can fix holes

[DigiShaman]

Excuse me! If MS ever pulled a stunt like that, it would be published on Slashdot with thousands of readers keel hauling Microsoft for pulling a reckless stunt like that! Microsoft has no business nor responsibility for patching a 3rd party application that may break existing functionality. Not even Apple does this in their walled garden. At least not to my knowledge as a MacBook user myself.

I wouldn't mind if Microsoft provided warnings and notifications to users to seek out their respective 3rd party vendor for updates. But to actually hold Microsoft accountable for updating someone elses applications is ludicrous! No wonder shit breaks under Linux when an update rolls along. In fact aside from a hardware failure, 99% of the Linux horror stories involves updates breaking shit. That update policy sucks ass!

Re:Can't stop crims, can fix holes

[Shoten]

They can. It's called Systems Management Server. And it works. The reason Microsoft doesn't do it for free is because then they have to deal with all the headaches of any oddness of the software or installer. Oh, and they would also be paying for the integration and deployment costs too. This is not what businesses do for free.

Re:Can't stop crims, can fix holes

[sjames]

Again, we've been known to bend over backwards to get our laws imposed on people in other countries when the FBI's lords and masters (the *AA) want them to. Perhaps they should use some of that to go after actual criminals rather than autistic UFO nuts and Megaupload.

Most of the Nigerian scams could be handled by insisting that U.S. banks clear checks once and for all with foreign banks (as in no take backs) before they claim that a check has cleared. That won't help people who are determined to be ripped off, but it will help a lot of people. "Identity theft" could be killed dead by making banks take responsibility when they hand wads of cash over to strangers and letting credit agencies know that if they continue repeating gossip and hearsay as if it was somehow verified information, they WILL be on the hook for libel.

Re:Can't stop crims, can fix holes

[cbope]

You obviously do not understand the *nix updating process. In a vast majority of cases, it's not the OS vendor patching other software. The patches/updates are created and submitted by the owners (or more likely, maintainers) of the software that needs patching/updating. The patches/updates are pushed to the various distribution servers and are pulled in using a common updater process depending on the OS in question such as yum, apt, etc.

Yes, from time to time something breaks but that is pretty rare in my experience. MS has broken plenty of stuff from time to time with their updates, so what you propose does not prevent something from being broken and only keeps an additional hole open and available for attackers.

Re:Can't stop crims, can fix holes

[arth1]

I *actually* laughed when I read that! When Microsoft's updater can update software other than their own, THEN you can TRY saying that again.

Um, it can, and it does. It often tries to install old outdated nVidia drivers on my systems...

The problem with Windows Update is that there is no sane or timely way for producers of other software to get a patch in. And when they do, by the time the patch becomes available through Windows Update, it's already going to be several versions behind.

The other problem

[MrEricSir]

Security is one problem -- the other being that you'll get sued for using it. Just ask Microsoft and Google.

Re:The other problem

[Anonymous Coward]

Nobody got sued for using Java. Microsoft got sued because they called something that wasn't Java Java. Google got sued because they used the elements of Java, but not Java itself.

Re:The other problem

[binarylarry]

Google got sued because they made a lot of money selling a Java platform to consumers.

Which Oracle/Sun failed horribly for years at doing. (Java ME anyone?)

Fuck Oracle!

Re:The other problem

[Dr Herbert West]

These posts bear a startling similarity to some of the work of the late, great Michael Kristopeit, whose shadow you would probably cower under.

You're completely pathetic.



That was fun, let's do it again sometime.

Re:The other problem

[caywen]

Don't know who's right, but I do know that the Android developers I know basically call it Java. "Hey, how do you program apps for Android?" Answer is usually: "It's Java." "What's Dalvik?" Answer: "Oh, it's Google's own Java VM that runs on handsets."

Really. Programmers call it what it is.

Trying to get developers to get developers to differentiate between the Java platform and Java the language is asking us to put on legal hats that we don't want to wear.

And please don't misread this post. This isn't meant to at all say that what Google is doing is illegal. Just that when you make something that looks like A, acts like A, people tend to call it A, even though you tried to call it B.

This is a stupid article

[rgbrenner]

Java isn't insecure, criminals just aren't being punished.

That applies to EVERY piece of software. Why should Java get a free pass?

Re:This is a stupid article

[GIL_Dude]

Well, in the enterprise space you have a huge catch-22. I deal with this at work all the time. Since Oracle / Sun Java doesn't actually do patches (they just do full versions that introduce new features, break existing code, and deprecate other features), you can't deploy it. You have this trade off of known security vulnerabilities vs. enterprise software that won't work with the new versions. You have banks that require you to run Java versions that are a year old in order to move money. You have vendors whose code won't work with the current version of Java - ever (since they take longer to get their code working on new versions that it takes Oracle to release the next new version). We try as hard as we can to get app owners to test - but every last time we ship a new Java versions apps come out of the woodwork with emergency requests to "stop the push". You can't win. Bust people's critical apps and you lose. Allow machines to get owned by insecure versions of Java? Yeah, you lose there too. Oracle needs to figure out how to do security patches that just fix the vulnerabilities and don't introduce (and remove) features. Until they can do that - yes, it is their fault.

Re:This is a stupid article

[Sarten-X]

You mean the "java update" icon in the taskbar? The one that wants to update every few months?

Yeah, I ignore it, too... It seems every update is a few hundred megabytes, and I don't really want to pay attention to it long enough to tell it to install, then come back to follow up on it. Between all of the "time-tested" self-updaters for Windows, Adobe, Apple, Google, and a dozen more I could track down if I cared to, I'm sick of the whole self-updating thing. Why the hell don't we use RSS (or equivalent) for this yet, and be able to group all the updates together in a single interface, with a single "update now" button?

I guess that'll still be a Linux-only thing for another decade or so...

Re:This is a stupid article

[PCM2]

Yeah, I think the bigger problem is that the updates are weird. It's been a while since I've had Java installed on my main machines, but the way I remember it, you'd end up with a long list of updates in your Programs and Settings panel, even when they all have the same major version number. Like... you could keep Java 1.6.19 even when you uninstalled Java 1.6.12. And they don't seem to be patches, either... like, each one adds another 350MB subdirectory to some folder in your system disk, and they all just sit there like turds.

Then there was the time Oracle tried to bundle a McAfee "security scan" in the Java updates. That really inspired confidence. "Hey, I know -- let's interrupt this vital security procedure to push crapware from our marketing partners."

No, I think Roger Grimes is wrong -- folks can and will uninstall Java. I've been avoiding it just fine, and those bespoke Java applications that we're told all these Fortune 500 companies are sitting on will eventually be replaced with Web applications.

(None of this is to say Java doesn't have a strong future in the datacenter, though.)

Re:This is a stupid article

[Anonymous Coward]

In Apple's case, they had a perfectly good update mechanism, they just never released the patch.

Re:This is a stupid article

[Nimey]

One of our old packages required Java 1.5 to execute certain Crystal Reports queries but would otherwise function, and there's one still in use elsewhere that requires JVM 1.4_03 and nothing else; not _02 or _04; it will refuse to run with anything else.

Re:This is a stupid article

[Billly Gates]

It is not insecure at all. Perfect solution is here! Many IT departments are lazy, overworked, or are incompetent to the point that they have no clue old java is bad. Here is a way to never get hacked by java exploits again

Steps:
1. Only use IE and setup zones with a group policy. I know the Internet Explorer haters will want to mod me down faster than goatse but there is a good reason in my other steps if you read 2 $& 3 before modding me down.
2. Disable Java on the internet zone and enable only in the intranet and custom zones.
3. Add Bank of America, Royal Canada, ADP, etc, and other financial institutions or HR processing sites that require ancient java and probably IE 6 & 7 to the custom zone for java.

Optional
4. If the browser requirement sucks use Chrome for regular browsing that has GPO and doesn't support java at all. Or have IT put a script for FireFox that has java disabled by default if you have a really old version of IE that can't be updated. IE 9 is decent and modern and IE 8 is ok. It is only IE 6 that sucks and if your employer uses that then BOY Java is the last of your security problems.

Done. Java no longer a security threat. The last time I used java was in 2001 for some java chatrooms. I have never seen it in action besides for a few JavaFX demos on Sun's old website. No one needs at besides corporate intranet/banking websites.

I use Java unfortunately as I love Netbeans as a GUI and recommend it to slashdotters. I also have the Android SDK with Eclipse and I just do not have it in my browser on purpose. Java was so awesome 10 years ago and bad management ruined it and pains me to even write such a post. With proper IT procedures you can still use the older stuff fine and every single client site I have been to does not do this and it boggles my mind.

Re:This is a stupid article

[knorthern knight]

> Write once, run anywhere.. my ass...

Write once, write anywhere... that has Java 1.2.3.4.5 installed. Not 1.2.3.4.4 or 1.2.3.4.6. It *MUST* be 1.2.3.4.5.

That's Java's main problem. Back in the days of DOS, a BAT or COM or EXE file that worked on DOS 1 would work on DOS 2 and 3 and 4 and 5 and 6, unless it did some really braindead version checking. The vast majority of Windows apps survive service pack security updates. But many Java apps seem to break with each sub-minor version bump.

soo..

[Anonymous Coward]

We should legislate away our technical problems?
No thanks. It's been shown time and time again that not only doesn't it work, but it tends to make the technical problems worse.

If everyone thinks "i can just sue them later" them attention to security will drop even farther.

There are very good security systems out there that very few people and organizations bother to implement or continue.

Invalid argument...

[wbr1]

We punish drug dealers and users... they keep on pushing and using.
We punish robbers and gangsters... stores get robbed and people gangbanged every day.
We punish rapists and other sex offenders...new ones crop up.
We punish murderers and and wife beaters... people still get killed and wives beaten every day.

Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.
And somehow Grimes thinks that punishing crackers (not hackers.. I am proudly one of those), is going to make a difference. Even if you did manage to snuff it out in one place (highly unlikely), the internet is worldwide and you will have places with less lax laws or corrupt officials where those of a criminal bent can launch whatever they choose.
Most crime (not all)is cause by real or perceived poverty or other social disparity. Spending billions to incarcerate the underprivileged does nothing but further this disparity and create -more- crime.
Try looking at the world with empathy instead of greed and anger and try to lift people up. You may be surprised what a difference it makes.

Re:Invalid argument...

[Concerned Onlooker]

Well, it's not necesarily about deterrence. It's about accountability and keeping a criminal from doing the same thing again. That shouldn't be that hard to figure out.

Re:Invalid argument...

[dkleinsc]

Punishment it little if any deterrent. In countries with far less harsh criminal penalties than the United States, the crime rate stays about even to all other industrialized countries, even given the lesser punishments.

What is a strong deterrent, though, is a high risk of getting caught. For instance, if you put your criminal justice resources into hiring police, training them to be more effective at tracking down crimes, and building trust with the citizens (so they'll be more likely to volunteer information), that gives you a lot better results than putting your money into keeping people in prison longer for having a bag of weed.

Re:Invalid argument...

[wbr1]

It doesn't work at that either though. Many criminals would like a better life and a better chance, and don't want to make the same mistakes again. Not all, of course there are exceptions. But you take a man, put him in prison for 5 or 10 or 15 years at the prime of his life, give him some opportunities to learn, but most are bogus, and most of what is learned is -more- criminal mentality, and more hatred of -the system-. Then you put him out on the street with strict rules, little money, most of his family and friend have probably deserted him (if he had much to begin with) during his time in prison so he has little if any healthy support systems in place. No add to the fact that everywhere he turns he cannot get a job. If he owes court fines he may not even be able to get a drivers license until he can pay part of his fees, further limiting his chance of employment. Is it any wonder if he goes back to robbing stores or dealing drugs? It is what he knew and all he has left.
And even if you made him a ward of the state forever, now the state has weakened whatever family he had, and made it more likely for others in his family to follow the same path. And there will ALWAYS be more criminals to replace him.
So no, it is not about deterrence. It is not about accountability even. In the United States it is about making victims feel better, and about making money for the government. Bringing in tax dollars through fear.

Re:Invalid argument...

[Anonymous Coward]

Actually, most crime is the result of opportunity, not poverty. It's not so much class psychology or class deprivation (in the Western world real deprivation is uncommon), but that lower income people tend to live in communities where crime is easier because of 1) underfunded enforcement and 2) cheaper targets. Crime is an evolutionary strategy, and there's no reason to think that the genes aren't evenly spread throughout the society, especially considering how the lower and upper classes mix so readily through the generations. Place groups of rich and poor people in a 7-11 with the understanding that there's no surveillance and in fact no repercussions whatsoever (not even peers) if they steal, and the same number of people from each group are likely to shop lift eventually. Others will never shop lift, because they're reciprocity instinct is just too strong, and still others will fall in between.

That's why punishment is ineffective. The supposition held by a perpetrator is that he would not get caught. You don't need harsher penalties (no matter what the economists say); you just need better policing and fewer opportunities (in the software case, safer software).

Re:Invalid argument...

[C3ntaur]

In the United States it is about making victims feel better, and about making money for the privatized prison industry.

FTFY

story summary != story

[circletimessquare]

Title:

Why Elephants Are Large

Story:

An Elephant's trunk is very flexible. Even more amazing are the flexible snakes in the grass. Click this link to learn all about why bird's eggs are shaped the way they are.

Get away with crime?

[Toe, The]

Instead, we allow almost all cyber criminals to get away with their Internet crime without any penalty.

Beloved, this is not being true! I have sure-fire way to stop crimes and makes you not being victims of many internet crimes ever. Alls I needs is your passwords to your accounts, and I makes them very secures. Especially yours banks passwords accounts numbers, I very much promising. I extra interested if you been scammed before. I help most much.

To show I most sincere, I also give you free 500 Viagra pills extra-effective man-stick for your every account you wants me protect! Your woman moan against your amazing he umbrella many time.

The problem of accountability

[c0lo]

They (cyber criminals) almost never get caught and punished. Until we solve the problem of accountability, we will never get rid of the underlying problem.

Hang on... what about the accountability of the software producer? Oh, yeah, the DISCLAIMER in the copyright/license legalese... it passes the responsibility to deal with the effects to the users. So why are the users complaining?

Before you jump on my throat: I reckon the "social cost" of going after hackers would be higher than the cost of the "war on drugs" (even if only because a running software is intangible and the attack vectors are easier to anonymize).
Even more, the "cost of discovering/deterring/preventing the cyber criminals" will be supported from taxes, even if the bug allowing the exploited is caused by the software producer... feels like a great incentive to reduce the cost of quality assurance stages in a software project, by externalizing them to the society... that's what corporations are excellent at, ain't it?

Incompatabilities...

[linatux]

I'm sure Java would be kept a lot more up to date if version 'x' could still run software built when version 'n' was current.

Java Update for Windows sucks; Java's fault.

[Anonymous Coward]

The Java Update notification shows up in the tray (on Windows Vista and XP), you click on it and get an error message to the effect of Java couldn't be downloaded or installed. What I have to do is logout and log back in as the Admin. Now, it would be nice if there were some program in the Programs list were I could click on it and just do an update, or easily bring up the java console - like Windows Update is easy to find and run. With Java, I have to search the web or better yet, bring up a page with a java applet which then brings up the Java console and then I can update - because the auto update sucks.

Now, I understand about the permissions and all that because I have a similar problem with Firefox and other Mozilla programs BUT I can do a "Run As" and run them as an admin and continue with the install - not really a problem. Java, on the other hand, requires an entire new download and then installing - only from the Admin account and digging for the damn Console in the control panel. BTW, the Java icon can only be found in the "Classic" view. And if I, an ex-programmer IT person thinks this is a pain, I wonder how many people get the error and then forget about the update?

tl;dr Updating Java is a pain in the ass if you run your machine under a user account. Java needs an easier way to bring the Java console. And this security problem is Java's fault.

Not just unpatched Java

[Hentes]

The big security problem with Java software is that you can't differentiate between them since they all run on the jvm. For example, you can't block net access from a Java program in a firewall, because you would have to block the whole jvm.

Zero day exploits sure...but zero month??

[optimism]

Few successful Java-related attacks are related to zero-day exploits. Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes.

I'd like to see a reliable reference for this.

Would also like to know the impact of "zero month" exploits. Much more relevant, since Java's auto-updater pings once a month.

Personally I only use Java for a handful of local applications, and I always disable the auto-updater attack vector.

Penalties

[PPH]

Because we can't do anything. We're helpless (never mind keeping up to date on Java patches). It's all hopeless. We need authority to trace the criminals and possibly take preemptive measures to shut them down and seize their servers.

And then all you do is chase down people sharing Lady Gaga MP3s. Yeah, right.

what?

[circletimessquare]

there are people who grow up in grinding poverty who would never do anything unethical

then there are assholes like this:

http://en.wikipedia.org/wiki/Leopold_and_Loeb

very intelligent, very rich, and they decided to kill a 14 year old just for the hell of it. why? because evil is real in this world, and it exists independent of poverty, neither as cause nor effect, and independent of stupidity, neither as cause nor effect

class != morality != intelligence

there are poor people who are good

there are dumb people who are rich

there are smart people who are evil

mix and match to your heart's content and please get your simpleminded idiotic way you think about your world out of your head

we punish criminals on PRINCIPLE. it's not about deterrence. it's not about revenge. it's about morality

you'll get it some day, i hope

Re:what?

[wbr1]

The examples you claim are exceptions to the rule. I agree that you can mix and match those categories. You can find evil rich people (just look at the heads of the banks and most of congress).
But by and large, walk into any prison in America and take a census. You will find that at a minimum 70%-80% grew up in poor, broken homes with dysfunctional families.
If this country spent as much effort and resources in helping to fix families, in making sure children had proper role models, in truly ending poverty as it does on punishment, then the number of new prisoners would drop by half or more in 18-20 years.
However this is not in the interest of the powers that be. Both federal prisons, and most state prisons have contracts with private corporations where prisoners are employed for extremely low wages, in often unsafe and unmonitored and unsanitary conditions, with almost non-existent medical care, and the government gets a cut of the profit. Look at models like Virginia Correctional Enterprises.
In addition, in many states, prisons are a boon for state legislators of poor districts. Build a prison in their district and create jobs, and business to support the prison and it employees, get tax dollars to improve infrastructure, and more. It also has the effect of lowering the welfare rolls in the district where it is built.
I know the prison industrial complex from two different sides, and it is a corrupt, stinking beast whose purpose is not about PRINCIPLE, and if you think it is, you need to take a closer look around you and stop living in fear.

The Reason Why You Can't Dump Java...

[Xarun]

...because you need it to run Minecraft. Or am I missing something?

Re:If I could dump Java, I would

[catmistake]

But that isn't going to happen as long as we have $600K of Oracle ERP software running in the company.

dooooood.... don't you know it instantly loses the better half of its value the moment you drive it off the lot? Oracle software is like an oversized RV, or a boat, even a really nice expensive boat. It doesn't matter that it cost $2.4 million to build it, the day you bought it for that, it was really only worth half that, and after its been in the water, its often worth negative fortunes.

Unpatched Java? Blame the patching process!

[Wrath0fb0b]

Almost all are related to Java security bugs that have been patched for months (or longer),' Grimes writes. 'The bottom line is that we aren't addressing the real problems. It isn't a security bug here and there in a particular piece of software; that's a problem we'll never get rid of.

And so the appropriate thing is to see why in the heck we don't have all software always patched up to date. And the reason for that in Java is that it's bloody stupid updater takes 5 minutes and 10 clicks. Change it to be like Chrome -- background auto-update itself silently* with zero user input (or one click) -- and you'll have 99% of the installs up to date without issue.

To be clear, for the control-freak BOFHs, enterprisey people and hobbyists that actually enjoy computer maintenance, there should be a checkbox in options that says "Disable All Automatic Updating until I uncheck this box". If the user checks it, turn on the webcam and require them to raise their right hand and swear "I AM RESPONSIBLE FOR KEEPING THIS SOFTWARE UPDATED, ANY ILL THAT BEFALLS ME FROM NOT PATCHING IS MY OWN DAMNED FAULT AND I DESERVE IT". Make sure that preference persist between installs.

IOW, I'm not saying everyone has to do automatic silent updating, I'm saying that it should be the default setting unless the user expresses a desire to maintain it updated himself and is appraised of the risk of doing so. Let the user decide, but provide a better default behavior that's appropriate for most users.

One word why I can't quit Java

[isecore]

Minecraft.

And how do you know who picked a fight?

[SmallFurryCreature]

The big question in the case is who picked a fight with who. The person who called the police and campaigned on behalf of a black homeless person against a white sheriff OR the self proclaimed gangsta nigga (his own nickname). I wouldn't trust the bleeding heart side with this one, they also make much that the HISPANIC guy lived in a gated community, but so did the black guy. Apparently white guy in gated community, racist. Black guy in gated community, victim.

I think it is even odds that Travor wanted to go crazy n* on the dudes as, thinking he could scare him off. In holland a group of youth immigrants formed a gang called the "crazy foreigners" operating on the same method, trying intimidation, knowing any white victim would be wary of standing up to them for fear of racist charges.

We shall see in the court case what both sides claim really happened.

That's not how it works

[jcupitt65]

MS wouldn't be patching 3rd party software (you're right, that'd be crazy). MS would provide a general framework for maintaining installed software which 3rd party vendors could hook into.

Instead of every package implementing its own updater with its own background service and configuration system, they'd be one updater that everyone used which presented updates to the user in a central place. Instead of 10 badly implemented updaters, you'd have one good one.

This is what all linux distributions do and it works pretty well. I expect the win8 app store will do something like this.

I can an did and won't go back.

[TheSkepticalOptimist]

I pulled Java off of all my systems because of the incessant nagging of updates and the fact is would add 16 versions to the computer rather then updating a single version. I found that anything using Java on a desktop was not useful or missed anyways.

I've also gotten rid of Adobe (service) products for the same reason, ridiculously annoying install nagging and update process and yet another security hole with not much benefit. Silverlight too.

The only reason for a website to use Java technology these days is because "the fossil" a company hired 20 years ago refuses to learn something new.
The only reason for a website to use Flash is because they got a bunch of graphic designers who will crap their pants if they see an actual line of code.
The only reason for a website to use Silverlight is because Microsoft wanted fossils and graphic designers to use their platform instead.

As for updating, FTW would companies please adopt Google's model in Chrome of constant BACKGROUND updating rather then nagging "You have an update!" popup's or explicitly requiring to manually update. I love the fact that the software I am running is known to be current, relevant, stable, and secure without having to do anything but simply use the product.

The best way for a company or technology to become irrelevant is to constantly announce your failures and expect people to invest time and effort to fix them.