Polish Researcher: Oracle Knew For Months About Java Zero-Day

dutchwhizzman writes "Polish security researcher Adam Gowdiak submitted bug reports months ago for the current Java 7 zero-day exploit that's wreaking havoc all over the Internet. It seems that Oracle can't — or won't? — take such reports seriously. Is it really time to ditch Oracle's Java and go for an open source VM?"

Comments

But still people was using Oracle's java?

[Anonymous Coward]

But still people was using Oracle's java? O_o

Duh

[binarylarry]

You think Uncle Larry gives a fuck?

No. Now pay him his money.

Re:Duh

[hairyfeet]

Does anybody still use it? Its been awhile since I worked enterprise is why I'm asking, but the home and SMBs dropped Java years ago and I had heard most of the bigger corps went .NET for their backends.

Lets face it, like Adobe products Java has NEVER been good about security. People used them because they had to, not because they were safe. Hopefully HTML V5 will get feature parity with Flash and .NET or something else can replace Java and we can let them both just go away.

Re:Duh

[Culture20]

Yes, it's used as a browser plug-in by big names a lot. Some times, they're smart enough to restrict sites, but that's rare.

Re:Duh

[Jane Q. Public]

"... and I had heard most of the bigger corps went .NET for their backends."

Java is not primarily -- or even mostly -- for Web use. The vast majority of Java programs don't involve the Web at all. So yes, it is still used a lot. However, of course only the ones that are accessed via the Web are susceptible to the remote exploit.

Having said all that, I will reply to OP and say yes, it's time we started using a forked Java. In fact, most of us should have seen the writing on the wall from the actions Oracle took immediately after acquiring the rights to it. We're only a few years late.

Re:Duh

[buchner.johannes]

People managed to take OpenOffice away from Oracle.

Java is open source, why can't the same happen there?

Re:Duh

[dunng808]

Ask Google about that.

Re:Duh

[hairyfeet]

Wow look at how quickly I got modded down, must have been since I dared to say corps use .NET but since I don't have a horse in this race who cares.

But here is what I don't understand: Who DOESN'T KNOW Java is a security nightmare? I mean how many exploits have we seen in the past 5 years? Your four biggest security nightmares are Adobe Flash/Reader, Java, and IE. Time and time and time again we see attack after attack and its always those same four over and over and over.

So I have to agree with you 110%, if you need Java then it needs a good forking. Take it away from Oracle, have a group that makes Java security be the #1 priority, and support THAT instead. Because lets face it folks, Java was a security nightmare when Sun ran it and Oracle isn't doing any better of a job at fixing the mess than Sun did, no different than how Flash sucked for security when it was Macromedia and it sucks under Adobe.

So all these corps that have serious mission critical applications that need Java really need to form a consortium and work together to get a solid, secure, reliable Java replacement. Otherwise there is no point in complaining, Oracle is just following Sun's bad example.

Re:Duh

[Jane Q. Public]

"Because lets face it folks, Java was a security nightmare when Sun ran it and Oracle isn't doing any better of a job at fixing the mess than Sun did, no different than how Flash sucked for security when it was Macromedia and it sucks under Adobe."

Sure. The only thing I would add is that Sun java was either less exploitable, or that exploits have simply become better-discovered since being acquired. I actually lean a bit toward the latter, because Oracle does not have the sympathy of its own user base, and I can see them finding flaws, just to strike at Oracle.

Sooner or later, Page should get the clue that most people -- or at least most developers, who count the most here -- don't like him or his products very much.

Re:Duh

[hairyfeet]

You mean Ellison? Page is at Google. Bit of a Freudian slip there friend.

But actually I don't think its either, I think its the fact that they've figured out how to make a business out of exploits with the black market and exploit toolkits so the really insecure stuff is gonna get beaten like a red headed stepchild by the malware writers as its easy money. In the past exploits were more of a small crime, your script kiddies and spammers, but those toolkits are making big money so it gives them incentive to find as many zero days as possible and Java was and is an easy target, along with the others I named.

Re:Duh

[Anonymous Coward]

Ask Google about that.

1. Google handed Ellison his evil ass on a silver platter
2. Dalvik is NOT Java
3. Once all those stupid patents Oracle tried to use against Google are invalidated(and they will be), work on forking Java will likely commence, even though it really is not in the best interests of the platform.
4. There are multiple implementations of the runtime, compiler and API's already.

THEN NOT REALLY 0-DAY IS IT ??

[Anonymous Coward]

It's a ZenZaZhun !!

Re:THEN NOT REALLY 0-DAY IS IT ??

[Anonymous Coward]

Exactly. Bullshit like this all the nice big corps are into makes full disclosure the only sensible thing to do. And using free software.

http://en.wikipedia.org/wiki/Full_disclosure
http://en.wikipedia.org/wiki/Free_software

Wow. Time for a class action suit, then.

[reubenavery]

Pile on the attorneys and litigation.

is there any other way to teach these lazy monopolistic companies anything?

Re:Ditch Java entirely.

[binarylarry]

So your business model is:

1) Ditch Java
2) ???
3) Profit!

You and the underpants gnomes should hook up!

Re:Why only Oracle's Java?

[Chrisq]

Maybe it's time to ditch Java altogether!

Yes, I'll switch to Scala. It will run on my Java web server and allow full access to Java class lib ... oh wait!

Why are people still using this?

[DrEnter]

Seriously, it isn't even like Java is a particularly good language/environment. Frankly, I would rather deal with architecture issues and multiple platforms and just use C/C++ than put up with Java's issues.

Re:Why are people still using this?

[binarylarry]

You sound like someone who shouldn't be giving technical advice.

C/C++ has advantages over Java, just like Java has advantages over C/C++

Saying you should use one over the other for every purpose is foolhardy.

Re:Why are people still using this?

[Anonymous Coward]

Hey Larry, what's your surname?

Re:Why are people still using this?

[Anonymous Coward]

hah!

Re:Why are people still using this?

[gbjbaanb]

Apparently it wasn't Oracle ignoring the exploit, its just that the exploit happened to be found well outside the standard Java quarterly patch release. Pesky kids, if only they'd waited until a week or so before patch tuesday, everything would have been fine - I mean, you just cannot imagine the paperwork involved in moving that patch release date!

Anyway, I agree Java is not the best environment - if you want performance and resource efficiency, you use C/C++. If you want developer productivity you use any of the scripting languages. Java (and .NET) fall into a middle ground that is neither as good as C/C++ (for perf) nor as good as javascript (say)(for productivity). So there's no real reason to use it - unless you work for Oracle and then you cannot imagine the paperwork involved in changing to another language!!

Re:Why are people still using this?

[NettiWelho]

I'm currently doing my internship at the IT dept. of a joint-municipal group responsible for about 15k windows computers(mostly for schools, vocational schools and a uni of applied sciences) and today the department heads made the decision to uninstall java from all machines except those in lab networks disconnected from outside world.

Re:Why are people still using this?

[Sesostris III]

Out of sheer curiosity, what are the C/C++ alternatives to JEE and associated frameworks/technologies/containers (e.g. EJBs, JSPs, JSFs, Spring, Hibernate, Struts, GWT, Tomcat, JBoss, etc)?

Thanks

Re:Why are people still using this?

[Anonymous Coward]

just like Java has advantages over C/C++

[citation needed]

Re:Why are people still using this?

[Anonymous Coward]

Does it really matter how verbose a language is if it gets compiled down byte code? If it's good code, it doesn't matter. You have the same logic that managers have, i.e., counting lines of code is a measure of productivity. There's plenty to dislike about the way Oracle has handled Java, however, complaining that it takes too many lines to accomplish something is not one of them. My guess is that there's a Perl programmer out there who thinks C++ is bloated.

The complaint I see, but hasn't been verbalized, is that Oracle isn't making money off of the Java language so their technical support has failed. That's as bad as Microsoft screwing with the VB to VB.NET change. That's a reason to reconsider your programming language choice. However, nothing better has come along.

For now, Java is good enough.

Re:Why are people still using this?

[Anonymous Coward]

Until they buy in a piece of enterprise software that needs it...

Re:Why are people still using this?

[VGPowerlord]

There are some things in Java that are decent. It's just that none of them are on the client side.

Re:Why are people still using this?

[X0563511]

code performance critical portions in C/C++/Cython

Well, you just set off the "I don't know what I'm talking about" alarm.

What the fuck do you think you were using when you did the rest of the code in Python? Cython is Python.

Re:Why are people still using this?

[Anonymous Coward]

Why are people still using this?

Because it's the native development language for Android, my development platform of choice?

Sure I -could- use the android NDK, but why ditch the hundreds of thousands of man-hours of work that have gone into making fairly robust and damn useful libraries, and try and code up everything myself?

no thanks.

Re:Why are people still using this?

[Greyfox]

Native development with applications that retain their state from moment to moment. Now... you kids might have trouble wrapping your heads around this, but imagine for a second that you didn't have a web browser. Ok take a deep breath and don't freak out. Now, you use a GUI library like GTK or QT to provide the interface, instead. The user runs your application on his local system, and all or most of the data is stored locally. So instead of ALL those things, you'd use a user interface library like GTK or QT. They're kind of like Swing or AWT.

So I know what you're thinking; "Well then how do I talk to a database?" Well as it turns out, every database has a library that local applications can use to send SQL queries to the database. It's true! You can also roll a socket protocol to talk to damn near anything else on the internet. You don't even have to use XML if you don't want to!

Now, these applications are linear in execution, so you don't have to maintain a session state or anything like that. When you're in the application, you're just wherever you are in the application. This might take some getting used to.

Now I know what else you're thinking; "But Java is write once run everywhere!" Well your IT department has the same version of Windows installed on every system in your company, so what's the problem? If you use cross-platform libraries like Boost, GTK or QT, odds are good you'll just be able to recompile your binaries if you need to support Linux or OSX, anyway.

Re:Why are people still using this?

[Tanktalus]

Counting lines of code is a measure of productivity. The more lines I need to type to get the same work done, the less productive I am for that functionality. If I can do the same work in half the lines of code without sacrificing readability and maintainability (I'd argue that often these are improved by cutting out boilerplate), then I'm more productive.

Every time I have to look at Java, I boggle at the volume of text they have to write for the simplest things. And then I'm happy I do most of my work in Perl.

Re:Why are people still using this?

[Blakey Rat]

It's more accurate to say that Java shouldn't be used on the desktop. And ESPECIALLY not in a browser.

On the server, Java's not bad. (I'd still prefer something else, but I wouldn't fault someone for picking Java.)

On the desktop, I've yet to see a single application written in Java that didn't have huge flaws, even if you ignore the huge flaws in the JRE itself.

Re:Why are people still using this?

[Anonymous Coward]

So LOC is not a valid measure, unless I want to complain about a language, of course.

Re:Why are people still using this?

[Anonymous Coward]

I know you were trying to be clever, but since you asked:
https://en.wikipedia.org/wiki/Comparison_of_Java_and_C%2B%2B

Re:Why are people still using this?

[geekoid]

Perl is a horrid 'language' for readability and maintainability.

Re:Why are people still using this?

[gbjbaanb]

good honest work :)

All those things are artifacts of how crappy java is, in order to get anything done you need a metric ton of framework crap slapped on, and this is why people say "java is fast to develop in" - they mean, the frameworks make it faster to develop stuff, as long as you're developing exactly the kind of thing those frameworks are designed for. C/C++ world tends to have libraries that provide you with functionality you then plug in to your code, rather than having to code the way the framework wants you to (roughly).

You could use Ruby on Rails and get much better developer productivity, or Python, or node.js

As for C++, we don't tend to use EJBs - straight forward classes are fine, though you could use COM if you're on Windows (or COM+). The JSP frameworks are covered by either Microsoft's new Casablanca project or various web-server libraries like cppCMSS. C++ doesn't have much in the way of ORMs, preferring faster access to DB code but there are still plenty, eg ODB

For example, you need tomcat to host your java beans and pages, but C++ would just run off Apache - either as a mod_xxx module, or via pass though to a running service. A C++ developer wouldn't necessarily embed a webserver into his code, instead expecting to reuse the existing web server infrastructure.

Generally the best place to start looking for C++ libraries is Boost. From there, just use google for what you need.

Re:Why are people still using this?

[VGPowerlord]

Yes, clearly the answer to someone asking what we can replace specific web technologies (the one thing Java is good at) is to suggest building local apps (one of the things C/C++ is good at).

Hey, can you compile a version of your replacement app that runs on iOS? Android? Windows? Linux? OSX? FreeBSD?

If you answered no to any of those, *bzzt* sorry, your solution has lost potential customers and is rejected out of hand.

Re:Why are people still using this?

[geekoid]

"Well your IT department has the same version of Windows installed on every system in your company, so what's the problem?"
have you ever worked for a large organization? Ever looked t costs of this?

Web applications have a lot of advantages over stand alone. It's a matter of risk/cost.

And I have been a software engineer for decades. Not that it makes me right or wrong, only that I understand the pre-internet software world as well as the internet transition phase.

Re:Why are people still using this?

[godefroi]

If the limiting factor to your programming productivity is the speed of your typing, then you either need to A) use more than one finger to type, or B) write more interesting programs.

Re:Why are people still using this?

[Anonymous Coward]

It's Page, you anonymous clod!

Re:Why are people still using this?

[Anonymous Coward]

If typing is the bottleneck to your efficiency, you either have some form of hand disability, or you are a truly awful programmer.

That said, I'm all for eliminating boilerplate. But that is for the sake of readability and maintainability, not to save keypresses.

Re:Why are people still using this?

[Anonymous Coward]

I think the implication was that the security risks and other issues with Java go a long way towards negating any technical advantages Java would otherwise have, and I'd tend to agree.

Re:Why are people still using this?

[Anonymous Coward]

Python? Python's written in C and probably a great deal smaller than any of the stuff you mention. You can use Django or any other web framework on top.

Re:Why are people still using this?

[Anonymous Coward]

It is possible to write beautiful, maintainable perl.

It is not possible to write concise Java.

Re:Why are people still using this?

[Pieroxy]

Can you elaborate on what is awful about the Java platform? And no, lack of an open source option is NOT one of the drawbacks since Java has those as well (which is not true of C# btw where the open source alternative is not really operational).

Now, before you jump in realize that I'm not asking about JAVA APPLETS, but about the Java platform.

Go.

Re:Why are people still using this?

[pointyhat]

*choke* OpenJDK?

Re:Why are people still using this?

[Dishevel]

Other than allowing lazy people to kinda get stuff done what are the advantages of Java over C/C++?
Are any of those advantages big enough out weigh the elephant in the room which is Oracle not giving one shit about Java and the massive number of security holes?

Re:Why are people still using this?

[Pieroxy]

Good desktop applications are rare in Java, and the only ones I'd recommend are developer tools anyways: Eclipse, SmartSVN.

The only drawbacks are startup times for me.

Re:Why are people still using this?

[SuricouRaven]

A program that tries to do all things does them all poorly.

Re:Why are people still using this?

[Pieroxy]

You have a far bigger problem with local apps. The problems are your APIs. You have (presumably) a web server somewhere serving data to your local apps. And every time you will release a new version of your app, you will also release a new version of your API. But you also should remember to keep the old one working, because guess what: Some people will upgrade, and then some will not.

All of a sudden, you have your server and a gazillion apps out there, some more or less buggy than the others.

THIS is the biggest benefit of a web based app, not the reach of the 1205 users of FreeBSD. You have a bug? Fix it. Instantly, no one has a bug anymore. THAT is convenient.

Re:Why are people still using this?

[elfprince13]

What the fuck do you think you were using when you did the rest of the code in Python? Cython is Python.

Well, you just set off the "I don't know what I'm talking about" alarm. Cython is a derivative of Pyrex, neither of which should be confused with CPython. And of course CPython is not Python either, it's the reference implementation of an interpreter for the Python language.

Re:Why are people still using this?

[Anonymous Coward]

"Does it really matter how verbose a language is if it gets compiled down byte code? "

Perhaps you should switch to COBOL.

Re:Why are people still using this?

[Anonymous Coward]

Are you suggesting that there are no lazy C/C++ programmers?

(ugh, I think I just spilled my drink laughing)

Re:Why are people still using this?

[TheDarkMaster]

The fundamental problem is to encapsulate the code in a VM when this code could use the native features of the operating system and hardware (such as a good old C application).

Running the code in a VM is OK for a server, but it is a disaster (in terms of resource usage) for a desktop.

Re:Why are people still using this?

[Anonymous Coward]

Performance. Flash may be pure hell, but at least it runs, and doesn't bring one's Web browser to a lurching halt like Java does.
JVM hell, where something that works on one JVM may not work 100% on another.
Platform differences. Same JVM might run code on Windows, but will break on a Mac.
Apparent neglect of the platform by Oracle.

Re:Why are people still using this?

[KlomDark]

Have you worked with C# under the .NET 4.x framework now that they've added Entity Framework to it?

It is so much more efficient that any other data access abstraction I've ever seen. It even makes Hibernate/NHibernate look like a lame hack.

I am able to do extremely complex things with 10% of the amount of code I used to have to write.

Microsoft might be making a LOT of mistakes lately, but Entity Framework is not one of them. I don't know if I'll ever have the patience to use another language again - C# with Entity Framework is that much better.

Re:Why are people still using this?

[lindi]

JOSM (Java OpenStreetMap editor) is not too bad Java application either. It is constantly improved to meet the demands on the mappers but still manages to stay fairly stable.

Re:Why are people still using this?

[binarylarry]

You have provided some terrible answers. Please stop posting about technologies when it's clear you have little technical knowledge.

Java is much, much faster than Flash.
The JVM set bundled with OpenJDK is the same as the one bundled with Oracle Java (Oracle Java is built on OpenJDK)
Java is cross platform, it's worked reliably for a long time
Java is open source, so blaming Oracle for slow development isn't fair (not that I like them, Fuck Oracle)

Some things that suck about Java:

No runtime generics
No lambda support
You have define your maximum heap size when the application is started
AWT and Swing are the official UI technologies and they're fucking terrible
It's very hard to port to platforms where it doesn't exist already

Re:Why are people still using this?

[Anonymous Coward]

Does it really matter how verbose a language is if it gets compiled down byte code?

As others have said, verbosity is the antithesis of productivity. Productivity also directly translates into dollars. Thusly, the less productive one is, the more expensive a project becomes. As such, from the comparison above, projects coding in Java are more likely to be more expensive than projects coded in C/C++ and especially Python. Not to mention, its more likely the Java project will take the longest to deliver, with C/C++ coming in a little more quickly, with Python being yet ahead of that.

Verbosity definitely matters for programming languages.

I also find it interesting that a good thread came of someone's account and yet it was troll moderated. Sorta blows a hole in the theory it was a troll post. Oh well, troll moderation is simply a disproportionate element of moderations on slashdot these days.

Re:Why are people still using this?

[Anonymous Coward]

javascript? productivity? I can beat you with .NET framework any time.

Re:Why are people still using this?

[Blakey Rat]

Ignoring for a moment Eclipse's awful UI, its entirely broken in Windows because of the way it handles (or rather, fails to handle) per-user special folders. Last time I installed it, it basically engaged in a DoS attack against every other app trying to use named folders.

Re:Why are people still using this?

[Anonymous Coward]

No, he's implying that those lazy C/C++ programmers don't get stuff done.

Re:Why are people still using this?

[fahrbot-bot]

Good desktop applications are rare in Java ...

Blame the developer - company and/or person - not the language.
My Java applications are rock-solid, perhaps helped by my 25+ years of sysadmin and systems-programming background.

Re:Why are people still using this?

[Blakey Rat]

If "manages to stay fairly stable" is literally the best thing you can say about it, it's shit.

Re:Why are people still using this?

[Anonymous Coward]

perhaps you weren't around for the days when every program had direct access to hardware.

take my word for it, it was -not- good times.

Re:Why are people still using this?

[Pieroxy]

To be fair to AC, Java is dead slow to start up. Once it's up and running there are no issues anymore, but on the desktop, the startup time is pretty bad.

Also, IIRC, I think there are still a few libraries that are not open source (and that don't work well in OpenJDK)

Re:Why are people still using this?

[Anonymous Coward]

Java is open source, so blaming Oracle for slow development isn't fair (not that I like them, Fuck Oracle)

Java is open source in the sense of "watch boy see the source code ?" but you can't extend it, not without Oracle's ok. Did the whole Harmony fiasco (about the use restrictions and not giving the Apache project the compatibility toolkit) just wooooooooosh by you ?
Oracle doesn't give a SHIT about making Java ready for the desktop, and it sure doesn't give a flying fuck about improving the language. As a language for server/infrastructure applications yes it has its place. On the desktop not by a long shot.
My only regret is that a beautiful language as Scala has been implemented on the jvm instead of going the native route. By now we could have ditched C/C++ and enter into the modern era of computer languages.
Oh well, until that time C++/Qt will have to do.

Re:Why are people still using this?

[Tanktalus]

I type ~60 wpm for normal text, and writing code is not much worse. Try again.

Re:Why are people still using this?

[VGPowerlord]

You have a far bigger problem with local apps. The problems are your APIs. You have (presumably) a web server somewhere serving data to your local apps.

Actually, the GP addressed this by having the local apps talk directly to the remote DB, which means you'd have to have a separate DB account (with proper permissions, since you no longer have a web app doing security checks first and you can't trust any data coming directly from the client) for each and every user of your system.

Re:Why are people still using this?

[Anonymous Coward]

Ya, everyone should just use PHP.

Re:Why are people still using this?

[binarylarry]

Why would you fork OpenJDK and then want a TCK like the Harmony project did?

Scala is just C++ for the JVM. It's got the same schizophrenic feature set that makes it a terrible language but without the upsides of C++ (great performance and memory usage).

If you want native Scala you already have it, it's called C++.

Re:Why are people still using this?

[Pieroxy]

Swing is anything but simple. I'd dare call it fragile. It's not a library you can just jump in and program with. You need to understand the intricacies of the threading model before you can start soing anything good with it.

Hence, I still can blame the language from coming with an overly delicate UI library.

And yes, it is perfectly possible to make a good app with swing.

Re:Why are people still using this?

[Anonymous Coward]

If the limiting factor to your programming productivity is the speed of your typing, then you either need to A) use more than one finger to type, or B) write more interesting programs.

And for that reason God created lisp macros. To tame boilerplate code.
And java has nothing but boilerplate code for even the simplest things, and it doesn't have macros.
If I'm paid for writing java code then sure I'll do it. In my free time though it will freeze in hell before I code even a single line in java for my hobby projects.

Re:Why are people still using this?

[VGPowerlord]

It really depends on what you're doing. If you're developing a database-backed website, I suspect that the Java solution* would be the quickest to deliver, followed by Python with C/C++ coming in dead last.

*That is assuming that the dev team uses appropriate technologies such as Spring and Hibernate, and not straight Servlets/JSPs/JSFs and JDBC.

Re:Why are people still using this?

[FloydTheDroid]

All those things are artifacts of how crappy java is, in order to get anything done you need a metric ton of framework crap slapped on

A C++ developer wouldn't necessarily embed a webserver into his code, instead expecting to reuse the existing web server infrastructure.

I'll never understand why anyone thinks that having a large framework available is bad? Just because they supply you with a framework doesn't mean you have to use any of it at all.

Saying that java is crappy because it uses libraries but then you proceeding to list libraries for C++ doesn't make sense. We don't develop green screens of text anymore... there's nothing wrong with using libraries or the best tool for the job.

Re:Why are people still using this?

[Pieroxy]

That's not addressing the problem, that's doing it wrong. I mean, imagine facebook with a policy like that. How do you scale?

Re:Why are people still using this?

[Anonymous Coward]

Why is it that whenever I see a criticism of Java, it's almost always a poorly informed one? You don't have to use the framework, but the web frameworks will most certainly make your life easier. There's a ton of them, and at the very least they're generalized down to the request/response, so it's hard for me to believe you couldn't find a framework that doesn't help you out quite a bit with some part of your project.

I find your comment about how you "need tomcat to host java beans and pages" but for C++ you can "just run off Apache" to be a very odd comment. It' would seem that you personally aren't familiar with Tomcat, and are familiar with Apache. That's a pretty poor reason to tell other people to use one tool over another. I've used both, and they both have strengths and weaknesses just like anything else.

Re:Why are people still using this?

[Anonymous Coward]

Seriously, nobody says development has to occur in Java. But it's not like the end user necessarily has a choice in the matter. And I'm far more worried about the stuff my people have to use from third parties - I can't just "turn off Java" or migrate to something else without significant time/money that I don't have to spend. ("Won't somebody think of the USER?" :D )

And I'd guess, paraphrasing Robert Heinlein, that the answer to most all questions starting with, "Why?" is, "Money."

Re:Why are people still using this?

[VGPowerlord]

All those things are artifacts of how crappy java is, in order to get anything done you need a metric ton of framework crap slapped on, and this is why people say "java is fast to develop in" - they mean, the frameworks make it faster to develop stuff, as long as you're developing exactly the kind of thing those frameworks are designed for. C/C++ world tends to have libraries that provide you with functionality you then plug in to your code, rather than having to code the way the framework wants you to (roughly).

You could use Ruby on Rails

Hypocrisy detected! Please check the highlighted sections.

Re:Why are people still using this?

[RabidReindeer]

Performance. Flash may be pure hell, but at least it runs, and doesn't bring one's Web browser to a lurching halt like Java does.

No, it just causes my browser to slowly scroll to the ends of very long pages with no way to regain control over that or any other browser window until it's done, short of killing the browser itself and all browser windows, downloads, etc.

As for Java version and platform issues, I call BS. Java is the ONLY programming environment (not just language) that I know of that has explicit deprecation mechanisms built into the core spec so that things will continue to run long after they're obsolete. And anyone who's writing OS-specific code in Java applets doesn't deserve the 13 rupees/hour that they were paid to do so. Java was explicitly designed to be OS- and hardware-independent. They even sued Microsoft - and won - in the battle to make SURE it stayed OS- and hardware-independent.

Re:Why are people still using this?

[Anonymous Coward]

On the other hand, the very same thing is the biggest disadvantage: You accidentally introduce a bug? Instantly, everyone will have the bug. And not even have the option to avoid the bug in return of reduced functionality.

What you are producing is effectively a monoculture. And monocultures are very prone to infections. Yes, the old version someone is running will have bug X which you eliminated in the new version. But at the same time it will not contain bug Y which you introduced at the same time, and which you probably don't even know about. So some people will be affected by bug X, but not bug Y. Others will be affected by bug Y, but not bug X. So unless an attacker targets both X and Y, no matter which of the attacks he chooses, he'll be successful only for some of the targets.

Not to mention that with web applications, you still have to deal with users using different local software, namely the browser; just that you don't make that software yourself and therefore don't even have control over their security problems. And since that software is also used to access a lot of other web services, you can be sure that it is a much more likely target for exploits than a self-written local client.

And finally, if you have to change (as opposed to simply extend) the API each time you release a new version of the client, IMHO you've done something wrong.

Re:Why are people still using this?

[RaceProUK]

No runtime generics

I seem to remember generics being added in SDK 1.5, but maybe I'm thinking of a slightly different type of generics to what you're thinking.

Re:Why are people still using this?

[Anonymous Coward]

Such a comment suggests you're not aware of the Python frameworks which makes things like that trivial and fast. Its extremely unlikely Java would score the win there.

Re:Why are people still using this?

[binarylarry]

Yep there are compile time generics in Java, but they're stripped out when compiled to bytecode. So at runtime, they don't exist.

It's not as big of a deal as some .NET pundits would claim (.NET has runtime generics) but it'd be nice.

Re:Why are people still using this?

[Anonymous Coward]

You sound like someone who shouldn't be giving technical advice.

C/C++ has advantages over Java, just like Java has advantages over C/C++

Saying you should use one over the other for every purpose is foolhardy.

Was it advice or an opinion? Who first used the phrase "for every purpose" .. was it the parent or was it you?

After what happened with Andriod I'm done with Java for good. mono/.NET are technically superior anyway. I would rather deal with MS than Oracles endless litigation and piss poor security record.

Re:Why are people still using this?

[oakgrove]

Personally I like the Eclipse UI but blaming your dislike for it on Java seems a bit misplaced to me. IntelliJ and Netbeans are both written in Java and lots of people rave about them. As far as other popular applications written in Java there is Azureus, Oxygen XML, RSSOwl, Matlab, and plenty more. I'm sure you can nitpick them all but the same goes for applications written in any other language.

Re:Why are people still using this?

[Anonymous Coward]

There is nothing "trollish" about the post. Someone shared their experience and their conclusion. In the good old days, the post would have likely been moderated up whereby both sides would have a say, allowing for others to draw their own conclusion. Now what we know is that the post is likely completely trustworthy (as I've repeatedly seen like results elsewhere over time) and that the Java camp simply wants it suppressed. Things have certainly changed on slashdot.

Perhaps most moderators these days simply don't realize they are themselves a troll via troll moderation.

Re:Why are people still using this?

[Blakey Rat]

I haven't tried IntelliJ, but Netbeans can't even render a font in the correct size. Seriously. It's that awful.

Re:Why are people still using this?

[Anonymous Coward]

P'shaw, all you have to do is use java quickstart. On my PC JQS was somehow performing about 10GB of reads per day. So everything that needed to hit the HDD ran with long random delays. But at least java things started quickly, right?

Re:Why are people still using this?

[Pieroxy]

Of course, you have the pros of your cons.

And finally, if you have to change (as opposed to simply extend) the API each time you release a new version of the client, IMHO you've done something wrong.

However, with AJAX you don't have to do that anymore. You can very well release a new API without touching your UI and you can release a new UI without releasing new DATA API. Look at gmail for example. They now have at least 5 different UIs (mobile, new, old, pure html, tablet, ...), and trust me, they have only one DATA API.

As surprising as it may seem, the web has evolved since 1995.

Re:Why are people still using this?

[oakgrove]

It's not really about laziness but about developer time = money. Java is faster to develop in than C and in the server environment it excels in, performance is really good. And Java Applets are a business staple that makes a lot of sense in a distributed corporate environment. There are also a ton of libraries for just about anything you're likely to ever want to do so why wouldn't you use it?

Re:Why are people still using this?

[Anonymous Coward]

The "advantages" of Java are slim-to-none, especially when weighed against its disadvantages.

My biggest complaint about Java has always been the stdlib, but now that it has the taint of Oracle I'd rather implement low-level code in C and business logic in a "sane" language like Python.

Re:Why are people still using this?

[Anonymous Coward]

C# has a very strong R&D platform behind it: Microsoft Research Cambridge and Haskell, in particular. Quite a few of the new toys to come into the .NET platform have been from there: LINQ and now the Entity Framework, plus the fairly impressive type system present in VS2010+.

Too bad they can't make up their mind if WPF is a good thing or not...

Re:Why are people still using this?

[zeroryoko1974]

A friend of mine was taking Java programming in college. The professor said to learn java, to first learn C, and then forget half of what you knew.

Re:Why are people still using this?

[Anonymous Coward]

Java was explicitly designed to be OS- and hardware-independent. ....

I take it then that you've never tried to write Java code that needs to communicate with USB or Serial devices. It cannot realistically be done in an OS independent manner.

Been there, tried to "done that". Decided to shoot myself instead *

Truthfully, it CAN be done. But it's a huge PITA.

* Well, almost.

Re:Why are people still using this?

[Nadaka]

Memory footprint is Java's other issue.

It's not so bad now that desktops have multiple gigs of ram, but on mobile and embedded systems it can still pose problems.

Re:Why are people still using this?

[Nadaka]

This is true, because they are too busy trying to track down the memory leaks they caused.

Re:Why are people still using this?

[fdrebin]

I agree with AC who said it is possible to write beautiful, maintainable perl. I have done so, and worked on a team of 6 writing nothing but perl for 2 years, and our code was as clean or cleaner than most of the C & C++ I've been involved with over the past few decades

I will also agree that it is also possible to write perl that is practically indistinguishable from line noise. It just takes discipline.

/F

Re:Why are people still using this?

[Anonymous Coward]

GORM is way easier:

class Person {
        String firstName
        String lastName
        Date dateOfBirth
        Date dateOfHire

        static constraints = {
                firstName blank: false
                lastName blank: false
        }
}

Re:Why are people still using this?

[Wootery]

Wrong.

Cython is a language that makes writing C extensions for the Python language as easy as Python

As for your "reference implementation" pedantry, it's clear in

What the fuck do you think you were using

that he's referring to CPython being the most widely used Python implementation, and that it's implemented in C.

That's not to say AC is correct, though: performance is a valid reason to rewrite Python code in C.

Re:Why are people still using this?

[Anonymous Coward]

Its extremely unlikely Java would score the win there.

You spelled "laughable" wrong.

Re:Why are people still using this?

[davewoods]

Not always, I think it depends a lot on the relativity of it all.

Back when IM was a big thing, everyone was using multiple chat clients, then GAIM (Now Pidgin) came around and rolled everything into one nice package. The program itsself had a few bugs, i.e. "Fairly stable", but given the alternative, it was vastly superior to running multiple chat programs to have access to all the various protocols I required.

Back then, I somehow managed to find friends that used AIM, MSN, ICQ, and Yahoo. I had to have some way of communicating with them without blocking off 90% of my 15" screen real estate, and the "Fairly stable" GAIM was the ticket.

Re:Why are people still using this?

[Anonymous Coward]

I thought the same thing about 9 months ago. Now that I've had to use it on databases that are not MsSql, I won't touch it for anything but the most quick and simple applications.
I've heard from the community that EF usage normally goes:
1. How does this work? I'll try using it for simple things.
2. This is awesome I'll use it everywhere.
3. Oh crap, I have a moderately complicated query and it's taking 14 hours to execute. Rewrite it in ado and it takes 18 seconds. (not an exaggeration)
4. Oh crap, this query is actually time sensitive, I'll just hand code that one. No prob.
5. Oh crap. Deploying it to prod on a machine without my exact version of EF. I'll have to hand edit xml.
6. Oh crap. 3 months later someone added a non-null field to a table and EF needs it's .edmx files regenerated because it's crashing instead of inserting the default value.
7. Oh crap. When i regenerated the .edmx files I forgot to hand edit the xml again. It's been x months, how do I do that again?
8. Repeat 5 and 6 a couple times.
9. Screw this I'll just use PetaPoco/Dapper/Massive for these common tables that get their definitions changed a lot.
10. I'm starting a new project and it's going to be important. Screw EF.

Re:Why are people still using this?

[Anonymous Coward]

I'm pretty sure this quote will fit in quite well here:

“Programming is like sex: one mistake and you have to support it for the rest of your life.” Michael Sinz

To think that even in the web environment a "fix once, solve everywhere" attitude will get you anywhere is still foolhardy. Granted IE is slowly, grudgingly, becoming more and more standards compliant, there are still issues between OS', and between browsers. The "oooohhh shiny red ball" distractable PM's and managers still want something sparkly like flash on their website, you've just screwed iOS, android, and linux users at a minimum, especially if you want to keep it up-to-date on versions of flash. You want some greater interaction with the users computer via activeX? You just screwed anyone not running Windows, and even some people running older versions of Windows. Want it to be "secure" via some active OS-handled authentication token (i.e. a smart card login), you're stuck with Windows.
 
  Point being, you need to really define your audience. Its true that many organizations will cater to their own disk image for things such as timecard entry, but for the majority of those that want to sell their wares to anyone and everyone, they need to make sure their message, shiny red ball and all, can be seen by anybody, anywhere, on any device, running any OS.

You may consider Java to be a panacea for that, but it has been my experience that even something that is multi-platform such as Java, the look/feel/behavior of the same base code across multiple OS's will drastically change. Not to mention that for most people I know, as soon as they try to navigate to a site and see "Java update required", to go somewhere else. The customer doesn't care how easy it is for you to fix a problem, they care about being able to buy what they want, when they want it.

Re:Why are people still using this?

[Anonymous Coward]

"Once its up and running" in my experience the JVM is still much slower that a native app, not to mention it will consume and keep as much RAM as possible.

Re:Why are people still using this?

[gbjbaanb]

I make a distinctions between a library - where code is available for you to plug into your code, and a framework where your code has to be plugged into it.

Sure they both provide features to make your life easier, pre-rolled code, the distinction is how they do go about it. Frameworks nearly always expect you to do things their way, but if you need to go beyond that, the framework starts to hinder you. a library doesn't have that flaw.

Re:Why are people still using this?

[elfprince13]

What are you ramblng about w.r.t. to Cython? It is a derivative of Pyrex, and it should not be confused with CPython. Being "easy as Python" is not the same as Python - and having written a good deal of both Cython AND Pyrex code, I can tell you they aren't nearly the same language as Python (support for strong typing, for example). And the AC could very well have been working with Unladen Swallow, IronPython, Jython, PyPy, etc. None of those CPython, but they are also implementations of the Python language. Don't use equivalence relations for things that aren't equivalent.

Re:Why are people still using this?

[bondsbw]

.NET 4.x is a great development platform even without Entity Framework (which I don't use or need to use). It stands heads and shoulders over Java in probably every way except cross-platform compatibility, which is not a use case for which I develop.

Re:Why are people still using this?

[metamatic]

On the desktop, I've yet to see a single application written in Java that didn't have huge flaws, even if you ignore the huge flaws in the JRE itself.

Try jEdit.

Re:Why are people still using this?

[maxwell demon]

Perhaps most moderators these days simply don't realize they are themselves a troll via troll moderation.

So you say that's not the purpose of the "Troll" moderation? Then why does it say "Troll"?
Next you'll tell me that "Funny" moderation is not about the moderator being funny!

SCNR :-)

Re:Why are people still using this?

[VGPowerlord]

Was it advice or an opinion? Who first used the phrase "for every purpose" .. was it the parent or was it you?

It was implicit when the GGP suggested using C/C++ instead of Java.

Re:Why are people still using this?

[VGPowerlord]

We were talking about using Java on the server side, not the client side.

Thanks for playing, though!

Re:Why are people still using this?

[Jonner]

You sound like someone who shouldn't be giving technical advice.

C/C++ has advantages over Java, just like Java has advantages over C/C++

Saying you should use one over the other for every purpose is foolhardy.

You can develop web site extensions in C++. It's a new-fangled technology called "ActiveX" and it's much more secure than Java applets.

Re:Why are people still using this?

[Fender Gibson]

How about Eclipse? I think that's pretty good...

Re:Why are people still using this?

[Jonner]

I'm currently doing my internship at the IT dept. of a joint-municipal group responsible for about 15k windows computers(mostly for schools, vocational schools and a uni of applied sciences) and today the department heads made the decision to uninstall java from all machines except those in lab networks disconnected from outside world.

It sounds like you're really interested in security, so while you're at it, uninstall Internet Explorer too.

Re:Why are people still using this?

[Pieroxy]

Java Applet are a horrendous piece of crap. Everyone agree on this. Even on this thread. Thanks for playing though.

Re:Why are people still using this?

[Anonymous Coward]

Rather harsh as this (as I recall) is only a problem with the Java-plugin for the browser? And now all use of Java is iradicated? Not a very educated desicion...

Re:Why are people still using this?

[Anonymous Coward]

If Java programmers knew anything about computers they wouldn't be Java programmers. It can be hard to tell if Java is inherently a slow language or just that competent people fight to the death to use something modern.

Re:Why are people still using this?

[theshowmecanuck]

I knew a guy who preferred to right web apps in C as opposed to servlets, php, perl, whatever. This was in 2005. He did them for the corporate internal site, and they were pretty good. Not saying I would, but it does break the mold on what people think can or should be done.

Re:Why are people still using this?

[theshowmecanuck]

right... right... write... right

Re:Why are people still using this?

[blippo]

Wait, what?

Have you ever tried compiling a couple of years old C++ code? Or actually compiled any code at all?

Java's best strength is the platform - the well defined vm-spec and the rock-solid api that is almost totally backwards compatible.
The language itself is stringent, which is really nice except in those places that it's causes som verbosity.
The jvm:s are quite nice, fast and with good gc.

The biggest problems are the lack of anonymous methods, and it's large userbase that includes a lot of morons, beeing an enterprisy language...

The GUI integration on the client side, sucks though. Even a simple thing as naming runnable jars as jxe is not thought of...

Re:Why are people still using this?

[Anonymous Coward]

I work with C# day-in and day-out, and I've found the Entity Framework to be somewhat of a pain in the ass.

- You're limited to LINQ, which is a poor replacement for SQL.
- Referential integrity is a joke. SQL enforces it one way, EF enforces it another. The two methods often conflict.
- You can't drop back to a basic SQL query without going back to ADO.NET anyway.

Maybe I'm just old-fashioned, but I find it much easier to use a SQL Server project in Visual Studio to build tables, stored procs, functions, etc. and then have a nice way to deploy all of that. Just right-click the project, click "Deploy", and watch VS make a schema file, compare it to an existing database, and merge all of your changes into a live database. It doesn't get any easier.

System.Data.DataTable is more of a tool than a system. There are few restrictions on how it can be used, and it can be a handy replacement for more finnicky data structures (like hashtables, dictionaries, and nested lists). It also "just works" with 99% of anything that can be data-bound, including WPF stuff.

I agree with you on not having the patience to use anything but C# (without a damned good reason). It really is that much easier than everything else, including its spiritual predecessors, C and Java. Also, the part about Hibernate being a hack... most ORM's are. They're a perfect example of the "sausage and code" principle.

Re:Why are people still using this?

[blippo]

I needed more control over the serial port than the available serial libraries could give, so I rolled my own.

It took me a couple of hours to implement a jna wrapper around linux terminal interface, without any suicidal tendencies, and I
ended up with 700 lines of code... It's yours if you wan't it....

JNA is quite nice, actually.

       

Re:Why are people still using this?

[Anonymous Coward]

Cool. Where can I download slashdot.jar?

Re:Why are people still using this?

[Anonymous Coward]

The biggest problem with Swing is that it is terrible for battery life, at least in the Apple version, where running a single swing app cold halve battery life under OS X 10.7.

Re:Why are people still using this?

[Compaqt]

Are you referring to the fact that you can't call into the GUI libs when you're handling events?

Other GUIs work like that, too.

Re:Why are people still using this?

[Anonymous Coward]

List of differences, not a list of advantages.

The list contains things like Java running in a VM, which means that when there is a security hole in the VM, causing you (or your admin, who cares more about security than you) to uninstall it, every fricking Java program stops working. When you uninstall Skype, Word doesn't stop working, but with the Java VM, every single Java program is useless.

Re:Why are people still using this?

[Pieroxy]

From what I remember, you can call the GUI lib in an event handler. You can call anything, but while handling the event, the UI is frozen. What you cannot do is modify the state of a GUI object while in any other thread than the "Swing Thread". The "Swing Thread" is the only thread allowed to touch anything UI related.

The result is that you end up with countless anonymous "runnable" classes that you feed the Swing Thread for later execution.

The concept holds water, but it is a pain to program with and it also is very fragile because calling anything UI related through another thread will have consequences that are no always immediately visible nor obvious.

Re:Why are people still using this?

[RabidReindeer]

Java was explicitly designed to be OS- and hardware-independent. ....

I take it then that you've never tried to write Java code that needs to communicate with USB or Serial devices. It cannot realistically be done in an OS independent manner.

Been there, tried to "done that". Decided to shoot myself instead *

Truthfully, it CAN be done. But it's a huge PITA.

* Well, almost.

That's getting the cart and horse transposed. JAVA was designed to be OS- and hardware-independent. If the OS or the hardware isn't independent, Java doesn't (directly) support it. It was, in fact, a major struggle to get environment variable access into Java, since not all OS's support environment variables. The war was only won when Sun realized that there was no net difference between no environment variables and an empty set of environment variables.

I have, BTW, done serial programming in pure Java, but it was so long ago, I don't remember any of it. Java can also work with USB devices providing they present themselves as abstract filesystem mechanisms. However, if you want access to the guts of things, Java isn't designed for that, since, as you pointed out, such code isn't "write once/run anywhere", because the underlying hardware isn't "write once/run anywhere". Not just in Java, but in in C, C++, Python, Haskell, Perl, whatever. To get support for specific hardware attributes, etc., you need JNI to bridge the gap between the abstract and the specific, and JNI is not intended for portable code.

Re:Why are people still using this?

[godefroi]

What sort of software do you write?

Re:Why are people still using this?

[godefroi]

I don't write in Java either, but I wasn't necessarily talking about Java. Doing things the "Java" way certainly requires a lot of boilerplate, but if the "Java" way sucks, there's noone holding a gun to your head...

Re:Why are people still using this?

[Anonymous Coward]

Java is much, much faster than Flash.

Java start-up time is a complete monstruosity.

The worst part is that 17 years ago, it was already slow to start as hell. Java was supposed to be World Wide Web language of choice.
Remember HotJava?

In 17 years, most tools+applications have improved, just because hardware improved (like E.M.A.C.S. - Eight Megabytes And Constantly Swapping).

But not Java. For 17 years, somehow Java architects managed to keep Java start-up time unbearably slow, which is quite a feat, considering hardware performance improved exponentially. In the same way, they also managed to keep it memory hungry.

That way, they near-perfectly ensured Java applets failure, because for web pages, the two more important parameters are fast start-up time (you don't want to wait 10 sec for the menus to render on the page), and memory use (you don't want to be out-of-memory after opening 20 pages with ads).

Re:Why are people still using this?

[Anonymous Coward]

So every problem in Windows makes every Windows app useless?

Re:Why are people still using this?

[Anonymous Coward]

Long running apps in Java will almost always smoke long running native apps. Why? Runtime optimizations that are unknowable during compilation.

Trading memory for speed gains is common even for native apps. Besides, memory usage is kind of a red herring. I have had custom java servers running all sorts of services and never take more than 20 MB of RAM during high load, and it beats the ever living shit out of native equivalents in performance, because my Java apps have been thoroughly examined at runtime and compiled to native code based on what is actually happening, instead of the guesswork of static compilers. There is often no need for branch predictions because HotSpot will know exactly when a branch will be taken and where it will go, if you need a simple example. Another simple example: memory allocation is often faster and better than malloc and other implementations and deallocation is almost always free.

Talking about native code vs Java is definitely a red herring, since Java is compiled to native code and that compilation at runtime often takes 1000 microseconds to output a class into highly optimized native code.

Granted, the Java language is almost as shitty as C++ but the runtime is where the benefit is. Oracle(and Sun before it) recognized that the language is beyond help and are focusing much more on improving better language performance on the JVM for sane languages such as Scala, Ruby, Clojure, etc.

Re:Why are people still using this?

[Anonymous Coward]

WTF?

You obvious do not understand Scala, or C++, or both.

Re:Why are people still using this?

[Anonymous Coward]

Good desktop applications are rare in any language.

Good application are rare.

Re:Why are people still using this?

[Anonymous Coward]

You can develop web site extensions in C++. It's a new-fangled technology called "ActiveX" and it's much more secure than Java applets.

LOL

Re:Why are people still using this?

[Anonymous Coward]

Code that you don't have to write never has logical flaws or security holes and of course never needs to be maintained.

A 100,000 LOC Java program can probably be written in 15-20k lines in a more concise language. That matters, a lot.

Re:Why are people still using this?

[Anonymous Coward]

Python is strongly typed.

Re:Why are people still using this?

[Wootery]

Now I see what you're saying, and yes you're right -- I misread both your post, and X0563511's :P

Don't mind me.

Re:Why are people still using this?

[KlomDark]

I haven't used EF against anything but MSSQL, so haven't ran into what you've experienced. Although I'd be hesitant to use it with something else, there's no way you'd get the deep integration with a third-party database server. But for solutions based on MSSQL, there's nothing better I've seen in any world.

3. Usually when I run into issues like that, I'm doing something stupid. There's a few cases (Like working with Full Text Search) where I drop back and use a stored proc, but 99% of what I do, EF and Linq has not let me down.
5. Check your project configuration, you can set it to push out the same version of EF that you used for development.
6. Who the hell is modifying the database schema in production without going through proper QA? That's a management issue, not an EF issue.
7. See #5

Re:Why are people still using this?

[KlomDark]

PS, I built TonsOfCards.com (A site for sports card collectors, buyers, and sellers. Apologies for the blatant shilling...) entirely on EF 4.3.1 and it just flies, so it's definitely useful in production with sorta-big data (16 gigs with millions of records in the database currently)

*sigh*

[Anonymous Coward]

Just like with the flash thing, it doesn't matter if YOU ditch it, we need websites to ditch it as well.

Re:*sigh*

[JDG1980]

Just like with the flash thing, it doesn't matter if YOU ditch it, we need websites to ditch it as well.

What public websites still require Java? I haven't had this crap installed on my home PC in 3 years and I think I may have seen one random personal website that wanted it (and even then it was for menu buttons or some nonsense, nothing essential).

Does anybody know?

[Chrisq]

The remark " Is it really time to ditch Oracle's java and go for an open source VM?" does not appear anywhere in the article. Does anyone know:

1. is this a JVM or a library problem; from the description it sounds more likely to be a library issue
2. Does this exploit also exist in open source implementations such as Apache Harmony or the OpenJDK?

Re:Does anybody know?

[Anonymous Coward]

Apache Harmony has been retired. I can't say for sure, but OpenJDK probably contains the same exploit as the Oracle JRE, since the Oracle version is based on OpenJDK.

Re:Does anybody know?

[makomk]

Apparently it's a security regression in the JDK, was analyzed and then patched in IcedTea yesterday

Time to Revive Microsoft's JVM

[Anonymous Coward]

As a developer, I'm glad I abandoned Java after testing it out with some of my college courses (which was really due solely to swing).

As a Sys Admin, the Sun JVM kept wanting updates, and updates kept breaking applications... I liked the Microsoft JVM, and I extracted it from XP SP1 after it got yanked from SP1a, so that I could keep using it (albeit only for a short period of time).

Microsoft's JVM never seemed to cause me the problems that Sun's did... I was hopeful that Oracle's purchase would improve the problems that I'd experienced before... since that's not going to happen, I vote for Microsoft to get back into the JVM business.

Re:Time to Revive Microsoft's JVM

[X0563511]

What hokey coded-overnight-while-drunk were you running, that routine JVM updates broke things?

Re:Time to Revive Microsoft's JVM

[ekgringo]

Any software written by ADP?

Re:Time to Revive Microsoft's JVM

[Anonymous Coward]

WAY back in the day, the company I work for paid a LOT of money for a technology known as "Arcot WebFort" which was some sort of secure login technology. There was a client-side (browser) applet that managed a "wallet" which contained some sort of keys that let you log into the website. If your "wallet" didn't have a key for the site you were logging into, you had to answer a bunch of questions, etc. It was shit, and we knew it even then, but the investors liked the shiny logos.

We found that the browser applet stopped working after some particular update. This was back in the 1.2 or 1.3 days, I believe. The client needed a very specific version, 1.2_35_b41 or some confusing version number (hey, it's been over a decade now...), or the applet would simply never create the wallet, appearing to be hung. Well, we decompiled that thing, and it was failing to create a random number for some strange reason on other versions of the JVM, so we wrote in a quick fix, recompiled it, and off we went.

Posting anonymously for obvious reasons.

Re:Time to Revive Microsoft's JVM

[godefroi]

Amen to that.

Re:Time to Revive Microsoft's JVM

[jimmifett]

Everything back in the days prior to 1.4 was a nightmare. Unfortunately, that is were most criticisms of java originated. Quite a few enterprise apps i've been forced to use have never been recompiled since 1.3 and are very temper-mental, usually requiring an older JVM and swing was horrid back then. Java really came into it's stride IMO once it hit 1.5. Since then, most (not all) complaints about performance, ui performance, and a lot of other things are moot, but people still like to kick those cans down the road. It'll never be as fast as c++, but it's pretty damn fast in the modern era.

Why Sun why?

[Anonymous Coward]

The saddest day of my life was the day I found out Sun was selling java to oracle.

Re:Why Sun why?

[Anonymous Coward]

The saddest day of my life was the day I found out Sun was selling java to oracle.

WHAT? Oracle bought Sun, Sun are gone. Java was part of the deal/

Ask Toolbar Really ?

[Anonymous Coward]

This is the programming language that still bundles the "Ask Toolbar" crapware with their installer. Nuff said.

Re:Ask Toolbar Really ?

[Anonymous Coward]

JVM implementation != Java langauge

That does suck though.

Re:Ask Toolbar Really ?

[GuldKalle]

Nitpicking: It's not Java the language that bundles it, it's Java the VM.

Re:Ask Toolbar Really ?

[Anonymous Coward]

So? .Net bundles Windows. I'd prefer the ask toolbar.

Re:Ask Toolbar Really ?

[Anonymous Coward]

No, no. McAfee is the new spam that's bundled with Java.

Developer liability

[Bogtha]

As a developer, I totally understand the problems with holding software developers liable for security vulnerabilities. But when it comes to cases like this, I can't help but think there should be some legal liability for mega-corporations knowingly distributing vulnerable products.

Re:Developer liability

[Anonymous Coward]

please mod this up. its interesting and i'd like to see it expanded upon in this discussion. Thanks.

Re:Developer liability

[Anonymous Coward]

This is slashdot. The time of interesting discussion has long since past. These days its more important to censor and troll moderator than actually discuss. After all, if the population has a discussion, its far too likely they will let the cat out of the bag they lack the knowledge to actually have an in depth, topical discussion. And while this may sound like trolling, as someone who has sadly been here forever, its tragically true.

Moderators: If you are moderating on the basis of "I disagree", you are doing it completely wrong. The directions are very clearly provided by slashdot and somehow the vast majority of you seem to epically fail at such a simple task.

Re:Developer liability

[Anonymous Coward]

As a developer, I totally understand the problems with holding software developers liable for security vulnerabilities. But when it comes to cases like this, I can't help but think there should be some legal liability for mega-corporations knowingly distributing vulnerable products.

Actually, it's Apple knowingly not distributing the current version of Java that's caused the biggest mess. If you are running an older OSX version, then you're stuck on unpatched Java, from about a year or more back. Considering that we all know old, unpatched software contains issues that aren't present in the subsequent fixes, it's halarious that Apple has managed to make Oracle look like the bad guys.

Ok, Oracle might have earned a reason or two to look like a bad guy, but come on?!?! Are they supposed to crack Apple's "we won't distribute" patch chain just so they can fix Apple's problems for Apple?

Re:Ditch Java entirely.

[nedlohs]

Because every action you do or recommend doing must be a business model designed to make a profit?

Re:Ditch Java entirely.

[hsmith]

I mean, it is hard to run a business if you aren't running a profit and generating income.

No

[ExE122]

This is not a sign that you need to start ditching Oracle. The reason more security loopholes are discovered in Oracle are because it is the most widely used JVM. Other VMs will still have a ton of issues, they just don't get attacked as much (yet).

A similar argument used to be debated years ago with Apple v Microsoft... Apple toted it's superior security over MS when in reality, nobody gave a crap about attacking Mac users which only made up 10% of the market. Once they gained popularity, they started getting hit more as well.

The real scary part is that MS at least takes its security flaws somewhat seriously. Oracle seems to have smugly ignored Mr. Gowdiak. He can now smugly turn around and give them a big "I told you so!"

Re:No

[X0563511]

The real problem here is the quarterly patch cycle that seems to ignore the severity of security bugs. If you want to do a quarterly cycle that's fine - but you need to make exceptions for security bugs.

Re:No

[geekoid]

It isn't the loopholes, its the lack of response from Oracle that's the issue.

Re:No

[geekoid]

Billions of Java apps run cross platform with no problems.
WTF is your problem?

Re:No

[BanHammor]

I don't honestly know about OpenJDK/IcedTea (The open-source reference implementation of Java.), but other open-source projects, even though they get a fair share of vulnerabilities, fix them quickly (look at openssl, or Linux kernel). Oracle Java does NOT fix security bugs quickly. That's the problem.

Re:No

[pointyhat]

Dear Blakey Troll,

Java desktop application guy here

Last place I worked, I was the lead architect for a real-time patient care system deployed to 120,000 users across 2500 hospital sites around western Europe across Windows, Linux and Solaris platforms.

It stopped the users' patients from dying, so they are quite happy with it as are their patients. It is incredibly fast (2 orders of magnitude faster than the C++ based MFC native Windows app our competitor was throwing out), it has had no downtime (ever!) by nature of the architecture which must not go down under any circumstance (everything was fully distributed), the UI definitely does not suck and it's certainly not bloated at 52Mb including the JVM (our competitor hit 2Gb including the local SQL server instance installation).

What do you propose we use instead and how do you propose we start rewriting the 1.9 million lines of code we've already got?

Re:No

[Blakey Rat]

Yeah, Lotus Notes "runs" also. Lots of shitty software "runs". My minimum bar isn't "runs" but is "not shitty".

Re:No

[Anonymous Coward]

Unfortunately, some still rely on Java. All Danish web banks go through a common national identity service which is implemented as a - tada, Java applet! So you basically can't do banking in Denmark without Java. Sigh.

The stupidity if this the whole setup is incredible. There's even a site dedicated to answering the question, is the id service down? An ill-placed disaster would take out the whole banking structure in Denmark.

Re:No

[Anonymous Coward]

What OS and language do you use to write your stuff?

I'm sure there are some 0-day problems in it, regardless of what it is.

Murphy's law: there is always at least one bug in any piece of software.

Re:No

[pointyhat]

No - you are actually totally clueless here and are just trying to get karma by jumping on the anti-Java bandwagon.

No our application is not contributing any such risk whatsoever:

1. We shipped the JVM with the application in its own standalone directory. No applets, no browser plugins. It's launched by a wrapper exe on windows and a script on Linux+Solaris. Basically it runs java[.exe] -jar application.jar. There is no target vector for this exploit.

2. we ship JVM 1.6 which is not vulnerable.

3. It uses SWT which looks native on all platforms - look it's not ugly at all: http://www.eclipse.org/swt/

Re:No

[Anonymous Coward]

Besides, there's no way your UI "definitely does not suck". It's in Java. It has to suck.

If you're talking about Swing or AWT, I would agree - however SWT has provided an excellent native UI for Java applications.

Note don't confuse IBM Eclipse applications (like Rational Developer tools, or the Lotus suite) with that - lazy authors tend to include crazy numbers of badly written bundles, which kills performance. But hey, lazy authors can screw up C/C++/your_lang_here solutions, too. :-)

Re:No

[Anonymous Coward]

congratulations on the most retarded line of thinking i've seen today.
"your application is the reason that JVM is installed on all those computers, so your application is contributing to risk".

if we were dumb enough to follow that line of thinking, the fact that the software is installed on those computer at all, necesistates an operating system. no operating system is secure, all have exploits of their own. therefore the fact that they wrote a program that requires an operating system means that they're contributing to risk.

which, once you think about it, means that if they didn't need a computer, there would be no risk of digital security breaches. if only the GP had written their "software" on paper with pencil instead of on a computer, there would be no risk of computer break-in.

but there's still a risk of social engineering, even with pen-and-paper records, as well as physical theft. even that isn't good enough. the face that we have records and information that needs to be transfered contributes to risk.

QED. you're blaming people who had the audacity to be sick and dying for necessitating risk.

asshole.

Re:No

[Anonymous Coward]

you are REALLY committed to trolling this guy, aren't you.
you're passing judgement on the UI of an app you've never seen and never used, solely because of its origin.
that's so mighty big balls you've got there.
if we were talking about people instead of programs, you'd be labled racist in a heartbeat.

Re:No

[pointyhat]

My point is there is no equal. We couldn't have delivered it with Python, Ruby, C, C++ or any other platform out there. Our competitors were struggling along adding features and dealing with maintenance issues with C++/MFC/Win32. It took us less time to build from scratch than it took them to get an interim release out of the door. Survival of the fittest.

You said that the UI sucked. Based on your previous comments, I assumed you were naive enough to consider that to be appearance. I do not claim to be a usability expert (I doubt that there is such a thing as it's subjective and look where 'usability experts have left us': unity, metro, gnome 3). We had three experts from the target market and three separate input paradigms based on whether or not you had a probe or instrument in your hand or whether you just sat behind a normal workstation. None of the UI's "sucked" for the users either with respect to usability or appearance.

Re:No

[pointyhat]

I think you nailed it here.

I'm currently waiting for someone to build me a new workstation after a disk failure so I have nothing better to do than to sit here and get paid to do this. Life is bliss.

Re:No

[Anonymous Coward]

Java 2 orders of magnitude faster than C++ ? I'm gonna have to call you out on that one. It may be faster than what your competitor was "throwing out" but that only means your competitor is incompetent.

How much hardware are you throwing at that no downtime claim? How much does your competitor require? I run Java servers for a living and it goes down all the time. Sometime not even down, just needs a restart of the JVM. Sometimes only a recompile of the code will fix it (note, we do not change a single line, not even a comment, just recompile). Sometime, java just breaks. It's a fact of life. If my life depended on a Java program, I'd update my will.

1.9 million lines of Java code? You have what I believe is the ultimate goal of Java - a job for life. Nobody is going to want to take that on and maintain it. I propose you demand a raise every 3 months.

Re:No

[Anonymous Coward]

If you think "looks native" has ANYTHING to do with usability, you are entirely unqualified to judge the usability of an app. So I stand by my statement that your app is an unusable mess.

On the behalf of all programmers, fuck you. You've never seen his software, never used his software, and you are in no way fit to judge it He fucking made something. He poured his blood, sweat, tears, and effort into it. He was under massive amounts of pressure to create mission-critical software that must not fail. It kept him up at night as he struggled with design and implementation decisions. It frustrated and delighted him, confused him at some times and at others enlightened.

What have you done, besides be a little bitch on the internet? Perhaps you should look within to figure out why you're compelled to drag everyone down to your level of mediocrity. Do some shrooms, realize you're not special. Be a creator not a detractor.

Re:No

[VGPowerlord]

If you think "looks native" has ANYTHING to do with usability, you are entirely unqualified to judge the usability of an app. So I stand by my statement that your app is an unusable mess.

SWT doesn't just make it look native, it calls the OS's underlying libraries... SWT is (formerly) IBM's Java Native Interface library, written in C to do those calls. As such, its C code is wildly different on each OS. For that matter, the Linux/BSD versions require that GTK be installed, because there is no QT version of SWT.

Re:No

[Billly Gates]

Java is here to stay in the corporate desktop. Manpower, Kronos, and a half dozen other intranet apps use it. Almost all banks require it for the finance and accounting departments. I am not talking of just checking money in a portal. I am talking about sophisticated lines of credit and finance analysis apps that need to use security exploits to communicate to excel for them.

Because of this require ancient insecure versions. Some still only work in java 1.4 in XP. THis is the biggest pain. If the software worked in all versions of modern java that a sys admin could update without worrying about compatility.

Re:No

[ifrag]

Then your competitor (if they can be called that) is garbage and it's no surprise at all they didn't get picked. Obviously there's no need to change anything at all. The question would have been far more interesting if the competitor actually did something better.

Re:No

[GuldKalle]

"Not shitty" is entirely up to the programmer. You bitch and bitch, but you provide no reason. Where does "the UI" fall short? Why is WORE not working?

Re:No

[Anonymous Coward]

"no problems?" and billions? hyperbole much?

what about JNI? how come I can't use the ONE decent Java app I've ever seen (KanjiGo, for those who care...) on my new Macs? (yeah, yeah, actually Apple's fault...)

Re:No

[Anonymous Coward]

I think you just pointed out more flaws than features.

Yes, a competent design tends to be less slow than a poor design. I don't think you can claim that all your data fits in that same 52Mb blob, and if it does... is it finite?

And, quite frankly, your belief that it's possible to design an architecture which guarantees 100% uptime leads me to believe you are full of s**t, from a technical perspective. Just because you don't know where your single point of failure hides doesn't mean it's not there -- just that you likely haven't thought about it enough.

This is all spoken as a long-time Erlang developer working in environments designed for (close approximations of) 100% uptime. It's possible to come close, but there will always be some event that will bring your system down. The question is, to paraphrase a much-maligned but brilliant quote, is it a known unknown or an unknown unknown?

Re:No

[Golden_Rider]

Because of this require ancient insecure versions. Some still only work in java 1.4 in XP. THis is the biggest pain. If the software worked in all versions of modern java that a sys admin could update without worrying about compatility.

So true. The one thing I hate most about Java (on the desktop) is that despite all the claims of "Java works anywhere, on all platforms", it just doesn't. For some disgusting reason, many admin tools (HP iLO, IBM RSA, web interfaces for switches, pass-thru modules of IBM Bladecenter, ...) all use Java. And many of them are not happy with the current, mostly secure version of the JRE, they ONLY work with older versions (e.g. the FC pass-thru module of the Bladecenter H we recently got brand new explicitly states it ONLY works with 1.4.2). So I need to run a couple VM with various (known unsecure) versions of the JRE just to cover all the stuff I need to connect to. And it's also fun if we want to roll out security updates to our servers and application administrators tell us to please NOT update Java because it would break their applications.

Re:No

[Anonymous Coward]

Whats wrong with lotus notes?

Re:No

[putzin]

Saying Lotus runs requires a better metaphor to counter than all the smartest minds on earth are capable of.

Re:No

[Anonymous Coward]

So it's essentially the Java version of wxWidgets then.

Re:No

[Anonymous Coward]

Thank you :)

Re:No

[Anonymous Coward]

Oracle has had the issues patched for some time. Yes, you could state they should have done it earlier, but one can always make that argument. In fact, one can make the argument that such a vulnerability should never have existed, but sooner or later we realize that we are all human.

What chaps me is that I have an Apple laptop, with an old version of Mac OSX on it, that will never be able to get the already fixed versions of Java; because, Apple has decided to stop packaging Java for that release. Which is worse, finding a bug and fixing it "not fast enough" for some people, or having the fix available via partnership and not distributing it at all?

Re:No

[Anonymous Coward]

I love working with C, C++, Java, Python, bash, Scheme. None of them is perfect, but they are all really good languages at their sweet spots.

As far as Java goes, the language and the SE libraries are really well thought out and quite fast. My biggest problem is that it promotes ubiquitous multithreading, which is impossible to get right for 95% of the Java programmers. The language definition is crystal clear and it provides nifty tools to manage concurrency, but the vast hoardes of Java programmers were never exposed to those and don't even know to be duly afraid of the intricacies involved.

Re:No

[pointyhat]

Seeing as I made a claim, I'll explain further.

No it's definitely faster if you know what you are doing. The reason C++ is "fast" is that you can easily sacrifice clean interfaces and modularity for raw performance i.e. by using raw memory and pointers etc. The moment you throw that away to build clean interfaces and modularity in (which is essential on larger projects like ours), your performance advantage goes out of the window. We're not doing it wrong - we're leveraging the right technology. It's easier to make serious mistakes in C++ as well and the additional checks required to verify that they are not being made are expensive. In Java, most of this is handled at compile time (g++ checks+valgrind are not sufficient btw).

Regarding downtime. Consider CAP theorem. We use a PAXOS consensus algorithm based protocol between nodes and our own event driven message-oriented container which runs inside the client process. Effectively the system, per-installation is a big message bus. There is no central point of failure. There are no servers to fail. If a single node is up, the system is operational. Scalability comes from CAP theorem - we sacrificed C (consistency) yet apply P (partition tolerance) and A (availability). We have unique reliability requirements which means we don't use a COTS container like Tomcat, Glassfish or Jetty which is what you are most likely used to.

1.9 million lines is due to the complexity of the product - the task it is required to do is not easy to visualize, is processing heavy and is complex. We also have about 2.9 million lines of jUnit and selenium RC tests. It's modular and well maintained as it's built by people who know what they're doing.

I earn plenty thank you.

This is a proper software engineering project, not a startup, internet fad, cost cutting low-rate business.

Re:No

[OdinOdin_]

Why use SWT at all I found it to be a collection of lowest common denominator APIs. Just use Qt directly in Java via the QtJambi project.

IMHO If the SWT on Qt project should get more traction in the future it is better throught of as being an "SWT compatibility layer (to help migration away from SWT)" since the direct Qt API in Java is so much better and that API already works on the big 3 desktop enviroments (Windows, Unix and MacOSX). So what purpose does SWT continue to serve.

Re:No

[pointyhat]

SWT works with selenium nicely.

Re:No

[VGPowerlord]

Why use SWT at all I found it to be a collection of lowest common denominator APIs. Just use Qt directly in Java via the QtJambi project.

IMHO If the SWT on Qt project should get more traction in the future it is better throught of as being an "SWT compatibility layer (to help migration away from SWT)" since the direct Qt API in Java is so much better and that API already works on the big 3 desktop enviroments (Windows, Unix and MacOSX). So what purpose does SWT continue to serve.

SWT doesn't require a third-party UI library on OSX or Windows and thus acts like native programs do (since it's using native widgets).

Re:No

[pointyhat]

The application is 52Mb. The data varies between 400Mb and 1Tb per node depending on the installation size and imaging data.

It is 100% uptime. It's up whilst it is turned on. It is designed so that a node failure and network failure is not important (eventual consistency) - in fact the nodes regularly power fail when they are taken offline to be moved around (some are attached to medical imaging platforms). It is not one single monolithic system - it's fully distributed.

Erlang gets the wrong end of the stick. We evaluated it and threw it out. The conclusion is that the language/VM doesn't matter. The architecture, data model and communication medium does.

Re:No

[pointyhat]

The competitor did have the better product. Ours was a naff embedded+C system. That's why we built this one, so please invert your argument.

Re:No

[Anonymous Coward]

They've already patched the hole, fucknugget.

Re:No

[tibit]

Due to hotspot, Java is faster than any other non-JITted implementation of any programming platform, so perhaps comparing it to Python or Ruby is a bit unfair. As for C++, I'm sure it could have been done. Do you utilize runtime code generation anywhere? Because that's the only thing where Java really wins, it can't be trivially done in C++ other than writing out some code to a pipe or file and running it through the compiler to generate a dynamically linkable library (bleh). Other than that, I don't see anything architecturally that would make Java all that much better. You can do garbage collection, even non-conservative garbage collection, just fine in C++. Sure it won't collect arbitrary classes, but as long as you keep your object tree rooted and only use boxed types as generic types, you can have non-conservative GC in C++ or even C. I'd argue that being able to do manual memory management in C/C++ when you need it for performance is a plus.

C++/MFC/Win32 in combination is a massive clusterfuck and I'm not surprised at all that your competitors couldn't get anything done right, because doing it "right" would imply pretty much maintaining a fork of MFC and bringing it in line with lessons that have since been learned in C++. Qt is a reasonable example of how to do a portable application development framework in C++. It has some rough edges, but they are nothing compared to MFC, and IMHO even nothing compared to any other popular C++ framework out there.

Re:No

[tibit]

Amen.

Re:No

[tibit]

The conclusion is that the language/VM doesn't matter. The architecture, data model and communication medium does.

Ergo, it could have been done in C++ ;)

As far as I can tell from your description, it is a cool system. Is there a whitepaper about it somewhere? I'd like to learn some new tricks.

Re:No

[Anonymous Coward]

Hey you,

Stay cool you are a Javadevel :) No need to argue with these people. I don't even have 10,000 hours of Java developing but I love it. I try this javaScript-Hype, too and "my brain hurts"

Anyone unable to explain how non-blocking works down to the hardware level just STFU.

Re:No

[pointyhat]

Fair point!

It is pretty cool. There is no whitepaper and I no longer work at the organisation unfortunately so publishing one is not likely. I will write it up in a blog post and post it against this at some point in the future (when time allows). None of the information is covered by proprietary rights in my contract so I can say as much as I like :)

Re:No

[pointyhat]

There is no runtime code generation done. Everything is done at compile time. We have a custom written annotation processor that allows pre/post/invariant condition checks throughout the code. That is the only code generation.

The application is modular (similar approach to OSGI) so it loads components at runtime on first request. This allows startup times to be minimal. There approximately 85 components which assemble themselves into the application at runtime on demand. This is not possible with C++ unless you resort to things such as CORBA, COM or at a low level dlopen, all of which multiply complexity. Have you ever tried memory management with CORBA? - it's horrid!

I know you can inject the Boehm GC into C++ for example and use your boxing methodology, but that still leaves plenty of windows open and is just trying to turn C++ into Java (why bother?).

Agreed about MFC/Win32/C++ - whilst the NT kernel is a really elegant piece of engineering, the Win32 subsystem on top is a steaming pile of dung. I'd rather have liked to have seen the OS/2 subsystem survive a little longer...

I've used Qt (commercial) extensively (on QNX) and it's not up to the job at hand here. The support is good but you need it too often.

If I was to pick an alternative to Java for this, I would probably pick Go with GCCGO and not C/C++.

Re:No

[tibit]

I don't think anyone bothers to call dlopen() directly anymore if a decent framework is available. Look at Qt Creator. It's all plugins, about as many as the number of components in your application. Writing modular applications in C++ is not hard.

I'd pick Go too, but that's a bit technically risky it seems. C++ has solid multivendor support.

Re:No

[tibit]

Please do, and I do appreciate any time you'll spend writing it up.

IBM

[Spiked_Three]

Whatever happened to them? Didn't they at one time have a Java implementation?

I'm not ready to give up on Java. It is not because I think it's the best, I still think C# beats it as a language, but at times when a client requires non-microsoft, it is my only choice for a modern language. Yeah, I know C++11, I've looked at it quite a bit, and it is better than it was, but as long as it needs header files, I don't put it into a modern language category.

So, anyhow, Eclipse seems to have really gone in the dumpster as far as quality lately, and IBM is silent as a Java leader too. Is IBM bailing on Java? I see the have a new big push to virtualization to a level that makes sense, by using a mainframe. Maybe they have (bailed). So what post java, other than c#, is available?

Re:IBM

[pointyhat]

There genuinely isn't anything out there which matches it at any level simply because you can kick out functionality that works and has test coverage in unbelievably short amounts of time. I discount C#/.Net because the community is shitty and it is definitely not cross platform (sorry Mono - but you don't do WWF+WCF+WPF properly so you don't count).

There is no post-Java (yet).

Please don't mention virtualization - stupid fucking idea designed to generate even more revenue from people who don't actually get the fact that their servers can run more than one cleanly isolated process without having to invoke a VSphere license cost...

Re:IBM

[Simon Brooke]

Whatever happened to them? Didn't they at one time have a Java implementation?

IBM's Java work is now part of OpenJDK. How close OpenJDK is to Oracle Java and whether it shares this exploit I don't know (although the OpenJDK home page says they are '...based largely on the same code'), but if it does it should be patchable.

I'm not ready to give up on Java. It is not because I think it's the best, I still think C# beats it as a language, but at times when a client requires non-microsoft, it is my only choice for a modern language. Yeah, I know C++11, I've looked at it quite a bit, and it is better than it was, but as long as it needs header files, I don't put it into a modern language category.

I could happily give up Java, but I wouldn't willingly give up Clojure. There's more (and better) languages for the JVM than just Java.

Re:IBM

[Anonymous Coward]

see http://www.ibm.com/developerworks/java/jdk/

Re:IBM

[robmv]

Java is not the best language out there, but it has a good library of APIs and 3rd party libraries that put any other business application friendly language/runtime below it. You want a better less verbose language? running on the JVM, just try one of the many. I personally recomment Scala

Note: I am really tired of news like this when people start bashing Java instead of the real problem that is Oracle slow response, IcedTea (and OpenJDK variant used by many Linux distros is already pushing updates for this). I don't see people going crazy with every browser vendor because they had security bugs and you only notice them when you read the release notes for their updates. "Remove Firefox/Chrome from your system, every 6 weeks there are security bugs". If you don't need Java do not install it or remove it, this apply for every software in the world, reduce code that could have vulnerabilities in your system, and if someone still is using applets with new code today, please take him/her to the corner of the room and punish him/her with the donkey ears hat, please

Re:IBM

[Viol8]

"but as long as it needs header files, I don't put it into a modern language category."

Sorry , what? Where do you propose putting common definitions then shared by many modules? Or do you seriously think the moronic everything-in-a-class approach of java is a sensible way to do things?

Re:IBM

[gbjbaanb]

So you think web services are non-modern either, as they use a header file - otherwise known as a WSDL.

That's the way to think of C++ headers, like interface definitions for the implementation cpp files. For that, they work great, so I actually prefer them over a large file with definitions and implementation all listed in it, that you *need* an IDE to figure out what is in each class. At least with C/C++ you can look at the header and see quickly and easily.

Re:IBM

[AwesomeMcgee]

I must say, and take a deep breath before reading this so your don't laugh yourself hoarse, but after you're done laughing listen to me. I'm an ardent C# developer for years, but I have found another extremely high level modern language that I would use in place of C# in a non-microsoft shop... Haskell. I know I know.. "academic bla bla bla" whatever, seriously, it's garbage collected, strongly typed, loaded with type inference to help you develop faster, has tons of packages for most things you may want to do, has *nix and windows compilers which will build the same code (you'll just have to swap out the modules you use for FFI to librarys if the dependent libs like UI you use are different).

Though I preface that with, while people have done UI's in Haskell, the idea to me is mindboggling, and I would just stick with UI in HTML using Haskell to serve web-pages in a non-microsoft shop. I wouldn't use java for UI in a non-microsoft shop anyway, java UI is absolutely gnarly bad and we all know it. If forced to do a desktop UI app in non-microsoft I would immediately be looking at tcl/tk, yes- ugly, but no one can argue with the fact that it always performed very well.

Re:IBM

[Anonymous Coward]

So you think web services are non-modern either, as they use a header file - otherwise known as a WSDL.

Web services aren't a modern *language*.

If you are writing java so that it's all definitions and implementation, then you should probably look up interfaces and use those, which would be the closer analogy.
The difference being you tend to get all sorts of other crap in header files as well as the method definitions.

Re:IBM

[godefroi]

What about the D programming language? Object-oriented, memory management, C ABI compatible, compiles down to native code and requires no runtime components, I don't believe. There's a GCC-based compiler, an LLVM-based compiler, and the reference implementation.

Re:IBM

[godefroi]

I'm not sure what you're saying. Having the "common definitions" inside a class or outside a class is orthogonal to requiring header files. Why can't "common definitions" simply be derived from the source files, as they are in pretty much all "modern" languages?

Re:IBM

[godefroi]

Except that the programmer doesn't (generally) have to create and manage the WSDL file, it's generated on-demand by the framework or toolkit in use. If the header files were generated automatically behind the scenes, and included where necessary all invisibly, then they'd be great.

Re:IBM

[mark-t]

.... but as long as [C++] needs header files, I don't put it into a modern language category.

From a usage perspective, there is no real difference between header files and import statements. The only significant difference between them, in fact, is in their creation, where a programmer must explicitly separate the interface from the implementation.

As it's entirely possible to write software that generates header files from an implementation (with suitable markup), and this phase can be added to the initial part of any automatic build process, I really wouldn't agree with your notion that this characteristic alone makes C++11 unworthy of the "modern language" category, while at the same time Java or C# would be.

Re:IBM

[Anonymous Coward]

The C#/.NET community shitty? Maybe because you were in it.

Re:IBM

[eyrieowl]

This is something I struggle with. Lots of people would reply "python", but I think they're off their rocker. Yes, python is probably just fine for a lot of website development, and yes, I know some enterprises are using it heavily, but when you dig into it, it's really a hacked up POS that carries WAY too much of its evolutionary baggage. Java certainly has a bit of that as well, mostly in the bundled libraries, but they are much more consistently architected than the Python libraries. Plus, the lack of true multi-threading support is just...unconscionable for a modern language, I think. Yeah, it simplifies things for the hoi polloi, but that should hardly be the standard we aspire to.

Unfortunately, the only languages I know which have the features I expect from the next great modern language are all research languages at this point. What I'd really like: Start with Java (convenient syntax that is familiar to many people, and a VM with a lot of important concepts). Go through the standard library and rework it to make it consistent, ditch the older paradigms that still hang around to support backwards compatibility. Rework generics, also ditching compatibility but to improve usefulness. Add support for design-by-contract. Add in language level (not library level) features to support fork-join with support for some mechanism to declare affinity between work units and data so that the VM can optimize thread placement and data placement in memory. Add better built in support for both dynamic class creation and bytecode injection. Add a smart/flexible int/float/number types where the VM will take care of sizing depending on how big the number is, something which can flow up to the Big range without needing to keep track of sizes yourself...and crucially, where the math operations work regardless of number size, efficiently (i.e., under the covers, this would mean allowing for a mutable big integer/decimal). Also add support for primitive collections...but do it in such a way that it's made as transparent as possible. This would probably mean it would allow treating primitives as Objects from a parameter passing perspective, so, say, your Map put method would still be put(K,V), but if you used a map which supported primitives (which would be a lot easier to write with the smart-number facility), it would pass a primitive straight through without any boxing/unboxing.

I'm sure if I thought a bit longer, I could come up with some other features I'd like to see. Importantly, this language still has a VM...I think that becomes more important for the future, not less, as we move to higher core/processor counts and NUMA becomes a bigger and bigger issue. There will always be a place for lower level coding a-la C/C++; but I think that a higher level language really...you need a VM. And, as with the JVM/CLR, I would want the VM for this language to offer support for running bytecode which could be compiled from a multitude of languages. People who have done work developing those sorts of compilers would probably have suggestions on how that could be even better supported, and I certainly think that input would be important for ensuring that support is done right.

Re:IBM

[Anonymous Coward]

This is something I struggle with. Lots of people would reply "python", but I think they're off their rocker. Yes, python is probably just fine for a lot of website development, and yes, I know some enterprises are using it heavily, but when you dig into it, it's really a hacked up POS that carries WAY too much of its evolutionary baggage. Java certainly has a bit of that as well, mostly in the bundled libraries, but they are much more consistently architected than the Python libraries. Plus, the lack of true multi-threading support is just...unconscionable for a modern language, I think. Yeah, it simplifies things for the hoi polloi, but that should hardly be the standard we aspire to.

The only thing you said there which was reasonable was the threading criticism. The rest is 100% bullshit. Having said that, Python has the multiprocessing module. So while the threading idiocy in Python is horrible, its not like good alternatives don't exist.

The simple fact is, Python has language features many languages would kill for. Its a powerful and expressive language with a powerful and large standard library and an even richer third party pool of possibilities. Saying its a "hacked up POS that carries WAY too much of its evolutionary baggage" flies in the face of reality.

Perhaps you'd care to expand on how it is a "hacked up POS that carries WAY too much of its evolutionary baggage." Perhaps you might also care to declare if that's python in general or python 2.x or python 3.x. I would be especially interested given that 3.x addressed almost all of the FEW oddities which surrounds 2.x. And even still, given that there are so few and they rarely actually effect anyone in 2.x, I'd really like to know what the hell your trolling on about.

Re:IBM

[Anonymous Coward]

Regardless of platform (with few exceptions) you need the java runtime implementation to run java applications. Same goes for C#/.NET - and there too the runtime is available for other platforms than windows. Just read up on the Mono project if you haven't already.

Re:IBM

[Viol8]

Huh? A C/C++ header file is a source file. It simply has a different file extension by convention indicating it contains common definitions. At least try and understand what you're talking about.

And if you didn't have header files how would you expect the compiler to know that variable "foo" used in module bar.cpp but defined in stuff.cpp is - for example - an int? C/C++ compilers compile ONE module at a time, not all of them in one go. They retain some state information for templates and thats complicated enough , but doing it for ALL variable definitions would be absurd given that header files are clear and simple and allow obvious compile time error checking.

Re:IBM

[pointyhat]

Actually no. I think my views on the matter are summed up nicely here: http://whatupdave.tumblr.com/post/1170718843/leaving-net

Re:IBM

[Anonymous Coward]

It misses the most important feature of any programming language to become successful:

Hype.

Re:IBM

[tajribah]

Using threads with locks and other traditional synchronization primitives is a walk across a minefield. More than 90% of multi-threaded programs I've ever seen are full of race conditions and other subtle bugs, which are not easily visible, but which make the program unstable on the long term (it is not unusual that a program suddenly deadlocks after running for several months). If you really want to write something parallel, use a language which provides a better abstraction, one of the possibilities is transactional memory.

Re:IBM

[gbjbaanb]

of course the coder has to generate the WSDL - you're not suggesting you write a bunch of methods and expect the system to write your definitions for you?! I know there are systems that do this - but you still have to decorate your methods with the appropriate codes to make the generator work correctly.

Mind you, there are generators for .h files, and also for .cpp generators too - Visual Assist for VS does it as does Dehydra from Mozilla. And for years cproto has been around though that doesn't understand C++, only C.

quick google: http://www.hwaci.com/sw/mkhdr/makeheaders.html

works for c++, though I don't know how complete its functionality is for advanced C++ features.

Re:IBM

[Anonymous Coward]

Have a look at Scala, a lot of what you stated you wanted is there. Scala is by no means perfect, but it is a better JVM language. There are also other alternatives like Clojure and Groovy. But you seem to be more inclined to a static type language, so Scala could be something that may be a good fit for you.

Re:IBM

[eyrieowl]

Scala does indeed have some of what I want...but some number of those features would require VM support to really properly put in place. Without VM support, you could perhaps emulate some of them at the language library level, but you're not going to get the true performance that you would have if the VM were intelligently doing many of the optimizations at a lower level. And I don't think many of those things will end up in the JVM b/c Java's too beholden to backwards compatibility...and since the primary language won't ever support those features there's little motivation to add extra complexity to the VM to support them. I do think the JVM would make a reasonable starting point...people have put a lot of work into developing a number of features which would continue to be very important for the next generation language, and if some of that work can be reused, it would certianly help jumpstart such a project. I do think there's not much point without VM support. A next generation language isn't going to be viable if it exposes nice features but they are slow/expensive. And that, I think, is one big reason why uptake on Scala hasn't been better than it has. I'd have dig around to find it again, but last I saw, there were several significant benchmarks for which Scala performed much slower than Java due to aspects to how the language is designed. Google's little paper notwithstanding, most benchmarks I could find in just looking around (such as the Computer Language Benchmarks Game http://shootout.alioth.debian.org/ ) have Scala coming in a bit behind Java...but well behind it on the high end. I think the next paradigm...it will have to offer more than Scala does, and do it with top-flight performance. There needs to be a real clear benefit which goes beyond appealing to CSey types and which can be used to make a compelling argument to business folk why they should let their development team(s) run off and use something new. I think several of the features I lay out would really help the language get even closer to C++ performance for a variety of computational tasks...still not as good as tuned C++, but maybe close enough that for an even broader category of problems, the extra productivity made possible by the higher level nature of the language would make it the way to go.

Re:IBM

[Great Big Bird]

Virtualization is not a "stupid fucking idea", it has been used on mainframes since the 80s if not before. There are places where it is fabulous and the right solution.

Re:IBM

[Spiked_Three]

" At least try and understand what you're talking about."

I think you are confused who is clueless.

Re:IBM

[Anonymous Coward]

There's no obvious technical reason IDEs couldn't do that - in fact, I'm fairly confident that there would be one or two which do it, because it is pretty simple once you have a full C++ parser built in (as some do).

Re:IBM

[Anonymous Coward]

This would probably mean it would allow treating primitives as Objects from a parameter passing perspective, so, say, your Map put method would still be put(K,V), but if you used a map which supported primitives (which would be a lot easier to write with the smart-number facility), it would pass a primitive straight through without any boxing/unboxing.

To be fair to Java, Java 5's auto boxing achieved that, at least on paper.

Re:IBM

[Spiked_Three]

"'To be able to install this JRE your computer must be an IBM system, as shown by a BIOS check"

WTF does that mean? surely not what it says?

Re:IBM

[Viol8]

"I think you are confused who is clueless."

You want to try repeating that in intelligable english?

Re:IBM

[godefroi]

of course the coder has to generate the WSDL - you're not suggesting you write a bunch of methods and expect the system to write your definitions for you?! I know there are systems that do this - but you still have to decorate your methods with the appropriate codes to make the generator work correctly.

Yes, that's exactly what I expect. I currently write code in C#, and I use WCF for my SOAP webservices, so my "decorations" consist of [ServiceContract] on the class and [OperationContract] on each method that is part of the service. I've never, ever, in my entire life, hand-coded a WSDL.

Re:IBM

[godefroi]

If headers are required for the features you list to work, then how does C# do it? How does Java do it? How does Perl do it? How does Python do it? I guess either they don't have compile-time error checking, or they're "absurd".

Re:IBM

[Viol8]

Simple - none of them are compiled down to machine code like C++ is. They're either scripting languages (perl,python) or use VMs (java, C#). If your code is running via some sort of interpreter it can do all sorts of runtime loading and analysis of program code which you can't do with a raw binary.

Re:IBM

[pointyhat]

Yes it is. It's an awfully unnecessary abstraction.

There are many more ways which are simpler to solve the problems that virtualization supposedly solves.

Virtualization is just an excuse for an IT department to get away with shitty infrastructure planning, poor product selection and bad quality software.

Re:IBM

[Spiked_Three]

Are you serious? You don't have a clue what you're talking about do you? Seriously dude, I think using a web page is out of your league. No one is going to reply with a technical explanation to someone who obviously doesn't have any idea. Do yourself a favor, spend some time with the free visual studio, or even Java if you don't mind having your computer pWned (for the last few days anyhow) - and try it. It has nothing to do with runtime loading and analysis, that is known as reflection. it has to do with the COMPILER being smart enough to look at a library, as opposed to only being able to load in source and compile it. Its not that hard really, and again, it IS a top priority of the C++11 committee. They acknowledge its desirability and are working towards resolution on implementation. Oh damn, I took the time for a newb (rolling eyes).

Re:IBM

[Spiked_Three]

No need. you and everyone else who read it, knows exactly what it says.

Re:IBM

[Viol8]

I love arrogant students who try and be intellectual and end up talking out of their arse. :o)

"it has to do with the COMPILER being smart enough to look at a library, as opposed to only being able to load in source and compile it."

Way to go on completely missing the point - which since you clearly can't read properly - was why does C/C++ required definitions in header files shared between source files. Presumably you thought that tossing in something about linking with libraries and C++11 makes you sound like an intellectual? I've got bad news for you sonny...

Re:IBM

[Spiked_Three]

oh, your right

"was why does C/C++ required definitions in header files shared between source files"

Never thought anyone would be ignorant enough to even consider that, when the compiler has to compile both and can simply keep a symbol table between the files. I though you were on to something less obvious and less basic.

Re:IBM

[Viol8]

"Never thought anyone would be ignorant enough to even consider that, when the compiler has to compile both and can simply keep a symbol table between the files"

Wtf are you talking about???? Do you even know the difference between declaration and definition? Why don't you go and buy a ticket on the clue train you utter fucktard.

Over & out.

Re:IBM

[Anonymous Coward]

Java import statements are equivalent to C++ using statements, not header files.

A Different VM

[mkkohls]

But Oracles VM is OpenJDK right? Why not just fork it and mantain an updated patched version?

Re:A Different VM

[robmv]

Not a fork, but a variant of OpenJDK already exists today, at least for Linux systems many distrutions use it (but people still insist on installong the Oracle one!!!!) IcedTea and they already patched this bug

Re:Ditch Java entirely.

[Anonymous Coward]

Yes, actually, it does. Everything we do has a business case attached. The level of effort we put into the business case is proportional to the money involved, but yes, we do a business case analysis for each decision. With decent mentoring, it teaches your employees to think about the second order affeects of decisions. Risks and assumptions are clearly stated, and it's very easy to defend risks that didn't work out, since they've already been defended. Good for everyone.

In a Word?

[casca69]

Yes

Re:Ditch Java entirely.

[cduffy]

I mean, it is hard to run a business if you aren't running a profit and generating income.

Sure, but some actions are taken to minimize cost centers.

Like cleanup after a security breach.

Re:Why only Oracle's Java?

[Anonymous Coward]

Maybe it's time to ditch Java altogether!

Can I keep LibreOffice if I remove Java completely?

Re:Ditch Java entirely.

[characterZer0]

Ditch Java applets entirely.

All bugs should be reported opening

[Nyder]

This is why reporting bugs to the software developers is stupid. Post the bug into the public, so they have no choice but to upgrade. Corporations are run by people who want to spend as little as possible to make as much money as possible. They won't patch bugs unless they are forced. They need to be forced.

Re:All bugs should be reported opening

[Nyder]

ah shit, fucked the title up. I'd fix it, but no one is forcing me.

Re:All bugs should be reported opening

[Anonymous Coward]

DO IT!

Or else I'll report to the world how Nyder doesn't ensure his titles are proper length.

Re:All bugs should be reported opening

[swillden]

This is why reporting bugs to the software developers is stupid. Post the bug into the public, so they have no choice but to upgrade. Corporations are run by people who want to spend as little as possible to make as much money as possible. They won't patch bugs unless they are forced. They need to be forced.

Not untrue, but too broad. There are companies who not only do fix the bugs reported to them, but even thank those who give them the reports with large checks.

Granted that they're the exception, and Oracle is clearly not one of them.

As a former Oracle dev

[juancn]

Oracle is a huge organisation. I mean mindbogglingly huge (think planet Vogon). There is a lot of red tape that you have to cut to get anything done, and in 4 months they're probably still scheduling meetings to figure out if it should be fixed, and when, and by whom.

Unless an SVP gets involved, it's unlikely that it will be rushed.

Re:As a former Oracle dev

[NettiWelho]

Perhaps they should, you know, have a department dedicated to handling these kinds of things in a timely manner then?

Re:As a former Oracle dev

[Anonymous Coward]

I honestly don't care what reason they have for not fixing the problem. That's irrelevant. The bottom line is that they haven't fixed the problem.

Re:As a former Oracle dev

[Len]

If that's the way they work, they should not be selling mission-critical software that is exposed to the internet.

Re:As a former Oracle dev

[Anonymous Coward]

Obviously you don't work for a Fortune 30 company. If you did you would know how ludicrous your statement is. :)

Re:As a former Oracle dev

[juancn]

The thing is that even the way they relate to their customers is different. For example, once a customer came to visit Oracle HQ (it was a large European bank that shall remain unnamed) and I got pulled for some technical question that they had regarding an old version of some product.

I found astonishing to see the way the customers asked for things. The power play was reversed, rather than the vendor trying to convince the customer that his was the right way, it was the other way around. It was the customer trying (even begging) to sell us on some ideas that we should consider including in our roadmap for the next two or three years (pretty pleaasee?).

I actually was acquired by Oracle, so I started in a small company, and ended up in the belly of the beast. So I was used to thing being the other way around, more like having demands from customers, or we'll go to other vendor. In this case it was more like: we'll buy anyway, but please add this, it will make our lives a lot easier.

I'm not defending them, but an Oracle-size company is a very unusual beast. At the very least it should not be surprising that it takes them some time to move.

Re:As a former Oracle dev

[Anonymous Coward]

Vogons come from the planet Vogsphere. Don't mind me, just being pedantic.

Re:As a former Oracle dev

[Anonymous Coward]

    Well.. they will if you are on their level 1 support contract.... which they just raised the rates through the roof for.

Re:Ditch Java entirely.

[rsmith-mac]

Indeed.

Microsoft, Mozilla, Google, and Apple should all be seriously considering enacting the death penalty after this latest exploit. These browsers should be actively blocking the Java plugin by default. Java applets have outlived their usefulness and now are good for little else besides drive-by exploits.

Re:java is an abomination

[macbeth66]

Really? In what way? Specifics, man!

According to my info, it has some Java, but it is mostly C, C++ and Python and is based on the Linux kernel.

Stop spreading ridiculous myths

[Zero__Kelvin]

"A similar argument used to be debated years ago with Apple v Microsoft... Apple toted it's superior security over MS when in reality, nobody gave a crap about attacking Mac users which only made up 10% of the market. Once they gained popularity, they started getting hit more as well."

Really. When did this happen? The claim that Microsoft has more viruses because they have more market share is patently ridiculous, if only becaue Linux has a huge market share on the targets that hackers really want, to wit servers. It is a classic myth pulled out of the ether by people who have no understanding of security. The fact which every security expert knows is that you can't layer security on; it needs to be designed in from the ground up. Microsoft has always been more concerned about making money than anything else, and only began to take security seriously when it started to affect their bottom line (i.e. after the fact, rather than from the ground up.) This is the reason why Windows hosts well over 90% of the exploits, and for no other reason.

Re:Stop spreading ridiculous myths

[tnk1]

First of all, I think the comparison was Apple to Microsoft, not Linux to MS.

Second, when you talk desktop to server, you are talking apples (heh) to oranges. Desktops are important hosts for viruses because of what they are used for and who they are used by. Which is to say they tend to run on-demand applications and web browsing, and are run by anyone, usually amateurs who are easy to socially engineer.

A server is going to be run by professionals who operate services that are either developed in-house, or purchased and supported professionally. They will not frequently install new software, and that will usually be vetted carefully, if only because they will tend to spend money on purchase or support. You can still socially engineer professionals, but you will tend to have a lot harder time doing it, as they usually receive training covering that very contingency.

Consequently, while server exploits definitely exist, exploits that are directly related to a server tend to be fewer and more difficult to make use of where they exist, so Linux is going to have a much lower exploit penetration simply by virtue of being used mostly as a server, despite its market share of the server business. Hence, the comparison of the Windows market share, which is primarily desktop computing, to the Linux market share, which is mostly servers, is going to show significant deviation based on their usage patterns. That invalidates a direct comparison of their market shares in this instance and fatally undermines the argument.

Desktop market share is a big deal for viruses particularly if it is as high as that for Windows. The argument that Microsoft only cares about money doesn't cut it when you'd consider that Apple only cares about making money as well. MacOS is not a community project like most distributions of Linux, it may have more links to Open Source, but that doesn't mean that Apple is immune to profit motive, as we well know. You may well argue that Microsoft ignored the issues in favor of their vision of interoperability and control, but simple profit motive alone is not going to explain the differences without further elaboration.

Apple did and does have a smaller market share. It was also used, primarily, for purposes like design until it became more popular for developers in the last few years. While Apple probably has better security, part of which is inherited from it's UNIX roots, this is not going to be sufficient to deter malicious coders if there is interest in penetrating the MacOS share of PCs. In short, Apple users are a minority who don't really have a usage pattern that will be useful for most exploit developers. This is a real effect which decreases number and extent of exploitation and it *does* make using that platform safer, but it is a smokescreen, not a shield against future attacks.

You could make more of an argument for the security of an iOS specifically than Apple in general. However, even that security model was built more on the need to generate revenue than it was to prevent infections.

So, market share does matter significantly. While amateur hackers may well like the challenge of cracking something like a Mac or an Amiga for that matter, the more professional exploiters are going to spend time on the platform that they can generate the most effect from for the smallest initial investment. These professional exploiters will be more effective and more persistent than amateurs, which means they will tend to keep at exploits until they work well enough for significant penetration. This is a primary reason that Windows is riddled with exploits and would continue to be riddled with them even with better security measures.

Re:Stop spreading ridiculous myths

[Zero__Kelvin]

It would be nice if you actually read what I wrote, which you clearly didn't, or you wouldn't have made the following ridiculous statement:

"First of all, I think the comparison was Apple to Microsoft, not Linux to MS."

If you read what I wrote, you would realize that it has nothing to do with Apple, Linux, or Microsoft. I am talking about the myth that market share accounts for a phenomenally disproportionate distribution in vulnerabilities. The topic is security and the moronic myth you are spreading like a virus.

"The argument that Microsoft only cares about money doesn't cut it when you'd consider that Apple only cares about making money as well."

It's a good reason that I wouldn't consider that then, since Apple clearly cares about more than that. Is it a major factor? Yes. Do they also care about security? Clearly they do.

"Second, when you talk desktop to server, you are talking apples (heh) to oranges. Desktops are important hosts for viruses because of what they are used for and who they are used by. Which is to say they tend to run on-demand applications and web browsing, and are run by anyone, usually amateurs who are easy to socially engineer."

Again, you try to change the subject. This is about security, and the moronic myth you are spreading. It has absolutely nothing to do with social engineering.

" While amateur hackers may well like the challenge of cracking something like a Mac or an Amiga for that matter, the more professional exploiters are going to spend time on the platform that they can generate the most effect from for the smallest initial investment."

You don't exibit even a modicum of knowledge about security, which you make blatantly clear when you cannot even get terms correct. Professional hackers - the ones with the greatest skills - enjoy the challenge. Professional crackers go for the low hanging fruit. They don't go for the most lucrative targets, because those are secured. They go for the systems with poor security, because those are the only system they have a chance of compromising. By your own admission, they don't go for better secured systems. Since you make my argument for me, why did you even bother to argue?

Re:Stop spreading ridiculous myths

[tnk1]

Are you really making the definition of "hacker" and "cracker" part of your response? I just can't generate a serious response to that. All I can say is that I've learned my lesson and I'll consult the Jargon File the next time I make an argument. I am chastened and bow before your neckbeard. And your bolding skills.

Sorry, there I go again... I meant your use of the "strong" tag. Or was I supposed to use CSS here?

Still, you do realize that you can't actually refute something by simply labeling it "moronic", right? I wish that was the case, because I've always wanted to shake my fist at people and yell, "NO, YOU FOOLS," when faced with counter-arguments, but it never seems to work.

This is what happens when you attack the person instead of the argument. People get all sarcastic and stuff. Kittens die, mountains crumble and Republicans are elected in Chicago. Nobody wants to see that. Except the Republicans, of course. And the terrorists.

Re:Stop spreading ridiculous myths

[Zero__Kelvin]

"This is what happens when you attack the person instead of the argument."

Claiming a strawman attack has been launched when the person actually successfully countered your argument is second only to an actual strawman attack in the gallery of last gasps of the debate loser*. When you clearly exhibited a lack of knowledge of the subject matter, pointing that out is not a strawman attack.

* No. That wasn't a strawman attack either. I didn't say you were a loser, merely the one who lost the debate.

Re:Ditch Java entirely.

[bennomatic]

I'm pretty sure Apple (a) doesn't include Java by default and (b) even once you install it, they make you jump through hoops to allow it in the browser/applet context. I seem to recall them being called evil for making those decisions a while back.

Re:Ditch Java entirely.

[Anonymous Coward]

Everything we do

I'd like to see the formal business case you made for posting on Slashdot.

Re:Ditch Java entirely.

[AwesomeMcgee]

No.. I think his business model is:
1) Ditch Java
2) Use mono or LLVM or .NET one of assuredly many other available VMs
3) Profit!

Not too extreme really..

Security and Security Through Layering

[Anonymous Coward]

Why not run the java interpreter on a java interpreter written in java, running on a java interpreter written in java?

This would give the advantage of layering, and a HUGE speed increase, since everyone knows Java is faster than C/C++.

Think of the security and speed advantages!.

Re:Security and Security Through Layering

[Kagetsuki]

Is that a Gosling quote from when he says Ruby is inferior without actually knowing anything about Ruby and just making shit up, or is it from the time when he claimed non-optimized Java bytecode will run faster than hand optimized ASM on ARM?

Oh, and while I'm here let me just give a shout out to James: Hey James! Fucking die!

Re:Ditch Java entirely.

[binarylarry]

Mono sucks and is inferior to OpenJDK
LLVM is awesome but a different technology all together
LOL @ .NET

Re:Ditch Java entirely.

[chfriley]

And if you have not used Java in 30 days, Apple disables it in the browser. (At least Java 6 and I believe any Java version). :-)

e.g., see http://www.christopherprice.net/making-sense-of-oracle-java-7-for-os-x-2119.html

Re:Ditch Java entirely.

[Dishevel]

Networking is good.

Re:Ditch Java entirely.

[Pieroxy]

They are Apple, so any decision they make is inherently evil. Period.

And even that one was probably made so that they could file a patent on removing Java in the Web browser to impeach other vendors for doing so.

There.

Ditch Java? Done ages ago!

[Kwpolska]

Is it really time to ditch Oracle's java and go for an open source VM?

I, for one, got rid of all Java from my machine a long time ago. I think that everyone at slashdot did that too. You don’t know how angered I am when my set-top box has some problems (eg. today it stopped sending audio over HDMI, I needed to set it to standby and wake it up again) or when I got my Kindle today. Both are in Java. Unfortunately.

Re:java is an abomination

[Kagetsuki]

!? Java is basically the only language you can seriously use to write apps on Android. The NDK? It's awful. I love Android but I seriously hate Java. As a language it's terrible, and anyone who says otherwise needs to pull their head out of their ass and play with some other languages. What's awesome about Java is the JVM... which is basically just an open standard. It doesn't necessarily need to run Java code just Java *bytecode*. There are some fantastic alternatives that run on the JVM too, like Scala (and in sort of a different way JRuby). Unfortunately Scala on Android isn't so mature and is a nightmare to get working or really use.

Not fully supporting the NDK is one of the biggest things that pisses me off about Android. I'd drop Java in a heartbeat for C++ if the NDK was decent. Google would do well to start supporting some scripting languages natively too - there's a reason there are so many projects trying to make platforms in Python and Ruby for Android, but they all end up half assed or running out of time/money and they start going non-free.

Seriously Google, give us some alternatives. Java is the absolute worst part of Android.

C++ header files

[bLanark]

Yeah, I know C++11, I've looked at it quite a bit, and it is better than it was, but as long as it needs header files, I don't put it into a modern language category.
 

This is the most bizarre statement I've seen here today. Can you explain your reasoning?

Re:C++ header files

[RabidReindeer]

He's an idiotic Java weenie who thinks that 5000 long source files just to read the interface specification is a good thing rather than having it cleanly separated in a separate file. Managing header files is pretty much the least of your problems with C++ so he's clearly never used the language for anything but toy projects.

Unless you're still using COBOL, if you have 5000-line source files, you need to be slapped around some. Even 1000 lines is pushing it. That's not modular programming, it's spaghetti code, even when the language is structured and OOP.

Discrete header files were OK in C - there were rarely that many. In C++, it got a lot nastier, though You could have one header/class, multiple classes/header or mix-and-match - there really wasn't a standard. And THEN you got into "header hell", where the header and implementation got out of sync.

In Java, either you're working directly with the target class, so you're probably already going to end up referencing the source code anyway, or you're working with a generic API or SPI, in which case, and those are normally implemented as Interface classes, which are rarely more than a page or 2 long (at least if the author wants to foist it on me and continue living). Interface classes are a lot like C/C++ headers, but because they are bound more intimately with the class implementations, it's a lot harder to get them out of sync.

Re:C++ header files

[Anonymous Coward]

If your header and source files are out of sync in C++ you get compilation or linkng errors. Moron.

Re:C++ header files

[Spiked_Three]

Sure, I can explain it.

C#/Java, import runtime library (dll or jar) of rich libraries, write new classes (using nice readable names), usually one file per class (but in c# I can combine them into 1 file), compile run.
c++, include header files, write new classes (using hideously complicated naming and syntax), write duplicate definition in own header files, add libraries (already included) to linking process, compile, run.

One way is smooth and logical, the other is barbaric, and a top priority of the standards committee to get rid of, just hasn't happened yet. If its so ok, why have they said it's got to go?

Re:C++ header files

[Spiked_Three]

He presses F2 and gets an outline of the entire API including developer provided docs. A java programmer does similar things. Apparently you aren't old enough to wipe your ass yet.

Re:C++ header files

[bLanark]

Sure, I can explain it.

C#/Java, import runtime library (dll or jar) of rich libraries, write new classes (using nice readable names), usually one file per class (but in c# I can combine them into 1 file), compile run.

c++, include header files, write new classes (using hideously complicated naming and syntax), write duplicate definition in own header files, add libraries (already included) to linking process, compile, run.

One way is smooth and logical, the other is barbaric, and a top priority of the standards committee to get rid of, just hasn't happened yet. If its so ok, why have they said it's got to go?

It's not clear to me, still. Please give concrete examples, from your point of view, showing the difference between the two? And please avoid emotive terms like "barbaric" That's adding nothing.

Nothing needs to be complicated about naming in C++, in fact it's easier than system.io.println, IMO. I am free to give my class and methods meaningful name - what's your point here? Better than giving everything a com.myco (well, actually we were taken over, so _myoldco_ - we don't want to break anything).system.subsytem prefix.

In Java *or* in C++, if you change a class interface, the dependencies need to be rebuilt. Most Java IDEs will do that on-the-fly, and you might have to invoke another tool (E.g. make) to build, especially if you are doing multi-platform development. But the building happens no matter what. If your C++ build tool does too much work when you make a change, then that effort can probably be avoided.

Please don't mix up Windows DLLS with shared objects in other systems, mentioning them is nothing to do with C++ per se.

Re:C++ header files

[Spiked_Three]

Sorry, I don't engage in prima donna intellectual conversations. If you don't like my emotions, skip over them. But why do you ask to leave them out, then use one as your first argument (ie naming)? I will admit, I was using a beta product that had trouble with namespaces, so my bitch about naming is withdrawn, although I still think STL names are very hard to read compared to C#s or even Javas.

And I think you are agreeing with me on the next subject - IF C++ could deal with changes to an interface, on its own, without the need for me to tell it in a second file, perhaps by a compiler maintained header / equivalent of a library (.dll or otherwise) with imbedded cargo information, then C++ would be acting like a modern language. What do you know, we both agree with C++11 committees as well, that is where they are headed. Its not clear to me what your point about DLLs has to do with anything, and why you think I am mixing them up with .... well I have no idea.

Anyhow, I am glad we agree, on everything substantive.

Re:Ditch Java entirely.

[nedlohs]

No it doesn't. And the goal of every action is certainly not profit.

There was no business decision being made when I had peach with my breakfast instead of grapefruit this morning. There was no profit when we played Alhambra last night instead of Carcassonne.

Good Java Desktop Application

[naroom]

ImageJ is a wildly popular image processing toolkit written in Java. Users are able to write their own plugins as .jar files, and thanks to that, there are loads of plugins for doing every image transform imaginable.

Re:Ditch Java entirely.

[nedlohs]

Posting anonymously is not networking.

Re:Why only Oracle's Java?

[rvw]

Maybe it's time to ditch Java altogether!

Can I keep LibreOffice if I remove Java completely?

Calm down... You can keep it - sure.
(Whether it still works is another question. ;-)

Java on Slashdot is almost a meme now

[GodfatherofSoul]

Same old jokes and criticisms. Reading these posts, you'd think Java was relegated to driving outhouse fans in Siberia and not the #3 language by popularity in the world.

That being said, the Java *browser* vulnerabilities need to be taken far more seriously. The only exploit that I know I've been hit by was through an unpatched Java install and it was nasty; as in rebuild my laptop from the ground up nasty.

Re:Java on Slashdot is almost a meme now

[pnot]

Same old jokes and criticisms. Reading these posts, you'd think Java was relegated to driving outhouse fans in Siberia and not the #3 language by popularity in the world.

Jokes and criticisms mainly seem to be coming from those who conflate the JVM, the Java language, the JRE, the Oracle Java browser plugin, and more or less anything else with a J in the name. "Browser plugin compromised, omg that means your GCJ desktop application is broken!"

Re:Java on Slashdot is almost a meme now

[JDG1980]

Same old jokes and criticisms. Reading these posts, you'd think Java was relegated to driving outhouse fans in Siberia and not the #3 language by popularity in the world.

A lot of these problems could be resolved if the Java installer didn't include the browser plugin. That should be a separate download, or at least it should require the user to affirmatively check a box. At this point, Java in the browser is, for most users, little more than a giant security hole. Virtually no legitimate public websites require it.

Re:Java on Slashdot is almost a meme now

[pnot]

Amen to that. As any /. Java comment thread demonstrates, the chief functionality of the Java browser plugin these days is tarnishing the reputation of the entire Java platform and ecosystem.

Doubtless there are still websites out there that need the plugin, but I don't remember the last time I saw one. Definitely time to make it opt-in, not opt-out.

Re:Java on Slashdot is almost a meme now

[Anonymous Coward]

Nothing worth having is written in it if you eliminate ridiculous enterprise crapware from consideration. I hope I would avoid running Java software on principle because of the horrendous JVM. However, I've never actually come across anything I wanted to run to test my resolve on that position.

Re:Java on Slashdot is almost a meme now

[makomk]

Is GCJ actually capable of running any Java desktop applications these days? Last I heard it had kind of been left behind by improvements in Java.

Re:Java on Slashdot is almost a meme now

[pnot]

Is GCJ actually capable of running any Java desktop applications these days? Last I heard it had kind of been left behind by improvements in Java.

I doubt you could use it as a drop-in replacement for a modern JRE. I did manage to compile a (very) small Swing application unmodified a year or two ago, but the Swing component implementations proved to be a bit buggy. AIUI, gcj was mainly created to address Java's non-freedom and slow execution speed; OpenJDK removed the first selling point, and JIT the second.

pdftk is the only program I use day-to-day which I know to be gcj-compiled. This illustrates perhaps gcj's sole remaining niche: smallish non-interactive command-line utilities where the start-up time of a JVM would impose a significant slow-down.

Re:Java on Slashdot is almost a meme now

[Anonymous Coward]

All screen-sharing/conferencing sites I've used within the last year (WebEx, ReadyTalk, etc.) with the exception of Join.Me all use a Java-based loader to install the real software locally (so you don't new to rely on stupid users to both download *and* install the software).

This is an absolute requirement for browsers that don't have ActiveX support.

These are legitimate websites and yet they use Java. Am I missing something, or were you just talking straight out of your ignorant ass?

Business Case for Learning.

[Anonymous Coward]

Simply put, we plan and expect bullshitting for 2 hours a day at work. Facebook is frowned upon, but reading tech sites and the news is listed as appropriate things to do on work time. We also encourage crashing other people's cubes and telling stories about other things you've done in related fields.

Re:Ditch Java entirely.

[Dishevel]

It is if your name is Anonymous.

Question on Java

[sinij]

I am not a web developer, and haven't worked as one since dot com (doh, first one in the 90s, not the social media meltdown that going on right now) bubble. Back then you could make a clear case that java was absolutely necessary.

What about today? Can we do without it? I run with no-script on all the time, and only occasionally have to enable something, it hardly ever breaks web pages these days.

Re:Question on Java

[Anonymous Coward]

I run with no-script on all the time, and only occasionally have to enable something, it hardly ever breaks web pages these days.

No-script is for JavaScript, not Java.

Zero Day?

[BenSchuarmer]

I don't think that word means what you think it means

Re:Ditch Java entirely.

[AliasMarlowe]

Everything we do has a business case attached

I'd like to see the formal business case you made for posting on Slashdot.

Well, it was originally a 78 page densely-written scenario analysis document circulated four weeks ago to more than 20 executives and managers. They liked it, so I was authorized to spend a week making 45 slides to reinforce the case, and these were presented two weeks ago to a specially selected focus group of at least 30 managers and engineers. We discussed it for a whole day at the meeting. There were lots of fancy headings, beautiful fonts, pie charts, animations, etc., and I got excited and did a lot of arm-waving which helped persuade the focus group to pass the business case onwards. I'm not sure which team they passed it to, but our processes must be streamlined, because it already got approved today, which was pretty fast.

Anyway here it is, reduced disgracefully down to a single paragraph:
"By encouraging all businesses to waste effort making business cases to justify every decision (including trivial ones), we can cripple our competitors in terms of costs (their management overheads skyrocket), reaction time (all their decisions get delayed), and flexibility (they must omit/neglect some possible decisions). Posting as an AC on Slashdot will advance this goal."

Re:Java is used everywhere in the office

[Billly Gates]

As someone pointed out in the last story it is the IE 6 that wont go away, or at least the Cobol of the 21st century.

Every banking site requires it so it can wrap win32 com objects like excel spreadsheets for lines of credit reportsthat can be cut and pasted using security holes from 1.4.1 or some ancient version. So java is used to activeX like functionality with no security controls and is a requirement for anyone in finance. Some support java 6 but have to include some security holes so they can access windows dlls for the accountants.

Manpower and Kronos for clocking employees in and out also use Java. Java is still the most widely used language in the world if you check any website.

The irritating thing is not that Oracle wont fix java and should be liable, but rather apps and banking sites require such ancient versions of it that only work with XP and are filled with 30 or more security holes.

Many of these accountant laptops just get re-imaged on a weekly basis from infections. These same accountants only look at the cost of upgrading and not the productivity loss.

The US Patent Office may have known about this

[Steve1952]

The US Patent and Trademark Office (USPTO) requires Java in order for outside users (such as patent agents and attorneys) to access their files on the USPTO servers. They have been warning for months that their systems are not compatible with Java 7, and only work with earlier versions of Java.

This is a big pain, since it forces you to keep your entire system at Java 6.X. Earlier I thought that this delay was mere bureaucratic foot dragging. Now I'm thinking that perhaps they had a "heads up" warning.

Re:Ditch Java entirely.

[Bobtree]

It goes more like this:

1) ???
2) Ditch Java
3) Profit!

Re:Why only Oracle's Java?

[RaceProUK]

Maybe it's time to ditch Java altogether!

Can I keep LibreOffice if I remove Java completely?

Calm down... You can keep it - sure. (Whether it still works is another question. ;-)

IIRC, Java's only used for LibreOffice Base - the rest will work fine without it.

Re:Ditch Java entirely.

[oakgrove]

Um, could you forward me those slides?

Report to OpenJDK as well

[David Gerard]

If you find a security 'sploit in Java, test in OpenJDK/IcedTea and report it to the security teams at Red Hat, Ubuntu and Debian. They are rather less likely to sit on it for months. I notice a fix in OpenJDK came through in Ubuntu this morning.

Not a zero day bug

[slashkitty]

It's not a zero day if it was privately submitted over a month before. Zero Day means "a previously unknown vulnerability". It just wasn't public, so they didn't have as much urgency in fixing. Just stop calling it a zero day bug if the developers knew about it before hand.

VM?

[QuantumRiff]

I know they are referring to an open source Java Machine.. but using a term like "open source VM" is kind of unclear. Especially when oracle has both Virtualbox and a product called "Oracle VM" http://www.oracle.com/us/technologies/virtualization/overview/index.html?origref=http://duckduckgo.com/post2.html

Re:Why only Oracle's Java?

[ais523]

Unlike OpenOffice.org, LibreOffice has been intentionally trying to reduce or remove Java dependencies. (I don't know whether it's because they're worried about Oracle too, or for some other reason, like "why would an office suite need Java anyway?".)

Re:java is an abomination

[macbeth66]

I was referring to Android, the OS, that the AC was blasting, not the development kit(s).

I have not tried to develop for the Android because I was so disauded by others by the very issues you bring up.

...and again.

[Anonymous Coward]

It has nothing to with "Java as a JVM and language" but everything to do with silly browser plugin, which nobody should be using in the first place.

Processes in overly-large & complicated orgs

[zooblethorpe]

Oracle is a huge organisation. I mean mindbogglingly huge (think planet Vogon). There is a lot of red tape that you have to cut to get anything done, and in 4 months they're probably still scheduling meetings to figure out if it should be fixed, and when, and by whom. Unless an SVP gets involved, it's unlikely that it will be rushed.

Perhaps they should, you know, have a department dedicated to handling these kinds of things in a timely manner then?

Oh, don't worry, it's in the works -- the planning meeting for starting the process of organizing to set up such a department is scheduled for early 2013.

Re:Why only Oracle's Java?

[Anonymous Coward]

You do realize the vulnerability is a privilege escalation that almost exclusively affects Applets, right? As a web server, this vulnerability gives you more power to use the user's machine in ways you wouldn't otherwise be able to...Java has just become a more attractive option on the server, not less.

Re:java is an abomination

[Anonymous Coward]

As a language it's terrible, and anyone who says otherwise needs to pull their head out of their ass and play with some other languages. What's awesome about Java is the JVM... which is basically just an open standard. It doesn't necessarily need to run Java code just Java *bytecode*. There are some fantastic alternatives that run on the JVM too, like Scala (and in sort of a different way JRuby). Unfortunately Scala on Android isn't so mature and is a nightmare to get working or really use.

I like how you say how awful Java is, but then go on to say how much you like Scala. Scala is 10% "extremely nice" and 90% "how to generate an unmaintainable shit-storm of code in 5 minutes or less."

As someone who has actually played with a lot of different languages, I can tell you that while Java isn't perfect, it (and various frameworks) facilitate generation of extensible, maintainable, testable server-side code, far more easier than almost any other language. C# is probably comparable - it has more language features, and like all Microsoft extensions, some are good, and some are downright terrible. PHP is just plain shit. Python is ok, but you'll never get developers to (politically) agree on using a language that still has the "spaces-make-block-structure" hack; ditto with the lack of static typing. C/C++ are just plain slower for server-side application development, but great for embedded. Clojure is nice, but has too large a performance hit to use in production. Similarly, Haskell is great, but doesn't have the software ecosystem to get things done quickly. Ruby on Rails is a scalability disaster (although Ruby might be ok on its own.)

Re:Wow. Time for a class action suit, then.

[lorenlal]

IANAL, so I have to ask. If the company *knows* their software has a security hole, and intentionally disregards it, do they then become liable for some or all of the damages?

I have to imagine that if they were seriously trying to fix this, and it was just taking a while that there would not be such an outcry. Would it be necessary in the suit to prove that they are ignoring the problem?

Re:Ditch Java entirely.

[denvergeek]

They all just say "Synergy" over and over...

Re:Ditch Java entirely.

[spongman]

your reasoned argument is awesome!!?!

Re:Ditch Java entirely.

[spongman]

1) Profit
2) Java
3) Ditch
4) ???

No, time to stop using Java entirely

[Anonymous Coward]

Sorry OP, time to stop using Java as a serious development language and consider it damaged. Java is the worst part of Android as well as the worst part of pretty much all mobile devices. Java was promising for certain things, but honestly the future is just EMCAScript JIT for everything that isn't native compiled.

Oracle doesn't care about Java in the browser

[SomewhereInTheUs]

Java is worthless in the browser and I doubt that Oracle cares if it's removed. They might even prefer it.

Rather, Java's worth to Oracle is primarily as an internal tool for creating products/services and secondarily a means for providing easy extensibility and connectivity to developers that code to the interfaces those products expose.

The days of Sun evangelizing Java as the Second Coming and pimping it everywhere they can are over. It's just a means to an end at Oracle.

Re:java is an abomination

[MrSteveSD]

Seriously Google, give us some alternatives. Java is the absolute worst part of Android.

Indeed. I'm finding it's particularly bad for game development where you want to avoid continuously allocating objects on the heap. So if you need to continuously call some mathematical function from the game loop that uses a temporary vector as part of the calculation, this is an issue. How do you create this temporary vector? If we create a new one in the function, it will go on the heap, so we don't want to do that. You could have some module-level variable that the function uses, but that's rather messy. I ended up having to make an object caching system. When a function needs a vector, I pop one off the global vector cache, do the calculations, then push it back. This is messy and dangerous in its own way too though.

In C# you could just implement the vector as a struct, since structs go on the stack rather than the heap (and in C++ you can put what you like on the stack). C# stucts have value semantics too, which I think is an added bonus for something like a mathematical vector. Java is quite crippled in this respect. Another annoyance I immediately found with Java is that you can't pass parameters by reference. Why does Java have such a restriction? Even Visual Basic 6 could pass by reference. It's not that often that I want to pass a parameter by reference, but sometimes you really need to.

I also made the mistake of trying to use Generics in Java. I knew ahead of time that due to type erasure, there would be no performance improvement, but I didn't quite realise how crippled the Generics were. I first noticed this when trying to declare an array of a generic type. This does not work due to type erasure. Java Generics really is a train wreck.

It's a shame C# is so strongly tied to windows (and Microsoft) because it's one of the most advanced modern languages there is. Compared to Java, it really is a joy to use. It doesn't get in the way of what you want to do.

Re:Ditch Java entirely.

[steelfood]

Amazon did it for a couple of years. So did E-Bay. They had income, but no profit.

All you need is enough venture capitalists to keep you going until you hit critical mass.

Re:Ditch Java entirely.

[Culture20]

More like
1) Ditch Java
2) Prevent potential catastrophic loss
3) Profit!

Re:Why only Oracle's Java?

[hairyfeet]

Have they removed the pop ups yet? The last time I installed LO it complained left and right because the system didn't have Java on it, one of the reasons I don't ever install LO the traditional way anymore, I just go to Ninite and use their fully automated install for LO along with any other must have software the user needs, no bitching about Java with Ninite and no Java install either, double good.

Re:java is an abomination

[Kagetsuki]

Let me try and sum that up for you: Java lacks a lot of language level functionality and has an over-simplified object and instance model which means you need to write massive blocks of code with the sole purpose of implementing functionality that's immediately available in other languages.

Oh man don't even get me stated on this. I've written hundreds of lines of code in Java to mimic functionality that can be achieved with a single operator with Ruby. Java has so many weird quirks too, like the fact that you can't compare a string object and a string literal with ==... I mean I get it for obejct comparison but seriously, how often do you compare string objects with other string objects to determine if they are the same object instance? I've done that... never. How about at least allowing operator overriding for [] so we can use vector... err.. "ArrayList" or whatever a little cleaner. And why can't we override or append constructors (without intentionally leaving an overridable method call)? I could go on forever here... but seriously anybody who wants to start attacking me for these complaints should sit down with Scala for a few hours. There's reasons Scala exists and just some of those are what I listed here - all the advantages of the JVM without having to write method after method of crap that should be a language feature to begin with.

Not about how bad the product is

[dutchwhizzman]

My suggestion to look for an alternative VM was because of how Oracle deals with the vulnerabilities. It's not about how bad the VM is, because given all alternatives, it's one of the best out there in terms of features, stability and performance.

When you deal with large amounts of software, several platforms and millions of people using it, you are going to get bugs. Nasty, insecure, application breaking bugs. Given the same quality of code, what differentiates the good from the bad vendors, is how they deal with those bugs. Oracle seems to default to dealing with grave security problems by keeping the submitters and their end users in the dark and not fixing them for over 3 months, even though their release cycle is every three months. I consider that to be bad.

If this 0-day didn't get the exposure it got, we would all probably be still vulnerable to it for who knows how long. We know about this vulnerability, but Gowdiak reported more. There are more people like Gowdiak. Statistically speaking, chances are probably very close to 100% that Oracle is sitting on more known severe 0-day bugs that they haven't fixed for many many months.

If that is Oracle's policy, they have a dangerous VM and it will remain dangerous until they either change the policy, or it gets replaced by an alternative. That's why I think that people that choose to use Java for who knows what reason, should seriously consider looking at alternatives for the Oracle Java VM.

Re:Wow. Time for a class action suit, then.

[amicusNYCL]

Proving that they intentionally disregarded it when they have a fix planned for the October update would be pretty difficult. I don't think you can charge a company with a crime because they have a 4-month patch cycle. Instead I would like to see browser vendors make a move to block the Java plugins by default and require explicit user activation to enable them on a 1-time-use basis (obviously with advanced options to fine tune this behavior). If Oracle doesn't want to update Java frequently fine, but someone needs to protect the users if it's not Oracle.

It's even worse

[Myria]

This is the programming language that still bundles the "Ask Toolbar" crapware with their installer. Nuff said.

It asks you whether you want to install the Ask Toolbar, defaulting to yes, of course, every time you install a security update.

Java is totally unrelated to javascript

[Anonymous Coward]

I suspect you're thinking of Javascript, which is wholly unrelated to Java. That's a completely different language, originally and generically called emacsript. One brand of emacscript script was renamed "javascript" just to make it sound like Java.

In fact, Java and Javascript are no more related than Susan Smith and Will Smith.

Have You Ever Thought About

[Anonymous Coward]

..the security implications of your fat client approach ?? Dick and Joe have a direct SQL connection to the corporate database ? If they bring John D. Criminal into their office he will run Wireshark, extract the database password and then mess with your database. He won't do "drop table XX", he will instead do something like "update accounts set outstanding = outstanding + 17 where customer_id > 170000 and customer_id 175000". That will destroy the integrity of your database without you realiizing it immediately. So the corrupted stuff will be backed up nightly and three months later you will only smell lots of shit, but you will not know were and when it came from. Fat clients are the dumbest idea you can think of.

Re:Ditch Java entirely.

[Anonymous Coward]

And if you have not used Java in 30 days, Apple disables it in the browser. (At least Java 6 and I believe any Java version). :-)

e.g., see http://www.christopherprice.net/making-sense-of-oracle-java-7-for-os-x-2119.html

Which in my opinion is a bit of "dirty pool", as Oracle doesn't ship Apple's Java offerings, Apple builds, packages, and distributes Java source code obtained from Oracle. In other words, instead of killing your browser to piss you off at Oracle, Apple could have just shipped a modern non-vulnerable version of Java.

But don't take my word for it, check it out yourself.

An Alternative

[Anonymous Coward]

As efficient as C++ with the same memory-safety assurances as Java or C#: http://sourceforge.net/projects/sappeurcompiler/

Or, take a look at Lazarus and disregard the "Pascal is outdated" B$. Very fast compilation, efficient execution. Quick development/debug cycles. Great IDE.

Android

[theshowmecanuck]

And what about on Android devices. Since Android is basically a Java based technology.

Tuxedo Server Is or Was The C/C++ JEE Alternative

[theshowmecanuck]

Tuxedo Server has been been around since the 1980s and is the C/C++ analog to JEE servers. From my understanding it started out for use with C and COBOL and then C++ to solve the same issues JEE back end containers are meant to solve. I have seen it used with other languages as well (as clients) including Visual Pascal, Visual Basic, and Visual C++, as well as tying into JEE systems and other web based clients. It started with AT&T, moved to BEA, which was then bought by Oracle. So you have come back full circle to the Oracle cunnundrum. And it isn't open source and it isn't free. But it works very well and scales massively. I have seen it run systems that handle tens and hundreds of millions of customer accounts, and highly complex and incredibly high volume of transactions.

Re:Ditch Java entirely.

[makomk]

.Net's not bad but ties you into Windows. Mono though, ugh - memory leaks out the wazoo on long-running servers that run fine under Microsoft .Net, a garbage collector that sucks compared to what Java had in 1992 let alone 2012, and as for backwards compatibility...

Re:Ditch Java entirely.

[Lime Green Bowler]

I'll bet it failed because the slides weren't in Comic Sans.

Re:Ditch Java entirely.

[bennomatic]

Well, you're right, except that the modern, non-vulnerable version was apparently vulnerable!

Re:Ditch Java entirely.

[Anonymous Coward]

Hear hear! And Obama uses a Mac. Draw your own conclusions!

Re:java is an abomination

[Anonymous Coward]

!? Java is basically the only language you can seriously use to write apps on Android.

Oxymoronic disposition of "seriously" and "Android"

Nuff said

Re:Ditch Java entirely.

[Anonymous Coward]

meta: i love that this got modded 'insightful'

Re:Wow. Time for a class action suit, then.

[doccus]

Aren't repeated letters to a manufacturer, that remain ignored, evidence of "ignoring the problem"? As far a the"patch cyle" goes, can they really get away with.. "it's only caused infected or hijacked PCs for a third of a year, that's neither s a significant amount ,nor our responsibility .. That appears how this played out, to me,...

Re:Wow. Time for a class action suit, then.

[amicusNYCL]

You're going to have to prove that they ignored the problem internally, rather than simply not sending a reply to the letter. I don't reply to every bug report, but I still fix them. Considering that they already released a patch for this issue yesterday though, it sounds like a moot point. Obviously they didn't ignore it.