Security Expert Says Java Vulnerability Could Take Years To Fix, Despite Patch

An anonymous reader writes "After the Department of Homeland Security's US-CERT warned users to disable Java to stop hackers from taking control of users' machines, Oracle issued an emergency patch on Sunday. However, HD Moore, chief security officer of Rapid7, said it could take two years for Oracle to fix all the security flaws in the version of Java used to surf the web; that timeframe doesn't count any additional Java exploits discovered in the future. 'The safest thing to do at this point is just assume that Java is always going to be vulnerable,' Moore said."

Comments

Java used to be secure and sandboxed

[buchner.johannes]

What happened? Most of these exploits seem to rely on rewriting methods / accessing byte code ... how about disabling that access for applets as a temporary measure?

Re:Java used to be secure and sandboxed

[bobdehnhardt]

Nothing is truly secure, it's simply in a state where the vulnerabilities haven't been discovered yet.

Re:Java used to be secure and sandboxed

[robmv]

I don't see think Java the platform is a security nightmare, but if someone doesn't need then don't install it, reduce your chances of being attacked with software you don use.

Every Chrome/Firefox release has security vulnerabilities fixes, sometimes bugs as critical as this one, and I don't see people screaming "Remove Chrome, Disable Firefox...". All software has bugs, the problem with Java is the slow response of Oracle (and Sun at that time) fixing things, the update cycles are too long and only when a critical bug very loud on the media is found you see them pushing a fix.

Re:Java used to be secure and sandboxed

[zero.kalvin]

Yes, but when a bug is found in either of them (Firefox or Chrome) devs race to plug the whole. On the other hand Oracle knew about this since August and did nothing about it..

Re:Java used to be secure and sandboxed

[gandhi_2]

Maybe if they'd spent less time trying to get people to install ask toolbar or somesuch bullshit....

Re:Java used to be secure and sandboxed

[Anonymous Coward]

They did not do nothing about it, they did release a patch. (That patch was insufficient and that is a valid point to criticize Oracle.)

Re:Java used to be secure and sandboxed

[Anonymous Coward]

yes, we already blacklist Java across the company where I work due to this.

in general they're quite liberal about letting employees manage their own computers (it's a software dev studio) but Java is blacklisted because of the Ask bundling, which is considered Spyware at corporate level and difficult to remove cleanly.

Re:Java used to be secure and sandboxed

[Billly Gates]

I don't see think Java the platform is a security nightmare, but if someone doesn't need then don't install it, reduce your chances of being attacked with software you don use.

Every Chrome/Firefox release has security vulnerabilities fixes, sometimes bugs as critical as this one, and I don't see people screaming "Remove Chrome, Disable Firefox...". All software has bugs, the problem with Java is the slow response of Oracle (and Sun at that time) fixing things, the update cycles are too long and only when a critical bug very loud on the media is found you see them pushing a fix.

It is a security nightmare. You can put to geek stats and engineering and I will point to examples. At the end of the day what matters is how many exploits keep getting hit by it compared to other products. The only thing that comes close are IE 6 and flash. Even PDFs have exploits but not as many as java nor the frequency.

Other browsers and technologies like silverlight have good engineering principles and less vulnerabilities. ... actually Firefox does have some as well compared to Chrome but htey update. Anyone uninstalling java yet uses Firefox 3.6 out of choice with +40 exploits is a fool. Chrome and IE 9 are sandboxed and so is silverlight. Java is sandboxed sort of, but it has RMI which sole purpose is to include untrusted unsigned c code. Corporations love it as it means +COM ojbect access for excel, but it also means a cracker can put whatever he wants in it. As Sun/Oracle try to sandbox and limit RMI it then breaks apps and teh corps end up whininng and locking down insecure old versions of it so their shitware apps work as they do with sticking with IE 6 as well.

Java still has its uses but not as a browser plugin. Java 7 is truly aweful and I sitll use Java 6 on my computer with plugins disabled on my browsers. It also doesn't turn itself back on inside the browser either. Java 7 turned security off and it re-enables itselfs in the browser according to ther slashdotters.

I highly advise anyone reading this to downgrade to Java 6 if they need it and then disable it in their browsers until all their apps no longer require it.

Re:Java used to be secure and sandboxed

[jones_supa]

Java used to be secure and sandboxed. What happened?

That struck the odd chord in me too. In my mind Java has also held the status of being a relatively secure system.

Re:Java used to be secure and sandboxed

[bbn]

Java code is sandboxed but many parts of the Java standard library is not written in Java. Every time SUN took the easy way out and used an external library instead of reimplementing in Java, they opened the platform to exploits of bugs in that library. Also it seems the SUN engineers did not really like to code in Java so they made a very large part of the platform in C - even when they could have made those parts in Java.

The standard library rt.jar file has more than 1000 methods that are implemented by native calls to C code or third party C libraries. It is simply too much to check that every single one of those crossed all the t's and dotted the i's. So we keep finding more bugs.

The sandbox itself is fairly secure so there is nothing wrong with the idea. It is just the implementation that went wrong.

Re:Java used to be secure and sandboxed

[LordLimecat]

Until it was the top attack vector in browsers for about 5 years running, sure. After that I think people started to go sour on it.

Re:Java used to be secure and sandboxed

[squiggleslash]

Disuse leads to misuse.

I'm serious. Java (on the web browser) got ignored, Flash (a more complex system so misleadingly more insecure) got the attention, and as a result Sun, and then Oracle, increasingly went to "phoning it in" as far as updating the Java plug-in went. If you want to know where the security holes are in any system, don't look at the parts that everyone uses, as those are the parts the security people are all over.

Re:Java used to be secure and sandboxed

[Anonymous Coward]

Taking half a year to release the patch is also a valid point to criticize.

Re:Java used to be secure and sandboxed

[khelms]

You do realize this is not the same thing as Javascript, right? Far fewer sites use actual Java compared to Javascript.

Re:Java used to be secure and sandboxed

[VGPowerlord]

They did not do nothing about it, they did release a patch. (That patch was insufficient and that is a valid point to criticize Oracle.)

Taking half a year to release the patch is also a valid point to criticize.

The GP wasn't talking about the patch from Saturday.

There was a previous patch in October that partly plugged the hole that was exploited this time, and Oracle should definitely be bashed for that.

Re:Java used to be secure and sandboxed

[Anonymous Coward]

I don't see think Java the platform is a security nightmare, but if someone doesn't need then don't install it, reduce your chances of being attacked with software you don use.

Every Chrome/Firefox release has security vulnerabilities fixes, sometimes bugs as critical as this one, and I don't see people screaming "Remove Chrome, Disable Firefox...". All software has bugs, the problem with Java is the slow response of Oracle (and Sun at that time) fixing things, the update cycles are too long and only when a critical bug very loud on the media is found you see them pushing a fix.

It is a security nightmare. You can put to geek stats and engineering and I will point to examples. At the end of the day what matters is how many exploits keep getting hit by it compared to other products. The only thing that comes close are IE 6 and flash. Even PDFs have exploits but not as many as java nor the frequency.

Other browsers and technologies like silverlight have good engineering principles and less vulnerabilities. ... actually Firefox does have some as well compared to Chrome but htey update. Anyone uninstalling java yet uses Firefox 3.6 out of choice with +40 exploits is a fool. Chrome and IE 9 are sandboxed and so is silverlight. Java is sandboxed sort of, but it has RMI which sole purpose is to include untrusted unsigned c code. Corporations love it as it means +COM ojbect access for excel, but it also means a cracker can put whatever he wants in it. As Sun/Oracle try to sandbox and limit RMI it then breaks apps and teh corps end up whininng and locking down insecure old versions of it so their shitware apps work as they do with sticking with IE 6 as well.

Java still has its uses but not as a browser plugin. Java 7 is truly aweful and I sitll use Java 6 on my computer with plugins disabled on my browsers. It also doesn't turn itself back on inside the browser either. Java 7 turned security off and it re-enables itselfs in the browser according to ther slashdotters.

I highly advise anyone reading this to downgrade to Java 6 if they need it and then disable it in their browsers until all their apps no longer require it.

Yeah, downgrade to a previous version with lots of security holes that are well known by now. That makes a lot of sense /eyeroll

And highly advise? You do realize youre just some guy on the internet right with no qualifications that are proveable or anything said that has even a shred of insight to it right? If everyone listened to anyone who just spouted some inane and pointless stuff on the net and then advised people to do something we would all be in a lot of trouble. Youre failing at sounding credible or even half way intelligent. I suggest you just stop talking.

Re:Java used to be secure and sandboxed

[Anonymous Coward]

If you download from java.sun.com (or http://www.oracle.com/technetwork/java/index.html) then there's no bundled toolbar. Only the installers from java.com have the bundled toolbar.

Re:Java used to be secure and sandboxed

[aled]

Java is sandboxed sort of, but it has RMI which sole purpose is to include untrusted unsigned c code. Corporations love it as it means +COM ojbect access for excel, but it also means a cracker can put whatever he wants in it. As Sun/Oracle try to sandbox and limit RMI it then breaks apps and teh corps end up whininng and locking down insecure old versions of it so their shitware apps work as they do with sticking with IE 6 as well.

This part of your post has wrong information. RMI is remote method invocation, has no relationship to execute c code. May be you are referring to JNI, Java Native Interface. I don't think you can execute native code in an unsigned applet. Why would anyone use it for accesing an excel spreedsheet is beyond me given that there are excelent pure java libraries for doing so.
Perhaps some company used Java and a COM bridge in the IE6 age when there where few alternatives and now is reticent to re implement it. Maybe this case could help convince them of the error of their ways.

Re:Java used to be secure and sandboxed

[aled]

For example, Java might have been a great idea, if it's main purpose was to enable applications... not games... to write once, run anywhere. This is largely being replaced with Javascript which is easier for people to understand because it lacks all the class bullshit that nobody understands.

You know, for most people actually using Java it works well for applications to write one, run anywhere, it's easy enough to understand, have an extensive library and even some commercial games are written in it (Rune, Minescape).
The principal source of complexity is in the number of different frameworks available, but don't we like alternatives here in Slashdot?
I think it is being reemplaced by Javascript in the front end mostly because of other issues, namely Java requires a relatively big runtime to deploy, user interfaces are not as easy as in other languages nor as pretty by default and the general movement from desktop to the web.

Re:Java used to be secure and sandboxed

[aled]

I'm not sure but I think any version resets some configurations. For example I have to disable the auto update feature after installing.

Re:Java used to be secure and sandboxed

[aled]

My thoughts exactly. Has really Oracle dropped the ball or is just too much attention from hackers or bad luck? Does really Java has a worst security record than other software (browsers, OSs, PHP)? Or is just that the Java exploit got much more press than others in the past?

Re:Java used to be secure and sandboxed

[Anonymous Coward]

This is absolutely not true. This vulnerability was a zero-day exploit. Zero-day means, by definition, nobody knew about it except the guys who wrote the exploit. We learned about this exploit last Thursday and had a fix on Sunday. Folks were up working around the clock to get the fix out.

We take security exploits incredibly seriously. Three times a year Oracle produces "critical patch updates" and we're working hard to clear out every bug from our backlog related to security, at the expense of new feature development. The suggestion that Oracle doesn't care about fixing these security problems is simply not true.

Re:Java used to be secure and sandboxed

[dshk]

You do realize that many casual games are Java applets, right?

Re:Java used to be secure and sandboxed

[rve]

The troll. You are feeding it.

It's a good one, better than most. Clever use of a series of real technical terms taken out of context and having nothing to do with the issue or Java or each other, and to finish it off, some truly awful advice

Re:Java used to be secure and sandboxed

[Gr8Apes]

Well, dumb is as dumb does, or whatever that quote was. Here we see it in action. JRE 7 u 11 has a plugins off option in the configuration, and I believe it prompts you during install as well.

If you support PCs as real work, in a real company, then you should be in control of basic functions. I wouldn't allow a windows machine on the network that wasn't severely restricted. 99% of the work force only needs email, office apps, and web browsing capabilities. If you're not in a real company, and just support fly by night clients, well, then you're in what most of us would define as the 9th circle.

Re:Java used to be secure and sandboxed

[drkstr1]

It's just a widely deployed target (much like Flash, PDF, and Windows), which means the baddies get a better ROI on their efforts. It's nearly impossible to fully lock down a platform like that while still providing functionality above and beyond HTML/JS. Even less so because it's a valuable target with lots of attention.

Re:Java used to be secure and sandboxed

[bbn]

Yes just google "java buffer overflow". There are tons of them. Here is an example: http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3AJava%2FCVE-2009-3869.M

The applet exploits a buffer overflow which existed in processing malformed images or audio files and affects Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17. The applet exports Java class "vmain" with several member functions named "HB", "HexDecode", "mspray" and "paint". The member function "mspray" crafts an image in memory which is than passed to the "paint" function.

The "paint" function then calls "drawImage" from the standard AWT Java library causing a buffer overflow and potentially executing code from the memory allocated by the "mspray" function.

Re:Java used to be secure and sandboxed

[Anonymous Coward]

No, no, no and no.

That is a terrible logical fallacy and everytime it comes up it gets to +5 insightful. This is simply just as broken as the "broken windows" fallacy (nothing to do with Microsoft Windows btw). And for whatever reason, even smart people fall for it.

The fallacy you're falling for is basically the "shades of gray" fallacy. Instead of having two choices (black or white) you argue that it's all gray. But hence you're restricting the issue to something even more simplistic than before: now instead of two colors, there's only one (gray, no matter the shade).

So instead of saying that there are technologies inherently more secure than others (for example OpenBSD hasn't been "rooted" nearly as many times as Windows XP), you're saying: "But OpenBSD had *two* remote-root bugs already found in 12 years and there are probably others, but we haven't found them yet. So it is impossible to create something secure".

And by doing you're implying that OpenBSD or Windows XP: it doesn't matter, it's all gray. Because nothing is truly secure.

And it's very sad. And it's a terrible fallacy to fall for.

Re:Java used to be secure and sandboxed

[aled]

Sorry, I can't help it. I just had to answer it.

The same way that I must say this: you have a four-digit id! awesome! :-)

Re:Java used to be secure and sandboxed

[aled]

Parent of who?
And what is flawed by design? if you mean Java then we could possibly apply the same analysis to almost every technology on the Internet.

Re:Java used to be secure and sandboxed

[drinkypoo]

Java is interesting because it's widely deployed in corporations. A home user may not even need it any more, but a business user often has multiple JREs installed because of some crufty applications that only run with a particular JRE (write once!) and as such is highly likely to be exploitable.

Re:Java used to be secure and sandboxed

[RaceProUK]

You do realize that many casual games are Flash, right?

FTFY

Re:Java used to be secure and sandboxed

[dshk]

Most casual games are Flash, however, many are Java, and Java is even stronger if we consider not only the count of games but the time played on a single game.

Re:Java used to be secure and sandboxed

[datavirtue]

I don't agree that Java has many exploits--I think we cant count the serious ones on two hands in almost twenty years. I do agree that Java 6/7 has been a real cluster compared with the stability of the JRE during Sun's time.

I blame the browsers. They control the environment and are more than capable of sandboxing applets and restricting access for certain APIs until the user has authorized them.

Re:Java used to be secure and sandboxed

[datavirtue]

Maybe his website uses an Excel spreadsheet for the user and content database. That would be cool. Then you could pass requests to a servlet that would access an application server running an RMI application that uses JNI to access COM on a live version of an Excel spreadsheet running on a desktop somewhere in the enterprise so the president's secretary's secretary can easily update customer data for the website! Thanks /.

Re:Java used to be secure and sandboxed

[datavirtue]

Yeah, try running Minecraft without Java. You do realize that almost every family with kids is running Minecraft right.

Re:Java used to be secure and sandboxed

[datavirtue]

agreed, the updater is a pain in the ass.

Re:Java used to be secure and sandboxed

[datavirtue]

AND people authorize everything that asks them for permission, so....

Re:Java used to be secure and sandboxed

[datavirtue]

class bullshit?? What the hell? Objects are much easier to understand than dangling data structures floating about in a monolithic namespace. It certainly is overkill for a rinky-dink program, but large applications that solve major problems realistically need to be object oriented.

Re:Java used to be secure and sandboxed

[aled]

I have seen things like that in real life. Perhaps not all in the same app but near enough. I really hate to use applets in that way.

Re:Java used to be secure and sandboxed

[fluffy99]

Must be pretty big hands to count that high. 26 earned CVE designations since 2006, and those are just the ones that made it into the public light.
http://www.cvedetails.com/vulnerability-list/vendor_id-5/product_id-1526/cvssscoremin-6/cvssscoremax-6.99/SUN-JRE.html

Re:Java used to be secure and sandboxed

[rve]

you have a four-digit id! awesome! :-)

It just means I'm old, which isn't all that awesome. Now get off my lawn.

Re:Java used to be secure and sandboxed

[Wolfrider]

--Seriously, they should hire some OpenBSD developers to take a crack at the Java code. Once they pick themselves up off the floor from laughing / shock at the current state of it, they should be able to put a serious dent in the vulnerabilities.

Re:So long/The way the future was

[tripleevenfall]

This might seriously impede the Year of Java on the Desktop

Two years?

[schneidafunk]

It looks like he randomly pulled a time frame. I cannot find an explanation for the two year estimate.

Re:Two years?

[Anonymous Coward]

It looks like he randomly pulled a time frame. I cannot find an explanation for the two year estimate.

Ah, but that's the beauty of it! Owing to the blind hatred of Java around these parts, he can pull any alarmist timeframe out of his ass at any time, and we're certainly not going to argue with him!!! If anyone does, we can accuse them of liking Java, and then we excommunicate them and shame them in the entire software engineering world until they can't ever get a job again as a warning to others! It's brilliant!

Re:Two years?

[Zocalo]

Possibly, but it could also have something to do with Oracle's announcement that Java will be getting regular updates on a two year schedule. Maybe he's just assuming it's going to take a major iteration - from the v8.x series due in September to the next release, v9.x to completely fix this class of flaws.

Re:Two years?

[Enry]

Pretty poor assumption.

Re:Two years?

[OverlordQ]

I cannot find an explanation for the two year estimate.

Hey, Java is going to be vulnerable for a couple years so that means you should hire us to help protect you.

Re:Two years?

[mcgrew]

Owing to the blind hatred of Java around these parts

The hatred is by no means blind. And it isn't hatred so much as simple disgust.

Re:Two years?

[LordLimecat]

and we're certainly not going to argue with him

Why would we? Given that Java has been a security nightmare for 5+ years, 2 years to "secure" it (ie, doesnt have a critical exploit every 2 months) doesnt seem far fetched. If anything its conservative.

Seriously, anyone want to take bets on whether in 2 years browsers will still treat java plugin as an unusual security case? (firefox / chrome auto-disable java unless its the most current version due to its massive problems).

Re:Two years?

[marcosdumay]

Java 6 has an entirely different set of exploits.

Re:Two years?

[sjames]

Not if he has reason to believe the flaws are structural or design in origin rather than being shallow implementation errors. I don't know if he has reason to believe that or not, I haven't done the analysis.

Re:Two years?

[tqk]

Put away the hard-on for Larry Ellison and calm down.

What's Ellison got to do with this? Perhaps you mean Gosling?

Browser Plugins are Always Vulnerable

[Anonymous Coward]

The solution is to stop running untrusted code in your browser. If you are using a browser's default configuration, then any time you go to a website, the browser will automatically download and execute software from the website, in the form of Flash, Java applets, javascript, and Silverlight, if you have it installed.

And you think there aren't any vulnerabilities in any of those sandboxes?

Re:Browser Plugins are Always Vulnerable

[Wrath0fb0b]

But there are also well-documented CSS vulnerabilities, XUL exploits and even one in a JPG parser.

Should we disable those as well? Are you part of some guerrilla marketing campaign to bring back Lynx?

Re:Browser Plugins are Always Vulnerable

[LordLimecat]

Living is a risk. You have to quantify and try to mitigate the bigger risks.

Java qualifies as a "bigger risk", and you mitigate it by uninstalling JRE.

Re:Browser Plugins are Always Vulnerable

[Anonymous Coward]

Personally I'd vote for bringing back gopher! And if that means we "lose" that blinged out "web-2.0" crap, it's not a day too soon.

Re:Browser Plugins are Always Vulnerable

[amicusNYCL]

Good idea. Don't use Opera because version 9.02 had an exploit that was fixed in version 9.10, while the current version is 12.12.

Re:Browser Plugins are Always Vulnerable

[dkf]

Java qualifies as a "bigger risk", and you mitigate it by uninstalling JRE.

You mitigate by disabling Java in the browser. You also want to do that for performance reasons; the Java plugin is resource hungry by comparison with most other plugins (let alone with running Javascript code). I've been keeping it switched off for ages, and the logic behind that wasn't security even though that was one of the nice outcomes. Uninstalling the JRE is a much more extensive change, in that it tends to result in the inability to run any Java program, including many that are totally unrelated to web security. The best response is always the proportionate one.

Of course, with this much hyperbole you're well suited to be a security commentator. Throwing babies out with bathwater a speciality! Next up, why you should disable HTTPS because of the compromise of one CA...

Re:Browser Plugins are Always Vulnerable

[steelfood]

It's not merely that Java represents a bigger risk. The reward is fairly insignificant as well.

If you disabled Flash, you'd have trouble with all sorts of sites, especially those that play video. If you disabled Java, you'd have trouble doing, well, nothing, because no respectable site has applets running straight off their pages anymore.

Re:Browser Plugins are Always Vulnerable

[LordLimecat]

I throw the baby out with the bathwater because in my 5+ years as a consultant, Java has been necessary on maybe 5% of the machines it was on, and was probably responsible for a third of the viruses I dealt with. Rather than dealing with java autoupdate (which annoys the heck out of users when UAC is enabled since they cant actually complete the update theyre bugged to do) and ask toolbar and re-enabled plugins, yes, i get rid of the darn thing. If they need Java, they will let me know.

Re:Browser Plugins are Always Vulnerable

[Lawrence_Bird]

Only if we get Archie and Veronica back too.

Applies to all outside software

[Todd Knarr]

The safest thing to do at this point is just assume that Java is always going to be vulnerable.

That's not specific to Java, it applies to all software that's downloaded from an outside source and run on your local machine. That means Adobe Reader (PDF is simply a wrapper for a program written in Postscript), Flash (ditto, written in a special programming language) and even Javascript. It even includes downloaded TrueType fonts (the font hinting program they can include is just that, an executable program). Don't dismiss them just because they're sandboxed. Java was sandboxed, that didn't stop this vulnerability. Sandboxes are software and software has bugs in it, always. The only question is the number and severity of the bugs. The simpler the software, the fewer bugs there tend to be because there's fewer places for them to hide. Their favorite hiding place is in unexpected interactions between different parts of a piece of software, or between the software and the system it runs in, and simpler software has fewer and simpler interactions that're easier to get right.

This even applies to software you buy from a vendor. The difference is that with bought software you tend to download it only a few times and always directly from the source. Contrast this with the Web, where you're downloading multiple pieces of software on virtually every Web page you hit with no idea where they're coming from (and, in the case of advertising networks, the place you download them from may not even know who or where they're coming from).

Re:Applies to all outside software

[TheGratefulNet]

in short, 'mobile code' (stuff that runs and is sent across from them to you, to be run on YOUR platform) is untrustable by nature.

I never liked the idea of it, not once. I think its all a security fail.

'here, here's some binary code. run this. no, don't ask questions, just execute this, please'.

why people thought that was a good idea is beyond me.

Re:Applies to all outside software

[Hatta]

Sandboxes are software and software has bugs in it, always.

So how does this bode for the cloud? OSs and hypervisors are conceptually similar at least to an OS and a sandboxed app. What prevents a hypervisor from being attacked in the same way that Java's sandbox was?

Re:Applies to all outside software

[PenquinCoder]

Java != Javascript

Re:Applies to all outside software

[Karlt1]

"Trying to use 'todays' internet with Java disabled is not a viable option. A realistic estimate is that over 70% of all common websites require Java to function correctly.

It is unfortunate that so many web developers use Java in places where it just isn't required. While I agree that Java Script does provide needed functionality in some situations, that is not the case in many (most) applications."

Really? This day and age someone not knowing the difference between Java and Javascript?

70% of pages do not use Java. Javascript yes but they are completely different.

Re:Applies to all outside software

[hobarrera]

Trying to use 'todays' internet with Java disabled is not a viable option. A realistic estimate is that over 70% of all common websites require Java to function correctly.

It is unfortunate that so many web developers use Java in places where it just isn't required. While I agree that Java Script does provide needed functionality in some situations, that is not the case in many (most) applications.

If this latest SNAFU gets developers to rethink using Java (or any similar tool), it may actually be a benefit to the web.

I haven't come across any website that uses Java in about three years (and even that one, was a very specialized website).

Name ONE popular website that requires Java.

Re:Applies to all outside software

[Lennie]

70% of pages do not use Java ? Make that 99.9999999999999% or something like that.

Re:Applies to all outside software

[Karlt1]

"70% of pages do not use Java ? Make that 99.9999999999999% or something like that."

I agree, I was refuting the original claim that "70% of web pages use Java"

Re:Applies to all outside software

[Todd Knarr]

Absolutely nothing. In fact, I think they've already found ways to break out of most of the hypervisors out there and gain access to the host machine from inside a VM. The only exceptions I can think of are the IBM mainframe hypervisors, and those have the dual advantages of a) decades of work finding and removing bugs and b) hardware that was designed to run the hypervisor and has special support for isolating the hypervisor from the virtual machines.

Bear in mind that for cloud applications you actually need to be worried about the reverse: protecting your application from the hypervisor breaking into it. The worst incursions won't be from other applications breaking out of their VMs, it'll be incursions from the cloud provider's own internal network (from conventionally-infected machines) infiltrating the host machines' hypervisor software and from there reaching down to infect hosted applications.

Re:Applies to all outside software

[gabereiser]

But I still have my Clock Applet from 1993 running on my site counting down to the return of Jesus....

Re:Applies to all outside software

[bcrowell]

PDF is simply a wrapper for a program written in Postscript

Not true. Postscript is a Turing-complete language. PDF is basically a redesign of postscript that, among other changes, makes it into a Turing-incomplete language. This makes PDF inherently more secure than Postscript.

The security flaws that keep popping up in Adobe Reader are not holes in PDF itself, they're holes in other features that were added on later, such as the ability of recent versions of PDF to embed javascript. By default, AR will execute javascript that's embedded in pdf files. This is both a privacy (people can track readers) and a security issue (more than one stack overflow bug has been discovered that's related to js). To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

Better yet, simply don't use AR as your PDF plugin in your browser. On linux, Evince is pretty good.

The situation with PDF is actually closely analogous to the one with java applets. Both technologies were designed with security in mind, and are inherently possible to implement straightforwardly in a secure way. Both are open specs that are freely implementable without paying patent royalties. In both cases, the evolution of the spec is currently being guided by an evil corporation that doesn't care about security. The main difference is that in the case of PDF, the relevant read/write functionality exists in multiple completely independent implementations, whereas for java, there is no full reimplementation by anyone besides sun/oracle, only implementations that use almost all of oracle's code and replace portions that weren't freely available.

Re:Applies to all outside software

[AaronLawrence]

For the same reason, I'm nervous about all the new features being added to browsers such as WebRTC, video, and 3D support. All of those can and will have bugs and greatly increase the attack area. It seems tedious to have to repeat the cycle of "add awesome new feature, wait for exploits, exploits get serious, disable feature" for every brilliant new idea.

Re:Applies to all outside software

[pionzypher]

Probably by reading it? Anyone reading a CERT post is very likely to understand the difference between the two.

Re:Applies to all outside software

[Shikaku]

http://pingtest.net/

Tests for packet loss, requires java for that feature.

Re:Applies to all outside software

[sjames]

Not having a sandbox presents the same problem in less convenient form "here, download and install this, no questions please". Or you can download your code in the form of javascript.

Assuming you'll have none of that, you can download your code in the form of HTML. Yes, it's considered data but it tells the rendering engine what to do and it does it, so technically it's code even if it's highly limited and nowhere near Turing complete.

It all comes down to design and implementation. Some sandboxes are designed in a way that facilitates good isolation, some are terrible and practically demand huge holes (I'm looking at you ActiveX). Some are well implemented and some not. Complexity of the system will have an influence on the likelihood that it is implemented well.

Re:Applies to all outside software

[RocketRabbit]

Just so you know, PDF is not merely a wrapper for PostScript. It's essentially similar to an object file produced by a PostScript interpreter. Like, but not exactly, a compiled PS program.

Re:Applies to all outside software

[sjames]

The sad thing is that timesheets and travel reimbursement are simple tasks (computationally speaking) that could easily be accomplished in HTML with just a bit of javaSCRIPT thrown in.

Re:Applies to all outside software

[Trogre]

70% of pages do not use Java. Javascript yes but they are completely different.

Wait, so 30% of web pages do use Java? As in, more than a quarter?

Are you sure about that?

Re:Applies to all outside software

[tqk]

Probably by reading it? Anyone reading a CERT post is very likely to understand the difference between the two.

You jest! I defy you to point to one member of your immediate family, or even close personal friends, who've actually read a CERT Advisory. Mortals have no idea what that acronym means (nor do they care).

Re:Applies to all outside software

[tqk]

http://pingtest.net/

Okay, that's the stupidest thing I've ever seen. Apologies to all others I've said that to (yes, there's been more than a few).

ping. Huh.

Re:Applies to all outside software

[tqk]

Always assume you're vulnerable because there is somebody smarter, sneakier and greedier out there.

Words to live by.

Re:Applies to all outside software

[phorm]

such as the ability of recent versions of PDF to embed javascript

And this is totally part of the problem. Unnecessary feature-creep. Originally, PDF was a secure way of sending read-only documents to other. Then they started adding stupid stuff like this, and - blammo - vulnerabilities.

Companies seem to think they *need* to add all this extra crap in order to continue the viability of a product, but in the end you just make the product a bloated mess full of vulnerabilities.

Re:Applies to all outside software

[Lennie]

Just put a date on your site to show when you think he'll arrive. Or make a small Javascript.

So?

[Hatta]

Running programs from untrusted sources has always been unadvisable. I run java every day, and I'm not worried at all about getting compromised. Apps like ImageJ or UGENE, if they weren't written in Java would be written in a native language which would be just as dangerous to install. So don't be an idiot and run programs from random websites and you'll be fine.

Re:So?

[Anonymous Coward]

And if their security was compromised, would you trust them to notice? Would you trust them to tell you? Would you trust them to tell you on time?

It's important to know, because with software as vulnerable as that, it's not a matter of if, but when.

Re:So?

[Hatta]

I would trust them about as much as anyone can trust any third party software. My point is that the software is written in java is as irrelevant as if it were written in C++.

Re:So?

[Billly Gates]

That is an outdated security fallacy before ads had flash and java in them. Ad networks get targetted A TON so even a legit website can be targetted. I have been reading about this on tech forums and someone got hit for checking a popular home rennovation website.

A java webstart mini icon popped up and before he could even stop webstart a fake AV popped up demanding money. Slashdot got hit last year too with a malware ad. If you had Firefox 3l.6 without AV on Windows you were 0wned.

Java needs to be downgraded to Java 6 and then disabled in the plugins to remain safe. I say downgrade, because Oracle's java 7 will renable the plugins again after each update. Java 6 doesn't do this and is more compatible with older software.

Re:So?

[Hatta]

That is an outdated security fallacy before ads had flash and java in them.

Why are you running java in ads? Don't do that, and the problem goes away. You wouldn't run .exe files from an ad would you?

Re:So?

[Billly Gates]

Webpages automatically run them. I heard Mozilla has a fix where you need to click on them but I wouldn't know as I have it disabled as a plugin. I have not seen any non office page have them in almost 10 years. Not worth the risk.

Java on the web failed misserably and SUN let it rot after dabbling in it in the 1990s. If Java FX came out 13 years ago where it could look all pretty and utilize native fonts and graphics and not spend a full minute compiling itself perhaps it could have beaten flash. But anyway it will live on in servers.

Re:So?

[Hatta]

That's what NoScript is for. Doesn't just stop Java, but javascript, flash, etc.

Re:So?

[adam.voss]

Well put. I had to post because I accidentally pressed the wrong moderation entry and near as I could find, there is no other way to remove the moderation.

Re:So?

[Hatta]

No thank you. I felt it was more annoying than UAC iwth Vista as it get blocking everything on every site which drove me mad! Just my preference but I can not browse the web like that.

Most sites work fine without javascript. 90% of the sites that don't work with just one or two scripts enabled. And most people visit the same sites over and over, so it's only a short time that whitelisting is any sort of burden to the user.

For those sites that are too complex to get working with NoScript, I say fuck em. There's no legitimate reason to require a dozen scripts from a dozen domains to view a web page. None whatsoever. Those sites should rightfully wither and die from attrition.

Besides noscript does not have an equilivent functional port to Chrome.

Which is an excellent reason not to use chrome. NoScript is a make or break feature for any browser as far as I'm concerned. If you can't give me fine grained control over the scripts I'm running, I won't run your browser. Period.

Fact free claims

[Anonymous Coward]

HD Moore, chief security officer with Rapid7, a company that helps businesses identify critical security vulnerabilities in their networks, said it could take two years for Oracle to fix all the security bugs that have currently been identified in the version of Java that is used for surfing the Web.

How is Mr. Moore computing this interval? Nothing is offered in these stories about why it would take Oracle "two years" to "fix" the "security bugs".

Re:Fact free claims

[HaZardman27]

Microsoft told him that in a message that included a "Welcome to C#!" brochure.

So a rewrite?

[waddgodd]

It didn't take two years to write JDK in the first place...

Re:So a rewrite?

[Anonymous Coward]

And this time we promise it'll work.

Re:So a rewrite?

[Zero__Kelvin]

This has nothing to do with JDK (Java Development Kit.) It is the JRE (Java Runtime Environment, including the JVM (Java Virtual Machine)) as implemented by Oracle. That being said, the JDK has been around for at least a decade. If anyone knows how long it took to write, it's not the guy confusing it with the JRE. Of that much I am certain. See also ...

Re:So a rewrite?

[H0p313ss]

the JDK has been around for at least a decade

You're trying to slam someone else for their dubious selection of jargon but the best you could do is "at least a decade"? (For nostalgia purposes I keep the original edition of "Java in a Nutshell" on my desk, copyright 1996, and yes, JDK is in the index.)

Re:So a rewrite?

[timeOday]

Writing a JRE is like writing an OS. You can write a toy one in a few months (Minux) or spend lifetimes writing one good enough to be competitive in the real world (Linux).

Re:So a rewrite?

[Zero__Kelvin]

So you are saying that I was correct, but because I didn't indicate the exact moment of its inception (which I would only know if I was James Gosling anyway) that I was in error somehow? I wasn't "slamming" anyone. I'm tempted to do so now though, but you aren't worth the effort. HANL and hope to never hear from you again ...

Re:So a rewrite?

[H0p313ss]

And for what it's worth, the JDK includes the JRE and JVM, so yes, if the original JDK took a year (it didn't Oak was under development for three years and it took two more for Java 1.0 to ship.) a complete rewrite, including the JVM should be less than two.

The problem with that statement is not that he said JDK, it's that his understanding of the time frame and effort to produce the original JDK is completely wrong and furthermore the current JVM looks almost nothing like the original from 1995. A complete white room rewrite with similar performance characteristics to the 1.7 VM with enhanced security would be significantly more expensive than the original implementation. (I'm pretty sure that more effort has gone into garbage collection algorithms alone since 1996 than went into the original JDK.)

Re:So long/The way the future was

[Anonymous Coward]

Sure, Java will be dead in 5 years.. just like COBOL.

Applies to all

[kimvette]

This also applies to every desktop OS - ESPECIALLY Windows. How many years has Microsoft been attempting to secure Windows? Obviously if you care about national security, you will unplug your PC today.

Re:WTF is the deal with Java and being so insecure

[Anonymous Coward]

The idea is that you are at the same time providing a full language and a sandbox. Together. Java is not inherently more or less secure than any other language (well, mostly), but the above premise is extremely hard to pull off correctly. Think of an applet as some piece of code you download and execute. Would you trust doing that in any special language? Think of Flash, how many flash issues have we seen? And Flash is "less complex" than Java.

OpenJDK

[Anonymous Coward]

Are those security flaws also affecting OpenJDK 6 and/or 7?

Re:OpenJDK

[Beamboom]

Bump for this - anyone know? Cause OpenJDK w/Icedtea plugin has really become very good - I myself use OpenJDK instead of Oracles JDK on all my machines nowadays, both in development and as end user.

Second 'Law of Moore'

[futhermocker]

"Over theÂhistory of programming, the number of exploits in softwareÂdoubles approximately every two years."

Much hyperbole about nothing

[Zero__Kelvin]

That's not specific to Sun/Oracle's JVM Implementation, but goes for all software, at all times.

"it could take two years for Oracle to fix all the security flaws in the version of Java used to surf the web" ... "The safest thing to do at this point is just assume that Java is always going to be vulnerable,""

This guy isn't a security expert. He doesn't even know that Java is a programming language, and that Oracle's JVM is not "a version of Java used to surf the web". No self respecting expert would misuse terms the way he is, and he should be sued for doing it. It leads to ridiculous situations, where people think Java is inherently bad. I mean, isn't Android based on Java? OMFG ... don't get one of those! Haven't you heard. Java is vulnerable to attack! If the writer got what this guy said correct then his guy is either shilling for Apple or Microsoft against Google/Android, hates Oracle, or is phenomenally incompetent.

Re:Much hyperbole about nothing

[amicusNYCL]

You think the chief security officer of Rapid7 doesn't understand the nature of Java, huh? It's not that he's trying to use language that most people would understand, but that he actually does not know that Java is a programming language and what the JVM actually is. That's some stunning logic you've got there. He sounds like he probably knows his stuff.

Re:Much hyperbole about nothing

[Zero__Kelvin]

I certainly left open the possibility that he is intentionally misleading people. You'd find people's logic less stunning if you learned to read and understand what you read. That being said, I didn't know who he was, or I would have went straight to the latter part of my post and skipped the possibly incompetent part.

Re:Much hyperbole about nothing

[PCM2]

This guy isn't a security expert. He doesn't even know that Java is a programming language, and that Oracle's JVM is not "a version of Java used to surf the web".

You're assuming quite a lot there. I didn't see any sentence in there that said "Oracle's JVM is the version of Java used to surf the web." But most of the exploits we're talking about certainly do involve the version of Java used to surf the web -- the Java plugin. People who are just running desktop Java apps aren't vulnerable. These are browser exploits, or exploits that attack the interface between the plugin and the browser. If a Reuters reporter wants to simplify the language so that regular people can understand it, where's the harm?

Re:Much hyperbole about nothing

[Zero__Kelvin]

"But most of the exploits we're talking about certainly do involve the version of Java used to surf the web"

It's not a version of Java! Java is a fscking programming language. It is no more correct to say Java is vulnerable than is is to say C is vulnerable or COBOL is vulnerable. Also ...

" If a Reuters reporter wants to simplify the language so that regular people can understand it, where's the harm?"

Oh ... Oh ... I remember this one from elementary school English class! It would be because he used quotation marks!

Re:Much hyperbole about nothing

[Zero__Kelvin]

Android is absolutely based on Java. The Dalvik Java Virtual Machine is not a "deivative" of a programming language (Java).

" Android, Linux, Java and Dalvik are all open-source projects, but that's about the only thing they have in common."

The Android OS uses Linux as its kernel, so I'd say they have something in common. Once again, Java is a programming language, which Android uses, and in fact the whole user space is, as I already stated, based on it, so I'd say they have something in common there. Finally, Dalvik is a Java Virtual machine, so it seems they have a little something in common as well. It seems you are batting 0.

Re:Much hyperbole about nothing

[Zero__Kelvin]

Technically you are correct, and I shouldn't have used JVM to describe Dalvik, since technically it is a VM that doesn't execute Java Bytecodes, but rather Dalvik bytecodes. The reason for this is not efficiency, however, but licensing issues. However (and I have been writing Android apps recently) you write Android applications in the Java programming language, and the de-facto standard IDE is the Java version of Eclipse with the Android Development Tools plugin. This merely drives home my point, which is that saying that Java is vulnerable is plain wrong. Even saying that all Java Virtual Machines are vulnerable is wrong. The vulnerability is in one specific company's implementation of the Runtime Environment (albeit in multiple released versions) and it is wholly incorrect, and tantamount to incompetence, to claim that Java is vulnerable while also calling oneself a "security expert". I'm not saying the guy is incompetent on the whole, merely that the statement is indicative of incompetence. (Yes, this is a bit of back-pedaling as I gained more information on him as a result of this thread.)

Re:Much hyperbole about nothing

[lgw]

This guy isn't a security expert. He doesn't even know that Java is a programming language, and that Oracle's JVM is not "a version of Java used to surf the web".

This guy sounds right on the mark to me. He's not saying "there are security flaws in Java (the programming language)". He said specifically "the security flaws in the version of Java used to surf the web", which is a far narrower claim.

By "version of Java" he doesn't mean Java 6 or Java 7 - this is a non-technical piece. He means Java applets downloaded by your browser and run locally on your machine. Those are indeed in a bad way, security wise - the existing sandboxing has proven inadequate to the attacks, and there's no easy fix. But none of those attacks matter for "local Java" with no browser plug-in - it's the browser plug-in for Java, when used to surf the web, that's in deep trouble right now.

And that warning should be taken seriously. Disable your browser plug-in, and start making plans around any software that requires it.

Re:Much hyperbole about nothing

[blackraven14250]

Would you rather he say "the Oracle JRE package", or "Oracle JVM browser plugin", to satisfy your pedantic impulses while confusing the layman that the article is actually intended for?

Re:Much hyperbole about nothing

[Zero__Kelvin]

"He said specifically "the security flaws in the version of Java used to surf the web", which is a far narrower claim."

It is a completely ludicrous claim, since there is no such thing as a version of Java that is used to surf the web.

" He means Java applets downloaded by your browser and run locally on your machine"

No. He means that a particular JRE is vulnerable. Saying "Java is vulnerable" is like saying that I can claim drinking water is dangerous when I discover that a particular cup of water happens to be poisoned. After all, I meant something completely different than what I said! Actually it is worse than that, since he gets it completely wrong by calling the Oracle JRE "Java".

"And that warning should be taken seriously. Disable your browser plug-in, and start making plans around any software that requires it."

That is frigging horrible advice, even were it not for the fact that I don't use Oracle's JRE. You see, I use a non-Oracle JRE. That is the point that you just don't seem to get.

"it's the browser plug-in for Java, when used to surf the web, that's in deep trouble right now."

Wrong. It is a Java Runtime Environment plugin - specifically Oracle's. Also, you are being exceedingly hypocritical unless you shit-canned Windows years ago. If you didn't stop using Windows despite the many, many, many more in the wild vulnerabilities, why would you suddenly eschew the Oracle JRE. You are completely ignoring basic computer security. I'm not saying that it is a good idea to allow random websites to execute Java, but tossing it out completely is throwing the baby out with the bathwater. The latest Oracle JRE already implement a Windows-esque UAW mechanism, so there is no need to uninstall it. Just upgrade to the latest, and as always, don't let untrusted code run on your machine. If you have been doing things correctly, then nothing has changed, since that is already the accepted paradigm by those who know what they are doing.

Re:Much hyperbole about nothing

[Bill_the_Engineer]

Sounds like he is about to try to sell us something by fear mongering and selling snake oil.

Re:Much hyperbole about nothing

[Zero__Kelvin]

First of all, it was printed in a tech magazine (Infoworld,IIRC) and yes, I'd rather he be correct than misinform people. I'm funny like that.

Re:Much hyperbole about nothing

[amicusNYCL]

That being said, I didn't know who he was,

I guess I can understand that, it's not like his name and title were right next to his quote.

Re:Much hyperbole about nothing

[amicusNYCL]

It's not a version of Java! Java is a fscking programming language.

It's also a platform, which does have individual versions and components.

Re:Much hyperbole about nothing

[Zero__Kelvin]

"I guess I can understand that, it's not like his name and title were right next to his quote."

I Ididn't say I didn't know what his name was, or what his title was, which is completely different. I guess I can understand. They probably don't teach New York lawyers what the phrase "knew who he was" means, or how to use punctuation properly.

Re:Much hyperbole about nothing

[Zero__Kelvin]

One doesn't say "I wrote a program in Java" meaning they wrote it in a platform. The Java Platform is a platform. Java is a language. Stick to law. It is at least possible that you are good at that, though your grasp of the English language as evidenced in the last two replies you have made to my posts makes that assertion highly suspect.

Re:Much hyperbole about nothing

[lgw]

Yes, yes, you and the 4 other guys who use their own JRE are fine. Congrats. But for the entire intended audience of that warning, he was right. Also, you need to unclench a bit over the word "version" - it's also a plain English word, you know?

Re:Much hyperbole about nothing

[Zero__Kelvin]

It was in Networkworld, so you either don't know what the term layman means, or it has escaped you that it is not aimed at the layman. To hear you tell it it was printed in Better Homes and Gardens. Furthermore, the word version has a very specific meaning in this context.

Re:Much hyperbole about nothing

[amicusNYCL]

I commend your grasp of the English language. When someone makes a claim saying that "Java is vulnerable", or that "Java contains a vulnerability", or that "people are exploiting security holes in Java", are you able to use your highly-tuned knowledge of English to infer from the context that they are referring to Java the language, or Java the platform? When someone describes "the version of Java that runs in a browser", are you correctly able to deduce that they are referring to a version or component of the platform, as opposed to the actual language? Apparently no, you're not.

Don't worry though, not all of us have a perfect grasp of what everyone else means all the time. For example, I'm not a lawyer and don't work in any law-related field, nor do I want to. I'm also working under the assumption, however incorrect it may be, that your body actually does radiate some amount of heat apart from what comes out of your mouth in a metaphorical sense.

Re:Much hyperbole about nothing

[Zero__Kelvin]

" When someone describes "the version of Java that runs in a browser", are you correctly able to deduce that they are referring to a version or component of the platform, as opposed to the actual language? Apparently no, you're not."

Do you know enough about what you are talking about to realize that the phrase "The version of Java that runs in a browser" is ambiguous? Do you understand information theory enough to understand that it therefore does not communicate to the reader any useful information? Apparently, no. You are not.

"Don't worry though, not all of us have a perfect grasp of what everyone else means all the time."

That is precious, coming immediately after your attempt to argue that there is no need to accurately describe the vulnerability, since everyone should "just know what he means."

" For example, I'm not a lawyer and don't work in any law-related field, nor do I want to."

Another precious bit there. Apparently you already forget chastising me by claiming that if I knew someones name I should "know who he is." ROTFLMAO. You really should consider becoming a lawyer if you really aren't already. You are clearly willing to obfuscate the facts, and good enough at it to fool the common man, as well as being stupid enough to be one. You really should find some new people to hang out with, as being around the people you know now has given you a false sense of your level of intelligence.

Applets?

[Twillerror]

Why exactly do we need applets on joe smoe's machine? If your a corporation enable it.

It would be great if all browser had a whitelist of domains that you tag a site for any of this stuff. Yes youtube can play flash, other sites not. Advertisers will just use animated gif\javascript or whatever.

Sure there is this plugin and that to accomplish this...time for FF, Chrome, and IE to build this stuff in and make it off by default and super simple to address. Of course you've got grandma on IE 6/7/8, but even then MS could put out a patch that just turns off applets. The next time IE starts up it ask the user. Group policy would override.

Re:Applets?

[ElmoGonzo]

Java applets were a good idea in 1996 or so when the web was mostly text documents and static images. Now there isn't very much that an applet does that can't be done with equal facility and somewhat greater security by making a web application using any one of a number of technologies. (Admittedly deploying an application server has its own set of security issues but for the most part, they are limited to the server side of the street.) I can't think of anywhere I've encountered Java applets in the past few years -- the ones I recall have all been replaced with Javascript for server-side calcuations.

Re:Applets?

[hobarrera]

Flashblock?

Re:Applets?

[gl4ss]

both firefox and chrome ask per site if you want to run java.

by the way.. just today I had to fix my java plugins to work, to authenticate via my bank to a 3rd party(the bank uses a java applet for security code input.. there's no real logic why though). the shit wouldn't work in either firefox or chrome before I ran it in IE. such bullshit.

Why isn't there a whitelist-only mode?

[Anonymous Coward]

I find it strange that I can install a flash blocker that allows me to whitelist certain websites but that similar functionality seems to be missing for Java... the easy answer is to not allow java to run unless the site or even specific URL is in a whitelist.

The java engine should check whether the code it is about to execute is from a whitelisted location before it executes it. If the code is not, it should warn the user, perhaps prompting to add the site.

That way your banking and ecommerce sites would still work easily while the "bad guys" would at least have to successfully social-engineer you into adding their site, a situation much better than what we currently see where all you have to do is inadvertently browse to a web page with compromized java applets embedded.

Re:Why isn't there a whitelist-only mode?

[David_Hart]

If you are using Firefox, Chrome, or Safari, you can install NoScript. I find that it works well. It takes some effort to figure out which scripts you need to run for each page to display properly and which are the advertisement scripts. But it does the job. So far, I have found only one site that doesn't work with NoScript, but it's not a common site.

If you are not using If you are using Firefox, Chrome, or Safari, then it may be time to switch. I, personally, have always preferred IE. However, I made the switch to Firefox a couple of years ago and haven't turned back since. The security plugins for FireFox are much better than for IE and most are free (open source).

Re:Why isn't there a whitelist-only mode?

[gl4ss]

like chrome & firefox? they both ask per site...

Re:Why isn't there a whitelist-only mode?

[jkrise]

you can install NoScript. I find that it works well.

Does NoScript protect from sites that use Javascript? Or sites that use Java?

If a tool protects from java applets, ideally it should be named Java-Block or NoJava. The tools that blocks Flash is called FlashBlock.

So please clarify: Does NoScript help against java applets at all? Or only Javascript?

Re:Why isn't there a whitelist-only mode?

[bcrowell]

There are unfortunately lots of problems with noscript.

Noscript is incompatible with flashblock.

Noscript's codebase has a reputation for being a mess.

I stopped using noscript in 2009, because of a variety of issues related to their attempts to maximize ad impressions on their site. It does extremely frequent updates, sending you to its home page every time. It is possible to defeat this, about:config, if you set noscript.firstRunRedirection to false. In May 2009, they got in some kind of a war with adblock: http://news.slashdot.org/article.pl?sid=09/05/01/236248&art_pos=1 They were modifying the behavior of adblock, and some of the code of noscript was obfuscated. In general, the behavior of the noscript developers seems irresponsible, sneaky, and deceptive. I don't want to fix a security problem on my machine by installing software written by people who behave ... kind of in the same scummy way as the people I was trying to protect myself from in the first place.

Re:Why isn't there a whitelist-only mode?

[RedWizzard]

I find it strange that I can install a flash blocker that allows me to whitelist certain websites but that similar functionality seems to be missing for Java... the easy answer is to not allow java to run unless the site or even specific URL is in a whitelist.

There is a Firefox feature request to add the ability to block all types of media (Flash, applets, other plugins) by site: bug 94035. It was created in 2001. More than 100 duplicate bugs have been added over the decade since. It's still not been implemented.

Re:Why isn't there a whitelist-only mode?

[bingoUV]

Noscript is incompatible with flashblock.

I have both of these installed. What is the nature of the incompatibility?

Re:Why isn't there a whitelist-only mode?

[bingoUV]

NoScript helps against javascript, java, flash, silverlight, font-face, webGL, audio/video, and more. Oracle Corporation is unable to see the future. Apple Computer Inc. is not a big fruit, nor a fruit flavoured computer. Get over the obsession with names.

Re:Why isn't there a whitelist-only mode?

[bcrowell]

http://noscript.net/faq#qa1_3

http://forums.mozillazine.org/viewtopic.php?p=1586359&highlight=flashblock+noscript#1586359

http://flashblock.mozdev.org/faq.html#fbNojavascript

But anyway I think the real problem with noscript is the untrustworthy behavior of its author.

Re:Why isn't there a whitelist-only mode?

[bingoUV]

When Noscript blocks scripts on the page, it blocks flash too. So the only time when flashblock doesn't work is when it isn't needed. Flashblock and Noscript are only incompatible if the intention is a theoretical one of "running" flashblock. If the intention is a practical one of blocking unwanted flash, I see no incompatibility.

Re:Why isn't there a whitelist-only mode?

[bingoUV]

In fact these two addons compliment each other. Using only Noscript, it is difficult to allow JavaScript but yet block flash from a page. Enter flashblock, problem solved.

As JavaScript is typically more trustworthy than flash, the converse goal of allowing flash but not JavaScript is less practical. And websites want to run some scripts to embed the flash, so it is less technically feasible too.

Re:So long/The way the future was

[thisisfutile]

Like who?

Re:the fix

[Anonymous Coward]

remove java, solved!

Nuke it. From space. Sharks, lasers, etc. Only way to be sure.

Let me get this straight...

[Anonymous Coward]

Some guy has the source code, examined it long enough and carefully enough to come up with an estimate of the time required to fix it... and didn't fix it? Didn't document the problems? Didn't bother to tell us what is wrong and where it is wrong? Sounds fishy. I don't think I believe it.

Re:Let me get this straight...

[mark-t]

You know, that's the funny thing I've always found about trying to do accurate software estimates. Because programming is so predominantly a thinking-heavy activity, the time that you're spending trying to figure out how long something is going to take can almost as easily be spent actually doing it.

I've always found it frustrating to try to explain this to people who want estimates on how complex certain tasks are, when you don't actually have enough data on those tasks yet to know, and by the time you do, you'll have already basically solved whatever problem the task was supposed to solve.

Metasploit is always right

[jaygatsby27]

The guy invented Metasploit. He's not lying.

Could somebody explain....

[mark-t]

... why, exactly, a java application that starts with the security manager turned on should *EVER* somehow need legitimate permission to turn the security manager off?

That, to me, seems so obvious as a basic security measure, it amazes me that software as old as Java would still have such vulnerabilities.

I can see absolutely no reason to start with an unprivileged app that can somehow give itself privilege it did not start with. In reality, such actions should be up to the user to decide *before* they run the app (although that may still be quite vulnerable to social engineering, it would at least remove the technical aspects of the vulnerability).

Re:Could somebody explain....

[sourcerror]

Signed applets can access the hard drive. I don't know how they thought it's a good idea.

It's the browser plugin...

[Anonymous Coward]

Running programs from untrusted sources has always been unadvisable. I run java every day, and I'm not worried at all about getting compromised. Apps like ImageJ or UGENE, if they weren't written in Java would be written in a native language which would be just as dangerous to install. So don't be an idiot and run programs from random websites and you'll be fine.

The problem is, the default Java runtime install includes a browser plugin that allows Java applets embedded in a webpage to run automatically. Code delivered this way is supposed to run inside a strict sandbox, but that sandbox has been repeatedly shown to be full of holes.

(Desktop apps written in Java, including UGENE and ImageJ [and Eclipse, and the mostly-not-Java LibreOffice] do not use the browser plugin and will run fine even if the browser plugin is disabled or deleted completely. Your standard don't-be-an-idiot advice does indeed apply to these kinds of apps. But the JRE you installed to run ImageJ will install the browser plugin you never asked for and don't need.)

Oracle really should consider making the browser plugin a separate, optional, non-default installation.

Re:It's the browser plugin...

[RedDeadThumb]

Java install has been crap for a while, even before Oracle got it. It should have always remained just a ZIP extraction. They also do their best to confuse between JRE and Java with the compiler (which then includes JRE, but it isn't the same JRE directory locations.)

Applets are vulnerable, not Java

[WOOFYGOOFY]

Get real. People running Java based apps on their computers are in no danger of anything. What is being talked about is Applets, where arbitrary code is injected and run in the browser-hosted sandbox. So you surf to some website We-R-Malware and it asks you to let it run their applet (written in Java) in your browser and you say "sure, great idea".

This is like opening an email attachment form the same domain name; don't do that because somehow that PDF file, Excel file, Word document or whatever is harboring some evil code.

But does any of that mean you should remove Excel or PDF readers or Word or Libre Office or anything else from your own machine? Of course not. Java apps are totally safe on your machine and removing Java from your machine makes exactly zero sense.

The only people (mis) representing this situation are people who have an economic stake in "competing " languages and runtimes and language warriors , so that would include M$, consultants who want to be able to bill to rewrite Java apps (for no reason) , authors and evangelists from competing languages etc etc etc . You should all be ashamed of yourselves. C# is a great language , Java is a great language , Perl is a great language , C is a great language, Scala is a great language, Lisp is a great language.. so just GTFU.

Re:Applets are vulnerable, not Java

[Xtifr]

C# is a great language , Java is a great language , Perl is a great language , C is a great language, Scala is a great language, Lisp is a great language.

You're confusing languages and VMs. Java-the-language is perfectly adequate*; Oracle's JVM is a very dubious beast. Of course, you can always get a native compiler (I have one, though I've never used it), if you really love Java, and don't trust the JVM. Though that won't help you with applets.

I agree with the main thrust of your post: the problem is applets and browsers and trust, not languages, but you seemed to be confusing the matter while trying to clarify, so I thought I'd supply a little real clarification.

* After over a quarter-century as a programmer, I have yet to see a language I would describe as "great". Adequate to the task at hand seems to be about as good as it gets, and even that's more rare than it should be! :)

Re:Applets are vulnerable, not Java

[WOOFYGOOFY]

You're interpreting my post too literally. When I say C# is a great language, I am implicitly including the runtime. Ditto for java- I am implicitly including the jvm since in both cases the statements become nonsensical without including the associated VMs they run on .

Also you're interpreting "great" too literally also. Great is of course always relative. They're as good programming languages as any. They're fine They're great. You should use them.

Just by coincidence , today in ARS comes this story which includes an "infallible" backdoor placed on machines via Adobe PDFs and Word documents that's part of a worldwide highly targeted espionage network. Homeland Security is not recommending that Word and PDF Reader be universally removed from all machines and they weren't recommending that for Java either. The advice is always the same- don't open / run shit from people you don't know or entities you don't trust.

People have to keep in mind that programming languages are seen as are prime economic turf that players will fight over for a wide variety of reasons That includes waging proxy wars on slashdot, exaggerating distorting the actual meaning of news events etc etc. The place where yo9u might have seen this happening over the years is Intel vs AMD. I would love to know the amount of money spent / number of people employed by Intel in astro-turf campaigns and reviews. If court records are to be believed, Intel is one of the dirtiest players in all of Silicon Valley and will do anything conceivable legal or illegal to gain an advantage. What it *looks like* is what the language wars *look like* either strong unequivocal bashing of the opponents platform by someone with apparently infinite time to respond to posts with enormous technical detail that distorts reality but is difficult for the average person to counter or damning with faint praise in reviews etc.

These things go on at every level everywhere. Java and it's VM is an enormously successful language / platform that is installed on perhaps a billion machines and is no more insecure than any other equivalently power technology. The same is true of C# and all the other platforms.

One could say that about any piece of software

[Omnifarious]

They all have undiscovered holes. What makes Java any riskier than IE? What makes it any riskier than Chrome or Firefox? Is it the lack of any update strategy on Oracle's part?

Server- vs. client-side Java

[DragonWriter]

"Trying to use 'todays' internet with Java disabled is not a viable option. A realistic estimate is that over 70% of all common websites require Java to function correctly.

The only way that number is within an order of magnitude of being correct is if it is a reference server-side Java, which isn't the issue. In-browser Java is the issue, and very few common websites require in-browser Java to function correctly (in-browser JavaScript, perhaps, but aside from artifacts of early-90s marketing in the naming, the two have nothing in common.)

Re:Server- vs. client-side Java

[blackraven14250]

That was a quote from the GP. He doesn't know how to use the quote tag.

Nonsense

[Anonymous Coward]

Java vulnerability can be fixed in a few seconds:

apt-get remove java

There. Vulnerability fixed.

Re:WTF is the deal with Java and being so insecure

[ewibble]

But we have javascript, which probably no more secure than java, especially now that we are now adding more features to it, canvas, websockets.

The thing is I see no need for more attack vectors so we might as well limit them not use java/flash on the web browser.

I run executable all the time, All apps should run in a vm by default, and only get access to real stuff if I explicitly say so, otherwise all data is faked to the app.

Do you guys realize...

[Synerg1y]

These vulnerabilities affect java applets right? How many java applets are "in the wild"? 10? Most java applets are in-house businesses task specific apps from what I've seen. Meaning if you're casually browsing the web and the JVM is on... turn it off you don't need it... wants to come on and you don't trust it, block it... standard web practices here.

Re:So long/The way the future was

[gabereiser]

I think he meant Kobol, the originating planet of the thirteen tribes.... Took a lot longer than 5 years to die but then again, the Galactica found it in ruin and didn't stay for archeological studies...

Re:WTF is the deal with Java and being so insecure

[Billly Gates]

Javascript is sandboxed in most browsers and in Firefox most of it is neutered in terms of access to local resources.

Java is untrusted and just runs without a user doing anything! That is the difference. Flash is now trusted and signed and Chrome auto updates it as does Windows Update now if you use IE 9. Mozilla it turns click to play now to prevent exploits.

Re:So long/The way the future was

[Squiddie]

I have a jar of molasses that seems to be equivalent to this concept.

Re:WTF is the deal with Java and being so insecure

[Luckyo]

Javascript has NOTHING to do with java.

same flaw in C#

[Progman3K]

Doesn't this mean the same problem is present in C#, as it is really just a clone of Java

Re:same flaw in C#

[cbhacking]

C# is much more than a clone of Java (the list of things .NET code, including C#, can do but Java can't is very long), but more to the point:

C# was invented by MS, who had, by that time, many years of battling security issues and had apparently learned a few things along the way. The closest thing .NET has to Java applets is the Silverlight browser plugin, which, like Java applets, runs in a sandbox that restricts the operations possible by the applet code. However, there are two major differences:
1) In Java, a number of potentially very dangerous operations are permitted if the applet is "trusted", which mostly comes down to it being digitally signed. In Silverlight, those operations aren't permitted at all.
2) Both Java and .NET have "reflection" APIs which allow the code to examine and modify itself. However, while Java applets mostly just try to block specific dangerous operations from happening in reflection (it's a near-impossible task to get them all), Silverlight has made Reflection essentially read-only, allowing examination of the loaded classes and assemblies, but not allowing adding or modifying any code (which is how Java applets keep getting broken; the security manager is in Java itself, and gets overwritten or bypassed using reflection).

Reflection API

[RedHackTea]

So after following the rabbit hole, the article links here (see PDF) and here (same site, just "codes" for the issues) while exclaiming about 50 issues in Java! If you cut out the fluff, the only issue is the Reflection API. C# will and does have the same exact vulnerabilities. And after looking through it, it wouldn't take 2 years to apply these "fixes"; however, some "fixes" remove Java functionality, so it will never be "fixed" because why remove functionality. Any language can do bad things. We can only hope that the general public doesn't read this shill crap.

However, I admit that this is also a good thing to hopefully encourage Oracle to provider quicker updates/patches/etc.

I still don't see a mass migration to other languages happening. JAXB (and annotations in general) is one of the best things Java ever invented. I have yet to find a language with features that make XML reading/writing as easy as JAXB. Unicode, i18n, and l10n were well-done from the beginning. Even though people laugh at the notion of byte code and the cross-platformness of Java, I still have yet to see another language do this better. Java will die when either a better solution emerges or enough corporate shill kills it.

And I still don't understand why Linux is being bogged down with C# mono programs such as Banshee, TomBoy, etc. Don't get me wrong, these are great programs, but why not write them in a language that is more open? It would have been just as easy to do these in Java with GTK+.

/endrant

Re:Reflection API

[oreaq]

C# will and does have the same exact vulnerabilities.

No. CLR application domains and Java class loaders are different concepts.

oracle as damage, route around it

[bcrowell]

To paraphrase a well known saying, I think it's time for the internet to start seeing oracle as damage and route around it.

One really simple thing that seems needed, and that should be extremely simple to do, would be a whitelist/blacklist plugin for java applets in firefox. The vast majority of java applet users are probably people who work in a bank, a law practice, or a medical office and only ever need to use a single applet. They need an option where they can blacklist all java applets by default, but allow applets from medicalrecords.com or whatever. These folks can't just disable the java plugin completely. Setting plugins.click_to_play to true is also a solution, but it breaks sites that use flash, and it doesn't protect the business against an office worker who clicks on stuff without thinking. (I tried setting this flag on my desktop box at home, and was too much of a nuisance. This is what I have flashblock for, and flashblock does the job better.)

Another helpful step would be to make it easier for people to find out which versions of java they have on their computers and easier for them to avoid unsafe versions. On my ubuntu box, managing this is a total mess. If I do "java -version", it tells me I'm running java 1.6, which would be immune to this vulnerability. But if I check inside the directory /usr/lib/jvm , it turns out I actually have 1.5, 1.6, and 1.7 all installed. Well, which one is firefox using? I get zero results from dpkg --get-selections icedtea . In firefox, doing tools:add-ons:plugins tells me I have IcedTea-Web 1.2, which tells me nothing about the java version. Typing about:plugins in the url bar shows me literally two dozen version numbers. Googling turns up somebody's test app at http://javatester.org/version.html , but (a) how do I know this guy isn't a black hat, and (b) even if that showed I was currently running 1.6, what happens if a future apt-get upgrade bumps me into 1.7?

The final thing that should really happen IMO is that the OSS community should get off the java upgrade treadmill. The IcedTea project should designate some version such as 1.6 as a high-security, stable version and focus some real effort on making that version secure. Distros should stop packaging 1.7+ until the dust settles -- and if that take a couple of years, who the heck cares? Hell, I wouldn't care if it took a decade, or forever.

Re:oracle as damage, route around it

[bill_mcgonigle]

The final thing that should really happen IMO is that the OSS community should get off the java upgrade treadmill. The IcedTea project should designate some version such as 1.6 as a high-security, stable version and focus some real effort on making that version secure. Distros should stop packaging 1.7+ until the dust settles -- and if that take a couple of years, who the heck cares? Hell, I wouldn't care if it took a decade, or forever.

Is the problem with OpenJDK or just Oracle Java?
Doesn't OpenJDK have a reasonable patch procedure?
Why don't all the corps that are tied to Java apps fund the development of an OpenJDK port/plugin for Windows and leave Oracle to run their own Java ghetto?

Re:oracle as damage, route around it

[bcrowell]

Is the problem with OpenJDK or just Oracle Java?
Doesn't OpenJDK have a reasonable patch procedure?
Why don't all the corps that are tied to Java apps fund the development of an OpenJDK port/plugin for Windows and leave Oracle to run their own Java ghetto?

I don't know that much about how these projects are actually organized. I could be wrong, but it sounds to me like basically a PHB at Oracle decrees that a certain feature should be added to java, even though it's ill-advised from a security-design point of view; then code monkeys at Oracle implement it; then people out in the OSS world (the project that used to be GNU classpath? IcedTea? OpenJDK?) import the code into their own implementation, which is really the same code-base with just a few IP-encumbered parts replaced with open-source work-alikes. AFAIK the present security hole was present in every implementation of java 1.7 for the last 6 months, not just windows implementations or implementations downloaded directly from oracle.

If anyone has deeper insight into how all this is organized, it would be great to hear from them.

Re:oracle as damage, route around it

[petteyg359]

Oh, it's so hard to find such a thing. There's this thing I've heard people whispering about in dark alleys called "NoScript", but I've never actually seen it.

Re:So long/The way the future was

[tripleevenfall]

"It's been in MY jar of molasses since 199x!"

Re:So long/The way the future was

[mwvdlee]

Does COBOL have as many security issues as Java?

Re:WTF is the deal with Java and being so insecure

[mwvdlee]

Yes, but Java is a completely different language from JavaScript.

How do *you* propose interfacing to the OS?

[msobkow]

Of course there are hundreds or thousands of native API calls made by the Java stack.

Sooner or later you have to talk to the OS.

Re:How do *you* propose interfacing to the OS?

[bbn]

Yes the point is that you can make it "later" instead of "sooner". Example of this is the Google Native Client which exposes OS services through only an API consisting of a handful of allowed methods compared to the thousands of the Java platform. It is a lot easier to make 10 methods secure than 1000.

Native Client can run C code inside the Sandbox, so you can still take advantage of existing libraries.

Re:How do *you* propose interfacing to the OS?

[BradleyUffner]

Yes the point is that you can make it "later" instead of "sooner". Example of this is the Google Native Client which exposes OS services through only an API consisting of a handful of allowed methods compared to the thousands of the Java platform. It is a lot easier to make 10 methods secure than 1000.

Native Client can run C code inside the Sandbox, so you can still take advantage of existing libraries.

Hmm... The mantra I always hear is "Don't try to write a function from scratch that has already been written".

Re:How do *you* propose interfacing to the OS?

[thoromyr]

You seem to be under the misapprehension that these bugs are in underlying C code, not java itself. I'm not sure why you think C code is somehow less secure than Java bytecode, but a common claim is C having pointers. Ooo, scary.

The problem is, these vulnerabilities are not due to buffer over runs or problems with pointers. They are caused by run-of-the-mill bugs in the java design or implementation. In other words, the jvm is executing the bytecode without any problem -- the *intention* of the security is being subverted, but the JVM is doing exactly what the source code is telling it to do.

Java was designed with the intention of providing a secure sandbox. The reality is instructive about the consequences of using a complex and many-featured product. Simple is no guarantee of security, but complexity is definitely an enemy of security.

Re:How do *you* propose interfacing to the OS?

[countach]

If you're not sure, let me explain. Java has a security model. C does not.

Re:How do *you* propose interfacing to the OS?

[Raenex]

I'm not sure why you think C code is somehow less secure than Java bytecode, but a common claim is C having pointers. Ooo, scary.

C pointers, and C's ability to corrupt memory in general, is a known, major source of security bugs.

The problem is, these vulnerabilities are not due to buffer over runs or problems with pointers. They are caused by run-of-the-mill bugs in the java design or implementation.

That's true, and there's no sense blaming C for this particular bug.

Re:the fix

[ixidor]

in soviet Russia, nobody expects the Spanish inquisition!

Re:So long/The way the future was

[BotnetZombie]

Perhaps the time is right for a COBOL browser plugin?

Re:WTF is the deal with Java and being so insecure

[Algae_94]

I was thinking this when I started reading his post, but then I actually read and comprehended what the poster said. He was talking about javascipt because we download javascript code and execute it without any warnings and that isn't a problem.

Stop yelling about javascript and java being unrelated. We all know it, and it doesn't help any discussions. The people that don't know they are different probably won't have a lot of insightful comments on threads about languages.

Maybe it was a bad idea in the first place

[fyngyrz]

Perhaps it's time to rethink the whole "execute in user space" thing and go back to HTML/CSS rendering and server-side CGI.

Near as I can tell, the whole user-space execution thing has been a security and compatibility clusterfark since day one. The "cloud" is a user data loss / privacy nightmare by design, too.

Honestly, it seems to me that outside of the usual HTML uses - reading a blog or a news site, shopping, that sort of thing - most people I know actually use the web to ship video and audio back and forth. Personally, I've done less surfing, emailing and other usual net activities this year than ever before; I have dedicated appliances that stream music from Internet radio stations, deal with video, e-books...

Guess I'm just a desktop kinda guy. Get off my lawn?

Re:Maybe it was a bad idea in the first place

[DuckDodgers]

Well, Chrome, Internet Explorer 9, and Firefox all have a better handle on this than Oracle. They all update automatically, with no user intervention required. Firefox was the last one to start doing that.

Adobe PDF Reader and Flash frequently have security flaws. Chrome includes its own PDF Reader to avoid the problems with Adobe reader. Chrome includes its own build of Flash so Google developers can release security fixes faster than Adobe does. Firefox checks the versions on Adobe PDF Reader and Flash player and if you're out of date, it prompts you to update them. I'm not sure what IE does, if anything.

Sun and now Oracle, though, rest on their laurels. Their "auto-update" feature for Java is not fully automatic, there are manual steps involved, and even worse after each update it resets the update check interval to something absurd like once a month or longer and if you want more frequent checks for updates it has to be reset to once every few weeks. Oracle needs to ask Google or the open source community for help to have Java update function exactly like Chrome's updates. Then they could ensure far more Java users have fixes installed more quickly.

Re:Maybe it was a bad idea in the first place

[Phrogman]

Well I agree with you. I use the web to read stuff, sometimes to view stuff, and to post information back. I use applications for pretty much any other use of the web.

I don't need a lot of the "functionality" that seems to important to web developers these days. A lot of that stuff could be done on the back end, or at least with a much more secure system than relying on Javascript to implement it.

Its perhaps time for a new client-side coding mechanism that starts with security first and foremost, and adds enough client-server interaction to be useful without exposing the user to as many possible exploits?

Re:Maybe it was a bad idea in the first place

[gtall]

"Oracle needs to ask Google", Uncle Larry would rather eat his shorts. He feels he got screwed out of Beeeeellions and Beeeeeellions of dollars. Uncle Larry and Darl McBride now share a condo on Uncle Larry's Hawaiian island...swapping stories of Beeellions lost, suits that never paid back what they thought they'd get, spanking each other on ass when they land a big fish. It's all they have to live for.

Re:Maybe it was a bad idea in the first place

[mcgrew]

I don't need a lot of the "functionality" that seems to important to web developers these days.

Indeed, and newspapers are the worst. All the ads and other crap like javascript "toolbars" make their sites a royal pain. My monitor is widescreen, so USA Toady's TWO "toolbars" are especially egregious. The local paper (SJ-R) has an "up to the minute news" popunder. Good way to run off prospective readers! Are these idiots all on crack? A newspaper should need nothing but plain vanilla HTML. Their "tools" just get in the user's way. It's worse at work (I'm home sick today) where they use IE7 and often content is covered by ads!

Re:Maybe it was a bad idea in the first place

[DuckDodgers]

I don't know if they have access to the source from Adobe, or if they just get the binaries with fixes faster than Adobe posts them to their own website, but Chrome tends to get security updates for Flash faster than stand-alone Flash gets them.

Re:So long/The way the future was

[znrt]

no, COBOL was written by actual programmers, long before software engineers infected earth.

Re:WTF is the deal with Java and being so insecure

[aled]

Javascript has NOTHING to do with java.

Actually, they're both rather mediocre programming languages in their own miserable ways. They have that in common.

Please, provide your examples of which are good languages in your opinion.
I, for one, think that Java is good enough for the job.

Re:So long/The way the future was

[aled]

I think he meant Kobol, the originating planet of the thirteen tribes.... Took a lot longer than 5 years to die but then again, the Galactica found it in ruin and didn't stay for archeological studies...

Remember, if you use Kobol in a project the gods will punish you.

After 40 min on tech support...

[hurfy]

ups.com

Needed to print thermal labels from the website interface. For some reason it uninstalled itsaelf or i got away without it for a year. But had to install java to get it to work again, pretty much on the day all this started but noone there had a clue. sigh....custom driver, activeX control, java all needed to be install to print the damned label.

It is not even in the damn instructions...it is just ASSUMED to be on the machine these days. That machine does nothing but UPS labels so the usual browsing baggage was not installed.

Re:After 40 min on tech support...

[hobarrera]

Like I said, only extremely specialized websites used applets.
If that's your example of a "popular website that requires java", then I think you've just proved my point.

Re:So long/The way the future was

[aled]

Wrong answer!

no, COBOL was written before software security was invented.

Selectively disable ONLY Java plugin

[Miamicanes]

Hmmm... would someone mind again explaining how to robustly disable the Java plugin from Internet Explorer, Firefox, and Chrome...

* WITHOUT uninstalling the JRE or JDK,

* WITHOUT globally disabling plugins (like Flash) in general,

* ROBUSTLY, in a way that can't be subverted by Oracle's installer or brain-damaged update logic, and

* in a way that allows you to permanently or temporarily re-enable the Java plugin for a domain, specific host, or wildcard/regex-matched URL... and allows you to do it retroactively, AFTER the page has loaded, without resubmitting a form (if that's how you got to the page in the first place) or restart the browser after re-enabling Java. Few things suck more than completing an online purchase for Java-delivered premium content, or going through some extended login process involving hardware tokens and one-time passwords, only to have to repeat the whole thing from scratch (or try to get a refund) because you forgot (or didn't notice) that Java has to be enabled before you start?

Re:So long/The way the future was

[Anonymous Coward]

COBOL has a better solution.

Java has a bad history

[pubwvj]

Java has a bad history. I disabled it on all of our machines years ago due to problems like this and the fact that so much poorly written Java code sucks CRU wasting computer resources and slowing down machines. I would recommend never using Java. I don't run into any situations that require it so there is no point in bothering to risk it.

Re:WTF is the deal with Java and being so insecure

[Gr8Apes]

You are entirely incorrect on so many fronts, it's funny. I think you should just stop posting on Java since we've probably seen every error you can make already in this story. To finish it off, Javascript is not only sandboxed within each browser's implementation, it is also severely restricted in those implementations in what it can do. Want to edit a local file... can't do it in Javascript in a browser - those capabilities do not exist there. Want to call a new server? Again, can't do it in a browser. Etc etc etc.

Java does have the capability to be signed and sealed, which is about as close to trusted code as you can get. But that's "too hard" for most to deal with, apparently. If applets required signed/sealed jars to run to begin with or pop up a warning, you'd still have a mess of stupid people trained by years of clicking through annoying confirmation boxes in Windows that would still run unsafe applets. So I doubt it would help in any meaningful way.

I don't have java plugins in my browsers, and run noscript in Firefox for non work sites. That's about as safe as you can get.

Note to IT staff...

[anubi]

If you are running a website targeting engineers and designers actively integrating products into new designs, take my parent post into consideration before considering all sorts of fancy window-dressing programming which requires java, javascript, pop-ups, etc to be enabled before content is displayed.

Businesses having lack of foresight who hire webmasters who implement finicky programming techniques isolate themselves from engineers trying to research products to be designed into other products. How many times has one tried to obtain product info only to be met with all sorts of script programming demanding java be enabled? Some business types will still pay a good salary to have prospective customers abandon their site because it is so difficult to use.

I do a lot of research for businesses in the design phase, and often this research is quite confidential. That is why they have me involved. I am not supposed to reveal the company name or even what it is they have me researching.

Business question: How much would you pay to have a script written that discouraged the engineer from your site, so your product was never considered in the design phase? How much would you pay for someone who would hire someone that writes this stuff? The answers to these questions will have a large influence on your future sales.

Re:Oracle owns Java now?

[mark-t]

Where have you been?

Oracle has owned Java since April, 2009, when they bought out Sun.

Re:So long/The way the future was

[Lawrence_Bird]

Who will out live the earth? Roaches or COBOL code?

MOVE 'FUNNY' TO WS-MODERATION-CODE.

What if Toyota said it would take 2 years

[Nyder]

to fix that stuck accelerator problem?

The government would fine them big time, if not possible keep them from making the cars that are affected.

Time to start handing out fines to Oracle I would think. See if that might change the 2 years to something a bit more realistic, like 6 months.

 

DJBDNS

[tlambert]

Java was designed with the intention of providing a secure sandbox. The reality is instructive about the consequences of using a complex and many-featured product. Simple is no guarantee of security, but complexity is definitely an enemy of security.

Exactly! This is why DJBDNS runs its parts in separate, simple processes: to reduce complexity.

Yes, the idea of zone transfers, secondary, and forwarding servers all break with this model, but fixing that is an exercise left to the student.

PS: I always handled complexity while maintaining security through abstraction + avoiding API layering violations, you know, like starting to interpret the meaning of MIME dat before verifying the validity of the MIME container object, which is what caused so many OutLook security vulnerabilities. But I now realize after reading your post that that was just my silly API design class talking.

nonsense..

[SuperDre]

Java may have it's security-problems, but it's not like it's the only framework/language that has it's problems.. You must be very naive to think that other languages/frameworks don't have the same kind of security-problems as java does. There is no such thing as complete secure, and there never will be...

Re:So long/The way the future was

[RaceProUK]

Who will out live the earth? Roaches or COBOL code?

There are only two constants in the Universe: death and COBOL.

Re:WTF is the deal with Java and being so insecure

[Sigg3.net]

Javascript has NOTHING to do with java.

Well, historically they share a past. JavaScript was named JavaScript because of Java. Before that it was called Livescript.

I read it on /. :)

All you need to know about Oracle security

[Medievalist]

Three times a year Oracle produces "critical patch updates"...

Three times a year.

Not when they are needed, or when they are wanted, or when they are actually ready... but rather, three times a year.

All you need to know about Oracle is contained in the parent post. They think "three times a year" is taking "security exploits incredibly seriously".

Reminds me of the sewer worker who's proud to take a bath every year, whether he needs it or not, because he's incredibly serious about hygiene.

Disable It

[agrisea]

I find this entire issue to be rather odd. I was under the impression that when Sun Microsystems was developing Java that its code was heavily looked at to make sure holes of the type found could not be there. Yet now that Oracle has it, "we should disable Java" because the Department of Homeland Security's US-CERT says so. If that is the case, then why isn't a warning issued so that people stop using Windows? After all, it too is full of holes that allows hackers to target it constantly. And Microsoft has been constantly fixing it and yet more holes appear.