Slashdot Mirror
Massive Amount of Malware Targets Older Java Flaws
Trailrunner7 writes "It's no secret that Java has moved to the top of the target list for many attackers. It has all the ingredients they love: ubiquity, cross-platform support and, best of all, lots of vulnerabilities. Malware targeting Java flaws has become a major problem, and new statistics show that this epidemic is following much the same pattern as malware exploiting Microsoft vulnerabilities has for years. Research from Microsoft shows that there has been a huge spike in malware targeting Java vulnerabilities since the third quarter of 2011, and much of the activity has centered on patched vulnerabilities in Java. Part of the reason for this phenomenon may be that attackers like vulnerabilities that are in multiple versions of Java, rather than just one specific version."
Actually, the one practically undisputed big selling point of Java is backwards compatibility. In fact, most experienced developers I know would cite that Java's stringent backwards compatibility policy is one of the things that has been holding the platform back, impeding progress. As an experienced Java developer myself, I would claim that 95% of Java applications should be upgradable to the most recent version without any issues at all.
Which changes nothing other than the application your updating.
You realize that MS is the only company that gets the word 'patched'.
Firefox, chrome and opera all do the same as Oracle.
Not that MS hasn't introduced breaking changes and called them patches or anything.
If you think the browser is a stable platform you've clearly never done web development.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Good luck with that... having code that works in more than one VM is a big task. For example, am I stuck with a VM that has JCE, or do I have access to JSSE? Even then, a JVM on a Mac may not run code written by a JVM on Windows.
Oracle needs to do a complete library enema of Java and really get write once, run everywhere going properly, just like how MS cleaned up house going from .NET 1.x to 2.0.
If I want something that works across platforms, it would be JavaScript, or HTML5. No flash, no Java, no stupid-ass extensions that some malware writer will cornhole.
Some posts above mine, people blame Oracle Java. I blame the updater.
My dad was hit by malware lately, which he got, because of an outdated Java on his system. He told me he always updated everything and blocked the install of everything else like toolbars. The last thing before he got the virus he remembered, was not allowing jusched.exe admin priviledges.
I get it: jusched mean java update scheduler and everytime it's run it asks for admin priviledges. First of all:
1.) This should be updated automatically by a package manager, hence I blame Microsoft
2.) If 1.) is not the case, it should at least be called JAVA UPDATE PROCESS
3.) It should display some kind of information before requesting Admin rights.
Not many people outside of Slashdot know what jusched.exe is. Updating needs to be automated. Actually: We should somehow take this into our own hands and provide OpenJDK for Windows also ourselves and get people to switch. Maybe even without the ASK Toolbar
As someone who no longer has to deal with corporate (thank God, Allah, Zeus and the FSM) what pisses me off is after YEARS of decline, to the point that finding Java installed on a home user or SMB was as rare as hen's teeth that god damned game came out and fucking obliterated 10 years of declining java overnight. I am of course talking about Minecraft, or as i call it "the STD of casual gaming"
The problem is...and i'm gonna get the Jfanboys screaming bloody fucking murder for daring to point this out, but Java just sucks ass when it comes to security, it really does. You can't even compare it to Windows or flash because with both of those you can turn on automatic update and you'll be fine, with java as you pointed out they do NOT patch, they REPLACE and that ends up breaking shit as often as it fixes it so naturally all it takes is java shitting all over an app after update for most folks to learn "Don't update java EVAR" which is how we are in this mess.
If we can't get the damned programmers to use something, ANYTHING other than java then we need an open source replacement, something that will just patch the bugs instead of screwing everything up by replacing. Hell maybe somebody could port the Google version android uses but make it compatible with standard Java apps, I don't know, all I do know is we need something better than fricking Java because down here in the trenches it makes Flash look like Fort Knox by comparison. You can't even get mad at people for turning off updates because their replacing instead of patching just leaves you with broken apps so its either leave their asses hanging in the breeze or give up on running anything that uses java. While that would be fine by me I have a feeling all the casual gamers won't let that happen.
ACs don't waste your time replying, your posts are never seen by me.
Hardly true. I'm using a whole system (Gentoo Linux) with no .NET (thank you, junk belongs to..) and no Java (disabled on the system level). Here we go: a bunch of programs NOT using Java or .Net AND actually working. That is what people use when they want the job done. Or, you can look at a bunch of Java programmers writing tons of code in pity attempt to create some useful. .NET as deceases. Once your company catches them, it's very difficult to get cured.
If they are trying to create desktop applications, that's in most cases laughable, with very few exceptions. The created monstrous dinosaurs work slow, consume a lot of resources, and are usually not any better than anything else from the point of functionality.
If they are creating 'Enterprise' software, than we usually see an enterprise-scale f-up, with HUGE hardware and human resources pulled in to perform even simplest tasks. I'm watching a comedy in progress, when a system performing about ten TPS requires six (6) application servers to work stably. But, of course, it's all latest Java technology, JBoss/Hibernate/etc. OTOH, JS+PHP based system does 300+TPS on a freaking laptop running same database.
Frankly speaking, I see both Java and
Interesting that the systems I've worked on for more than 10 years, some still running, don't seem to have these security issues you're whining about. Is that, perhaps, because they're almost all wholly related to the browser plugins? Disable that and woah... you don't have security problems.
The cesspool just got a check and balance.
In the interest of being pedantic, OpenJDK is the reference implementation. Oracle's JRE is the one that isn't compatible.
You do not have a moral or legal right to do absolutely anything you want.