Slashdot Mirror
Oracle to Block JAR Files Signed with MD5 Starting In April (bleepingcomputer.com)
An anonymous reader quotes BleepingComputer:
Oracle says that starting with April 18, 2017, Java (JRE) will treat all JAR files signed with the MD5 algorithm as unsigned, meaning they'll be considered insecure and blocked from running. Oracle originally planned MD5's deprecation for the current Critical Patch Update, released this week, which included a whopping 270 security fixes, one of the biggest security updates to date. The company decided to give developers and companies more time to prepare and delayed MD5's deprecation for the release of Oracle Java SE 8u131 and the next Java CPU, scheduled for release in April...
Oracle removed MD5 as a default code signing option from Java SE 6, released in 2006. Despite this, there will be thousands of Java apps that will never be resigned. For this, Oracle will allow system administrators to set up custom deployment rule sets and exception site lists to allow Java applets and Java Web Start applications signed with MD5 to run. Sometimes in the second half of 2017, Oracle also plans to change the minimum key length for Diffie-Hellman algorithms to 1024 bits. These updates are part of Oracle's long-standing plan for changes to the security algorithms in the Oracle Java Runtime Environment and Java SE Development Kit.
Oracle removed MD5 as a default code signing option from Java SE 6, released in 2006. Despite this, there will be thousands of Java apps that will never be resigned. For this, Oracle will allow system administrators to set up custom deployment rule sets and exception site lists to allow Java applets and Java Web Start applications signed with MD5 to run. Sometimes in the second half of 2017, Oracle also plans to change the minimum key length for Diffie-Hellman algorithms to 1024 bits. These updates are part of Oracle's long-standing plan for changes to the security algorithms in the Oracle Java Runtime Environment and Java SE Development Kit.
The article suggests only 1.8, but will this also be pushed to 1.6 and 1.7 too?
...write a code-signing infrastructure instead.
Presumably they mean that they wont accept RSA signatures over MD5 hashes.
BUT WHAT ABOUT SOLARIS
It was dead the moment Oracle ate Sun -- it wasn't even their primary target, merely collateral damage in their plan to kill MySQL.
Unrelated: you really should check your keyboard, either your Caps Lock or Shift is stuck. If you can't fix that immediately, try stty iuclc although this helps on terminals only (although elinks is an option). If you did that intentionally, please at least use small caps: apt install tran; echo "But what about Solaris?"|tran smallcaps; that's way less rude. As the Great Runes are dead in England since 11th century, last computer terminals since late 1970s, there's no reason to use them.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
It seems to me that the stewardship of Java in the past few years, particularly it's security aspects, have rendered it useless and undesirable.
I must use java in my employment with well - let's just say "a lot" - and all over the world. It is not simply my own conclusion, but the conclusion of many people I consider more facile and accomplished than myself that Java is undesirable. My employer has gone to the point of shutting down a planned services introduction. That product, instead of launching, was shut down and the teams re-assigned to other tasks.
The workarounds to use Java in the current environment are such that we commonly create VM images to spin up and destroy for tasks requiring Java.
Going forward, I will carefully review employment offers - if it deals with Java, they're going to have to work very hard for me to accept it. I don't need the pain and heartache dealing with it causes if there are alternatives.
I am being intentionally careful not to give out details, and I'm sure there are many that will start off a reply "You stupid idiot, you can do X!" - again, these are not solely my own conclusions, but shared with many people I consider to be very, very good. I assure you, anything you may think of has surely been considered if not by myself, then by others in the same situation. Please do suggest if you wish, but also consider that a lot of other, very smart people, have looked at this same situation for more than a few years.
Like all opinions, this may or may not fit your situation and exact needs. It can even be quite wrong.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Ever since Dobbertin found a hash collision in 1996 RSA labs themselves were already recommending alternatives such as SHA-1. This was just around the time Java 1.0 was released.
These security changes make just make it tougher and tougher to support "legacy" Java applets that are unsigned. Forget Java 8... even the newer versions of Java 7 can't run them anymore.
I guess that it's good that they fix these issues, but they need to offer workarounds or I'm going to have to keep installing Java 6 on some customer machines to keep their legacy crap running.
"the current Critical Patch Update, released this week, which included a whopping 270 security fixes,"
Remember when Java was touted as the super-secure language that was supposed to be nearly impossible to exploit? I do.
It was gonna be the "write-once, compile anywhere" language that was going to make all other languages obsolete. It was basically going to take over the world and *everything* was going to be written in Java, "Everything, you'll see!" they said.It was going to be the Uber Language for all time, the Final Solution.
Oh, the Java early adopters sneered at anyone who didn't jump on the Java Train and they kept crowing about how it was going to be the end of sloppy programming and uncertain coding, and vulnerable executables would be a thing of the past...
I didn't believe it then and I (obviously) don't believe it now.
Just cruising through this digital world at 33 1/3 rpm...
Well one could always hope
http://saveie6.com/
... their plan to kill MySQL.
Did you remember to tell Oracle about this plan? Because I don't think they know anything about it.
Il n'y a pas de Planet B.
Nope, all SHA hash functions are standardized by the federal government and are license free.
Not if Java refuses to load those functions and requires their 'more secure' proprietary functions instead.
This feels like the computer industry trying to lock out the free like in the days of big iron.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Literally wtf are you even talking about. We know what Java does. It uses regular standard hash functions, no proprietary ones.
They didn't expect a group of most competent devs jumping ship and making MariaDB. It's nearly impossible for a fork of something as complex to succeed, thus it was a near-sure bet that control of MySQL would let them slowly extinguish their biggest competitor. Well, proper use cases for Oracle-the-DB and MySQL differ but most people who decide don't know the difference: if that wasn't the case, MySQL wouldn't have the massive usage share it enjoys, as if you need real SQL then Postgres is much better, and if you don't, you're better served by a non-relational database.
Thus, instead of reaping the rewards, they flail wildly and merely make MySQL unusable: stop real new features, shut down access to most of bug database, halt any detailed information about security vulnerabilities (providing fixes only as massive new versions, unfit for backporting). Thus, distributions are switching to MariaDB left and right: Debian just did, Fedora did so ages ago.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
I know it's fashionable to dump on the Java ecosystem around here. However, given the tools and libraries that are available, I find it incredibly easy to write apps quickly and efficiently. Personally, I've started to use Kotlin and it rocks. Between it and Groovy and the massive wealth of libraries in the Java ecosystem, I haven't found anything else that lets me be as productive.
That said, some of the frameworks out there just plain suck. My employer is building a Spring/Hibernate Servlet system, and while there are a few things that are kinda cool about Spring, I think it's mostly a clusterf**k of an over-bloated framework. I guess you have to use it when you are communicating with a bunch of disparate systems, but I'm certain that it's killing our team's productivity hugely.
I've tried Go, and I like it but there is not very much of a community around it, and the database package was designed by morons. I've tried Rust. I think it has potential, but it's really hard to spin up your head around it. And again, not much of a community.
It is a joy for IT to keep around a bunch of old java client environments to access old printers, NAS, switches, kvm switches, motherboard controllers (iLO etc), blade server management all "conveniently" accessed through a web browser (and requiring an old obsolete java and old insecure java features).