Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenJDK May Tackle Java Security Gaps With A Secretive New Group (infoworld.com)

Posted by EditorDavid on from the beyond-the-bylaws dept.

An anonymous reader quotes InfoWorld: To shore up Java's security, a private group that operates outside the normal open source community process is under consideration. The proposed OpenJDK Vulnerability Group would provide a secure, private forum in which trusted members of the community receive reports on vulnerabilities in code bases and then review and fix them... The vulnerability group and Oracle's internal security teams would work together, and it may occasionally need to work with external security organizations.

Due to the sensitive nature of its work, membership in the group would be more selective, there would be a strict communication policy, and members or their employers would need to sign both a nondisclosure and a license agreement, said Mark Reinhold, chief architect of the Java platform group at Oracle. "These requirements do, strictly speaking, violate the OpenJDK bylaws," Reinhold said. "The governing board has discussed this, however, and I expect that the board will approve the creation of this group with these exceptional requirements." If the Java security group is approved, Andrew Gross, leader of Oracle's internal Java vulnerability team, would lead it.

5 of 79 comments (clear)

  1. I smell something strangely familiar... by Frosty+Piss · · Score: 4, Insightful

    The vulnerability group and Oracle's internal security teams would work together

    Two things: I thought Oracle wanted to cut Java free? No? And really, when has Oracle been willing to work with anyone outside Oracle on Java?

    I mean, it could be true...

    --
    If you want news from today, you have to come back tomorrow.
    1. Re: I smell something strangely familiar... by KGIII · · Score: 4, Insightful

      I'm usually fairly mild mannered, but fuck Oracle. I trust those fuckers about as far as I can throw a fucking yacht. They came in to provide a database, consultants and all. The fucking fuckers were there for more than six months and never actually got it all working. So, I kicked them out. Shortly after, they had us in court and wanted a seven figure sum. It cost nearly that much just to defend ourselves and I have no idea how much was lost in productivity and due to morale. Fuck Oracle, fuck them right in the face.

      I feel better now.

      --
      "So long and thanks for all the fish."
  2. Re:The NDA by Frosty+Piss · · Score: 4, Insightful

    Java is dead. Let it live in legacy in a dusty MDF somewhere with it's elderly uncle COBOL.

    Is Java "dead"? I'm no expert, but I thought huge giant swaths of "enterprise" code was written in Java? Shit like that doesn't just vanish, it get's maintained and added on to forever - like COBOL code... But also, while it's trendy for all the hip kids to say such things, COBOL is far from dead.

    --
    If you want news from today, you have to come back tomorrow.
  3. Re:The NDA by Billly+Gates · · Score: 1, Insightful

    Name one big new project that is popular made in the past 3 years based on Java?

    --
    http://saveie6.com/
  4. Re:The NDA by Anonymous Coward · · Score: 3, Insightful

    Java is dead? Not likely. It is the most popular programming language in the world by a large margin.

    http://pypl.github.io/PYPL.html

    Been in software development for 15 years and there is always some fool saying "java is dead"