4 ms·

> Java exploit after Java exploit One zero day in 2 years. Not quite the disaster area it's made out to be on HN.

• azinman2 11y ago
  http://www.cisco.com/web/offers/lp/2014-annual-security-report/index.html http://www.cisco.com/web/offers/lp/2014-annual-security-repo... "91% of web exploits are targeting Java"
  • ZoFreX 11y ago
    That doesn't change the facts. Flash has had more zero days than Java. Your browser, regardless of which one you are using, has had more zero days than Java.
    • azinman2 11y ago
      Flash has nothing to do with it. The browser doesn't either, which receives updates much more frequently as well and is fundamentally necessary (compared to applets). My point is that Java keeps having security vulnerabilities some of which are exploitable from the web. There's a reason why Oracle keeps releasing patches. Even more important is my main point that the reasoning given against a bug bounty program is idiotic, especially on the backdrop that they do in fact have security vulnerabilities on a regular basis. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#AppendixJAVA http://www.oracle.com/technetwork/topics/security/cpujan2015...