> You're talking about POODLE? Why would I? That wasn't Tomcat, and it didn't leak keys. I won't read through the CVE list right now (because it is long, and

> You're talking about POODLE? Why would I? That wasn't Tomcat, and it didn't leak keys. I won't read through the CVE list right now (because it is long, and that's only counting Tomcat and not the JRE itself), but it reused buffers and leaked potentially anything, very much like Heartbleed. If you were in a Java shop at the time you know about it. > It's not about adding abstraction. There are plenty of safe systems programming languages. No true Scotsman, eh? Most people who go about how the world would be saved if we just got rid of C are provably wrong, because popular application in their pet language are just as bad. It used to be Java fanboys, that's why I mentioned Tomcat. Then it was Ruby (and don't get me started on the security disasters Rails brought with it). Most of these do indeed pile abstractions on popular data structures to minimize the possible errors. There are promising languages, but none in popular use, and very far from something you could audit.