7 ms·

As a .NET developer, I only use wrappers for unmanaged code as a last resort. Having to introduce a dependency on something as slow and security-bug-rich as Jav

by skrowl 10y ago

As a .NET developer, I only use wrappers for unmanaged code as a last resort. Having to introduce a dependency on something as slow and security-bug-rich as Java would be a hard sell in most .NET shops.

johncolanduoni 10y ago
That's not what IKVM does. It transpiles JVM bytecode to .NET CIL so you only need one virtual machine.
maxxxxx 10y ago
It depends on what you are doing but there are a ton of libraries in Java that have no equivalent in .NET. For a lot of projects it would be very useful to use Java libraries.
- cm2187 10y ago
  Out of curiosity would you mind providing a few examples?
  - shouldbworking 10y ago
    Since Java is the most similar language and what I'm familiar with, here's some things where no C# equivalent exists: Lucene, Guava, Apache Commons, Redis driver, Postgres driver, Cassandra driver, Kafka driver, gRPC, Http2 support(on all platforms, not just windows 10) Notice I said "equivalent". C# ports exist for some of these but they're unofficial, unmaintained, or both. The most heinous thing I've seen MS do recently is only support Http2 on newer versions of Windows. Http2 is a high level protocol and there's absolutely no reason for this. In Java you can use Http2 on any platform using Jetty, Netty, or soon built into Java 9.
    - voltagex_ 10y ago
      I think you're being a bit unfair. I am not properly familiar with Guava, but aren't most things available in .NET's collections classes? A lot of what's in Commons is available in the .NET BCL. https://redis.io/clients#c https://redis.io/clients#c looks fine to me (I'd probably pick the StackExchange client) NPgSQL seems to be the recommended library for Postgres. https://www.nuget.org/packages/CassandraCSharpDriver/ https://www.nuget.org/packages/CassandraCSharpDriver/ was updated in February. https://github.com/Microsoft/CSharpClient-for-Kafka https://github.com/Microsoft/CSharpClient-for-Kafka starts to show some of the issues you're talking about - Microsoft aren't supporting this one anymore, but they point to https://github.com/confluentinc/confluent-kafka-dotnet https://github.com/confluentinc/confluent-kafka-dotnet which wraps librdkafka - seems sensible I'll definitely give you a point for the HTTP2/IIS issue - although there might be more technical reasons than you think for that. From what I recall, a lot of NET and Windows HTTP stuff is implemented in http.sys or WinHTTP which is a low level component. They're not going to ship a large update to anything before Win10, so that's probably why it's missing. In this case I'd just run nginx in front of IIS if you needed to, but I'd hope that most people running IIS in production can afford to update to Windows Server 2012 or 2016.
      - shouldbworking 10y ago
        Guava/Commons contains a lot more than collections. The standard class library in .NET has maybe a third of what's in Guava. Keep in mind that Java's built in library is probably just as big as C#. I won't bore everyone going over the list but check out the summary https://github.com/google/guava/wiki https://github.com/google/guava/wiki Things I've used recently include Guavas automatic argument tester, in memory caches/queues, high speed hashing algorithms, and Bloom filter. None of that stuff has real equivalents in C#. That redis client looks solid, so I may got a bit carried trying to prove a point. The Postgres driver looks good too, but is not officially maintain by the PG team so it could evaporate some day. The Java equivalent IS an official Postgres driver. I see this with C# frequently, it's treated as second class by a lot of OSS projects. You didn't make a counterpoint to Lucene, I assume because there was really no equal out there for C#. These days tying your language to Windows, visual studio, and IIS is unforgivable. MS is trying to undo this with .NET core but for the time being I find it rediculous to need to pay for all these licenses. If my employer wasn't paying for my enterprise edition of VS and copies of IIS, Windows Server, and SQL Server I wouldn't be touching C# at all. At home I use OpenJDK with eclipse and Dropwizard running on Linux with Postgres. The quality of the tech is the same and everything is free and open source.
  - maxxxxx 10y ago
    I did a project around full text search and the amount of libraries in Java was just staggering whereas with .NET you often only had some half baked port that was way out of date. I don't think too many researchers do their stuff in .NET. It's Java or something like Python.
kuschku 10y ago
I’m sorry, could you expand on that? I’m not sure if I’m understanding you correctly, that you’re saying Java is slower than .NET, and the JVM more vulnerable than the CLR?
- Pharylon 10y ago
  Lat time I played with Java was in 2015. It seemed like there was a new JVM zero-day every month, and every time I upgraded, the Java installer tried to install the Ask toolbar. After that, I started joking that installing malware one way or the other was Oracle's primary goal.
  - maxxxxx 10y ago
    Considering that Java runs on many more servers than .NET it can't be that bad.
    - tracker1 10y ago
      Compared to most of today's more recent frameworks, that doesn't mean it's actually great. And while I appreciate the direction of .Net (Core), I am hoping the integrated tooling story gets a bit better (outside VS for windows). Code is okay, but not great, and other editors are mostly non-starters. Installing VS for Mac was a horrible experience that had to be done via manual steps for all the dependencies, etc. My understanding is Java tooling has gotten better, but being able to setup a hello world application in Java, or any established application without a ton of weird dependencies to discover always seemed painful, and "Enterprise" .Net applications didn't feel much better. Today, my world tends to mostly center around Node.js and git... I've dipped my feet into some new .Net bits, and a little bit of go, and that's about it. I find the learning curve steep, but the actual implementation WTFs are nearly non existent. With Java/.Net it's always been a relatively steep learning curve (worse with Java) and a lot of WTFs along the way.
      - kuschku 10y ago
        Eh, lol? Setting up new applications in Java or .NET is by far easier than Node.JS. It's Node.JS where you need 400 dependencies just to use the latest version of the language. That said, there's many easy to use and simple frameworks for Java, and you can try also other JVM languages such as Kotlin, Clojure, Scala or Eta. The JVM hosts the most powerful and fastest managed languages at the moment (via eta and clojure also allowing haskell and lisp on the JVM). .NET is nice, but there's quite a few reasons why Java is used everywhere.
MichaelGG 10y ago
Can you name a few specific examples of where you are using .NET/CLR that Java would have introduced security holes? Basically all the high profile ones that people think of are code-loading issues, similar to XBAP and other .NET tech's bugs. In other words, the "Java insecure" meme applies to very little actual Java dev.
- skrowl 10y ago
  You have to install a whole extra runtime on all of your servers, including production internet-facing servers to use Java. If you can't see that would add to your potential attack surface, I can't help you.
  - merb 10y ago
    you also need to install the .net runtime on all of your servers.
  - MichaelGG 10y ago
    Please list a few remote access vulnerabilities caused by the JVM and not app.
- cm2187 10y ago
  I don't know about security but the fact that the java installer tries to install crapware or change my browser settings doesn't do much for its reputation.
- mpeg 10y ago
  Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using a java library to do one specific thing related to file uploads, despite all their code being .NET. The library became a bit of a black box and no one bothered to keep up with updating it as it was essentially a binary blob that sit outside the normal update mechanisms (visual studio references) Turns out the library had patched a RCE vulnerability a while back, spent a fun afternoon making a PoC exploit for it (tricky because we had some other file validation in place) to win the unofficial office competition to find a security hole in our product. I would agree with your point in general, but the moral of the story is that adding complexity is not good considering most people are too lazy/incompetent to understand the full implication of something like "I'll just use a third party binary / library here" to their ongoing maintenance.
emodendroket 10y ago
I don't think Java is really much slower than .NET code.
- venture_lol 10y ago
  What makes you think it is even slower? Care to show real numbers?
  - emodendroket 10y ago
    I don't.
- shouldbworking 10y ago
  It's faster. The JVM is almost always faster than the CLR, look at the techempower framework shootouts. .NET core is fast but regular .NET get destroyed by multiple Java frameworks.
  - Haldir 10y ago
    The techempower Benchmarks are related to ASP.NET core, that one you can use on Desktop too. The coreclr is only maybe 10-15% faster than Desktop, but not a magnitude or more compared to old ASP.net. I don't think that the clr is slower than the jvm, but quite a few basic frameworks are compared to their Java counterparts
    - shouldbworking 10y ago
      Look at the older techempower benchmarks where they include the regular .NET framework. It's slow as hell compared to java. And yes that's the problem. The CLR itself probably isn't slower than JVM but most of the .NET stack is. It just wasn't written with performance in mind.
      - emodendroket 10y ago
        > The CLR itself probably isn't slower than JVM but most of the .NET stack is. It just wasn't written with performance in mind. I don't really think that's true.
rsynnott 10y ago
Java code is, of course, managed. In any case, this isn't a wrapper for Java code running in a JVM; it's an implementation of Java for the CLR. Not sure what makes you think Oracle's JVM is slower than the CLR, in any case...
venture_lol 10y ago
Yeah, because as a .NET developer, you would not of course know all about Java :) Right, tell me the ecosystem of .NET vs Java and deployment statistics...

by skrowl 10y ago

johncolanduoni 10y ago

That's not what IKVM does. It transpiles JVM bytecode to .NET CIL so you only need one virtual machine.

maxxxxx 10y ago

It depends on what you are doing but there are a ton of libraries in Java that have no equivalent in .NET. For a lot of projects it would be very useful to use Java libraries.

cm2187 10y ago
Out of curiosity would you mind providing a few examples?
- shouldbworking 10y ago
  Since Java is the most similar language and what I'm familiar with, here's some things where no C# equivalent exists: Lucene, Guava, Apache Commons, Redis driver, Postgres driver, Cassandra driver, Kafka driver, gRPC, Http2 support(on all platforms, not just windows 10) Notice I said "equivalent". C# ports exist for some of these but they're unofficial, unmaintained, or both. The most heinous thing I've seen MS do recently is only support Http2 on newer versions of Windows. Http2 is a high level protocol and there's absolutely no reason for this. In Java you can use Http2 on any platform using Jetty, Netty, or soon built into Java 9.
  - voltagex_ 10y ago
    I think you're being a bit unfair. I am not properly familiar with Guava, but aren't most things available in .NET's collections classes? A lot of what's in Commons is available in the .NET BCL. https://redis.io/clients#c https://redis.io/clients#c looks fine to me (I'd probably pick the StackExchange client) NPgSQL seems to be the recommended library for Postgres. https://www.nuget.org/packages/CassandraCSharpDriver/ https://www.nuget.org/packages/CassandraCSharpDriver/ was updated in February. https://github.com/Microsoft/CSharpClient-for-Kafka https://github.com/Microsoft/CSharpClient-for-Kafka starts to show some of the issues you're talking about - Microsoft aren't supporting this one anymore, but they point to https://github.com/confluentinc/confluent-kafka-dotnet https://github.com/confluentinc/confluent-kafka-dotnet which wraps librdkafka - seems sensible I'll definitely give you a point for the HTTP2/IIS issue - although there might be more technical reasons than you think for that. From what I recall, a lot of NET and Windows HTTP stuff is implemented in http.sys or WinHTTP which is a low level component. They're not going to ship a large update to anything before Win10, so that's probably why it's missing. In this case I'd just run nginx in front of IIS if you needed to, but I'd hope that most people running IIS in production can afford to update to Windows Server 2012 or 2016.
    - shouldbworking 10y ago
      Guava/Commons contains a lot more than collections. The standard class library in .NET has maybe a third of what's in Guava. Keep in mind that Java's built in library is probably just as big as C#. I won't bore everyone going over the list but check out the summary https://github.com/google/guava/wiki https://github.com/google/guava/wiki Things I've used recently include Guavas automatic argument tester, in memory caches/queues, high speed hashing algorithms, and Bloom filter. None of that stuff has real equivalents in C#. That redis client looks solid, so I may got a bit carried trying to prove a point. The Postgres driver looks good too, but is not officially maintain by the PG team so it could evaporate some day. The Java equivalent IS an official Postgres driver. I see this with C# frequently, it's treated as second class by a lot of OSS projects. You didn't make a counterpoint to Lucene, I assume because there was really no equal out there for C#. These days tying your language to Windows, visual studio, and IIS is unforgivable. MS is trying to undo this with .NET core but for the time being I find it rediculous to need to pay for all these licenses. If my employer wasn't paying for my enterprise edition of VS and copies of IIS, Windows Server, and SQL Server I wouldn't be touching C# at all. At home I use OpenJDK with eclipse and Dropwizard running on Linux with Postgres. The quality of the tech is the same and everything is free and open source.
- maxxxxx 10y ago
  I did a project around full text search and the amount of libraries in Java was just staggering whereas with .NET you often only had some half baked port that was way out of date. I don't think too many researchers do their stuff in .NET. It's Java or something like Python.

kuschku 10y ago

I’m sorry, could you expand on that? I’m not sure if I’m understanding you correctly, that you’re saying Java is slower than .NET, and the JVM more vulnerable than the CLR?

Pharylon 10y ago
Lat time I played with Java was in 2015. It seemed like there was a new JVM zero-day every month, and every time I upgraded, the Java installer tried to install the Ask toolbar. After that, I started joking that installing malware one way or the other was Oracle's primary goal.
- maxxxxx 10y ago
  Considering that Java runs on many more servers than .NET it can't be that bad.
  - tracker1 10y ago
    Compared to most of today's more recent frameworks, that doesn't mean it's actually great. And while I appreciate the direction of .Net (Core), I am hoping the integrated tooling story gets a bit better (outside VS for windows). Code is okay, but not great, and other editors are mostly non-starters. Installing VS for Mac was a horrible experience that had to be done via manual steps for all the dependencies, etc. My understanding is Java tooling has gotten better, but being able to setup a hello world application in Java, or any established application without a ton of weird dependencies to discover always seemed painful, and "Enterprise" .Net applications didn't feel much better. Today, my world tends to mostly center around Node.js and git... I've dipped my feet into some new .Net bits, and a little bit of go, and that's about it. I find the learning curve steep, but the actual implementation WTFs are nearly non existent. With Java/.Net it's always been a relatively steep learning curve (worse with Java) and a lot of WTFs along the way.
    - kuschku 10y ago
      Eh, lol? Setting up new applications in Java or .NET is by far easier than Node.JS. It's Node.JS where you need 400 dependencies just to use the latest version of the language. That said, there's many easy to use and simple frameworks for Java, and you can try also other JVM languages such as Kotlin, Clojure, Scala or Eta. The JVM hosts the most powerful and fastest managed languages at the moment (via eta and clojure also allowing haskell and lisp on the JVM). .NET is nice, but there's quite a few reasons why Java is used everywhere.

MichaelGG 10y ago

Can you name a few specific examples of where you are using .NET/CLR that Java would have introduced security holes? Basically all the high profile ones that people think of are code-loading issues, similar to XBAP and other .NET tech's bugs. In other words, the "Java insecure" meme applies to very little actual Java dev.

skrowl 10y ago
You have to install a whole extra runtime on all of your servers, including production internet-facing servers to use Java. If you can't see that would add to your potential attack surface, I can't help you.
- merb 10y ago
  you also need to install the .net runtime on all of your servers.
- MichaelGG 10y ago
  Please list a few remote access vulnerabilities caused by the JVM and not app.
cm2187 10y ago
I don't know about security but the fact that the java installer tries to install crapware or change my browser settings doesn't do much for its reputation.
mpeg 10y ago
Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using a java library to do one specific thing related to file uploads, despite all their code being .NET. The library became a bit of a black box and no one bothered to keep up with updating it as it was essentially a binary blob that sit outside the normal update mechanisms (visual studio references) Turns out the library had patched a RCE vulnerability a while back, spent a fun afternoon making a PoC exploit for it (tricky because we had some other file validation in place) to win the unofficial office competition to find a security hole in our product. I would agree with your point in general, but the moral of the story is that adding complexity is not good considering most people are too lazy/incompetent to understand the full implication of something like "I'll just use a third party binary / library here" to their ongoing maintenance.

emodendroket 10y ago

I don't think Java is really much slower than .NET code.

venture_lol 10y ago
What makes you think it is even slower? Care to show real numbers?
- emodendroket 10y ago
  I don't.
shouldbworking 10y ago
It's faster. The JVM is almost always faster than the CLR, look at the techempower framework shootouts. .NET core is fast but regular .NET get destroyed by multiple Java frameworks.
- Haldir 10y ago
  The techempower Benchmarks are related to ASP.NET core, that one you can use on Desktop too. The coreclr is only maybe 10-15% faster than Desktop, but not a magnitude or more compared to old ASP.net. I don't think that the clr is slower than the jvm, but quite a few basic frameworks are compared to their Java counterparts
  - shouldbworking 10y ago
    Look at the older techempower benchmarks where they include the regular .NET framework. It's slow as hell compared to java. And yes that's the problem. The CLR itself probably isn't slower than JVM but most of the .NET stack is. It just wasn't written with performance in mind.
    - emodendroket 10y ago
      > The CLR itself probably isn't slower than JVM but most of the .NET stack is. It just wasn't written with performance in mind. I don't really think that's true.

rsynnott 10y ago

Java code is, of course, managed. In any case, this isn't a wrapper for Java code running in a JVM; it's an implementation of Java for the CLR. Not sure what makes you think Oracle's JVM is slower than the CLR, in any case...

venture_lol 10y ago

Yeah, because as a .NET developer, you would not of course know all about Java :) Right, tell me the ecosystem of .NET vs Java and deployment statistics...