4 ms·

Can you name a few specific examples of where you are using .NET/CLR that Java would have introduced security holes? Basically all the high profile ones that pe

Can you name a few specific examples of where you are using .NET/CLR that Java would have introduced security holes? Basically all the high profile ones that people think of are code-loading issues, similar to XBAP and other .NET tech's bugs. In other words, the "Java insecure" meme applies to very little actual Java dev.

skrowl 10y ago
You have to install a whole extra runtime on all of your servers, including production internet-facing servers to use Java. If you can't see that would add to your potential attack surface, I can't help you.
- merb 10y ago
  you also need to install the .net runtime on all of your servers.
- MichaelGG 10y ago
  Please list a few remote access vulnerabilities caused by the JVM and not app.
cm2187 10y ago
I don't know about security but the fact that the java installer tries to install crapware or change my browser settings doesn't do much for its reputation.
mpeg 10y ago
Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using a java library to do one specific thing related to file uploads, despite all their code being .NET. The library became a bit of a black box and no one bothered to keep up with updating it as it was essentially a binary blob that sit outside the normal update mechanisms (visual studio references) Turns out the library had patched a RCE vulnerability a while back, spent a fun afternoon making a PoC exploit for it (tricky because we had some other file validation in place) to win the unofficial office competition to find a security hole in our product. I would agree with your point in general, but the moral of the story is that adding complexity is not good considering most people are too lazy/incompetent to understand the full implication of something like "I'll just use a third party binary / library here" to their ongoing maintenance.

skrowl 10y ago

You have to install a whole extra runtime on all of your servers, including production internet-facing servers to use Java. If you can't see that would add to your potential attack surface, I can't help you.

merb 10y ago
you also need to install the .net runtime on all of your servers.
MichaelGG 10y ago
Please list a few remote access vulnerabilities caused by the JVM and not app.

cm2187 10y ago

I don't know about security but the fact that the java installer tries to install crapware or change my browser settings doesn't do much for its reputation.

mpeg 10y ago

Hey I have a real world example, it's not a problem with the JVM but with the way JVM interop would work for a .NET shop. A company I was working at was using a java library to do one specific thing related to file uploads, despite all their code being .NET. The library became a bit of a black box and no one bothered to keep up with updating it as it was essentially a binary blob that sit outside the normal update mechanisms (visual studio references) Turns out the library had patched a RCE vulnerability a while back, spent a fun afternoon making a PoC exploit for it (tricky because we had some other file validation in place) to win the unofficial office competition to find a security hole in our product. I would agree with your point in general, but the moral of the story is that adding complexity is not good considering most people are too lazy/incompetent to understand the full implication of something like "I'll just use a third party binary / library here" to their ongoing maintenance.