3 ms·
There is absolutely nothing which has that level of vulnerability and lack of security on a modern network. OK, let's say I overwrite part of your system with
by gaius 8y ago
There is absolutely nothing which has that level of vulnerability and lack of security on a modern network.
OK, let's say I overwrite part of your system with something evil, knowing that your app will Class.forName() it. Is that a problem with the ClassLoader or is the problem that your perimeter is already compromised anyway?
- wepple 8y agoI don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda agree with Oracles approach here: kill serialization, make things more secure. If they have to change core language/libraries, so be it. You were trying to say that anything left on a network socket will be compromised, and that’s simply not true. Most software is pretty solid. Anything in C will have more than it’s fair share of upcoming patches, but unlike Java serialization, you can’t fix a single lib to fix 99% of bugs.. or we would’ve surely done that.