3 ms·

2-3 years is pretty old. Java backward compatibility is really good, even better when it's on the same major I don't see why you shouldn't update. You have a d

2-3 years is pretty old. Java backward compatibility is really good, even better when it's on the same major I don't see why you shouldn't update. You have a docker image with java, just pull the base image before you build, you run it bare you/need to update the server packages periodically, better if you have unattended update setup (default in recent ubuntu versions tho might need a server restart for some to apply) It's not like between java updates there aren't any security fixes, there are so you should update. Nevertheless other mitigations like not exposing internal services to the internet would have blocked these attempts.

justinclift 5y ago
> 2-3 years is pretty old. In the JS or NodeJS world, sure. For pretty much everyone else, not so much.
- TheGuyWhoCodes 5y ago
  I wasn't talkin about a 3rd party library, Java is your runtime platform it has security fixes roll out. If you are an enterprise company that runs 3 year old java version then 1) Your CSO and CIO should all be fired 2) Your security team should be replaced 3) Your ISO 27001 and SOC2 certification among others should be revoked
  - raggi 5y ago
    Glass houses: https://snyk.io/vuln/npm:lodash@4.17.15 https://snyk.io/vuln/npm:lodash@4.17.15 / http://ariagno.com/spotify/ http://ariagno.com/spotify/
  - madeofpalk 5y ago
    Until two months ago the LTS release of Java - Java 11 - was 2 years old.
    - TheGuyWhoCodes 5y ago
      Not sure what you are talking about. Java 11 was released on 2018-09-25 Java 11.0.2 that contained the "fix" was released on 2019-01-15 Java 11.0.13 (latest) was released on 2021-10-19 Also Java 8u192 was released on 2018-10-16
      - alanfranz 5y ago
        I think you and parent(s) kept exchanging messages which conflated major and minor Java versions. Java 11 as a major is not old, it’s probably the best GA version right now, 17 is at a very early adoption stage. Openjdk 11.0.0 would be too old, though.
  - yjftsjthsd-h 5y ago
    If it's an enterprise running a 3y old JVM, what makes you think they have a CSO, CIO, or security team?
- Gigachad 5y ago
  For internet connected software, it's pretty old. If you don't update for 3 years and expect to still be secure, you are in for a shock.
  - actuallyalys 5y ago
    Obviously you shouldn't go three years without security patches. But it's perfectly reasonable to not update to a new major version for three years.
- charrondev 5y ago
  Not keeping up with patch versions of your runtime. As other comments mentioned even with a patched JDK you are still vulnerable in other ways, but the specific method this whole thread is about seems to have patches in Java 8 and 11 releases. I understand that lagging new major releases by years and be prudent for different apps, but there is no excuse not to be updating your patch versions.
thrower123 5y ago
Something that's 2-3 years old maybe has enough bugs worn off it by the early adopters that enterprise users might start thinking about maybe using it in Q4 of next year. After a massive pilot program to do a test rollout and lab deployment.
deleted 5y ago
[deleted]

justinclift 5y ago

> 2-3 years is pretty old. In the JS or NodeJS world, sure. For pretty much everyone else, not so much.

TheGuyWhoCodes 5y ago
I wasn't talkin about a 3rd party library, Java is your runtime platform it has security fixes roll out. If you are an enterprise company that runs 3 year old java version then 1) Your CSO and CIO should all be fired 2) Your security team should be replaced 3) Your ISO 27001 and SOC2 certification among others should be revoked
- raggi 5y ago
  Glass houses: https://snyk.io/vuln/npm:lodash@4.17.15 https://snyk.io/vuln/npm:lodash@4.17.15 / http://ariagno.com/spotify/ http://ariagno.com/spotify/
- madeofpalk 5y ago
  Until two months ago the LTS release of Java - Java 11 - was 2 years old.
  - TheGuyWhoCodes 5y ago
    Not sure what you are talking about. Java 11 was released on 2018-09-25 Java 11.0.2 that contained the "fix" was released on 2019-01-15 Java 11.0.13 (latest) was released on 2021-10-19 Also Java 8u192 was released on 2018-10-16
    - alanfranz 5y ago
      I think you and parent(s) kept exchanging messages which conflated major and minor Java versions. Java 11 as a major is not old, it’s probably the best GA version right now, 17 is at a very early adoption stage. Openjdk 11.0.0 would be too old, though.
- yjftsjthsd-h 5y ago
  If it's an enterprise running a 3y old JVM, what makes you think they have a CSO, CIO, or security team?
Gigachad 5y ago
For internet connected software, it's pretty old. If you don't update for 3 years and expect to still be secure, you are in for a shock.
- actuallyalys 5y ago
  Obviously you shouldn't go three years without security patches. But it's perfectly reasonable to not update to a new major version for three years.
charrondev 5y ago
Not keeping up with patch versions of your runtime. As other comments mentioned even with a patched JDK you are still vulnerable in other ways, but the specific method this whole thread is about seems to have patches in Java 8 and 11 releases. I understand that lagging new major releases by years and be prudent for different apps, but there is no excuse not to be updating your patch versions.

thrower123 5y ago

Something that's 2-3 years old maybe has enough bugs worn off it by the early adopters that enterprise users might start thinking about maybe using it in Q4 of next year. After a massive pilot program to do a test rollout and lab deployment.

deleted 5y ago

[deleted]