5 ms·

From the article: "The ultimate irony of this attack is that the owner of mysql.com is Oracle Corp., which also owns Java, a software suite that I have often ad

From the article: "The ultimate irony of this attack is that the owner of mysql.com is Oracle Corp., which also owns Java, a software suite that I have often advised readers to avoid due to its numerous security and update problems." Seriously, I'm not a fan of Java, but still, a software suite? Anyway, it's quite hard taking that article seriously after that.

46Bit 15y ago
Well from the point of view of your typical end users, Java is just a random bit of software.
pnathan 15y ago
Java has security problems? That is surprising to me. I have always considered it a relatively secure platform... am I so wrong?
- code_duck 15y ago
  I'm pretty sure they're exhibiting confusion about the JVM vs. the browser plugin.
  - srazzaque 15y ago
    Agreed - this has very little to do with the JVM and server-side Java processes. Java applets.. shudder
    - ars 15y ago
      A bug (exploit) in the JVM is a bug, it doesn't matter if you are running it server side or client side. The only reason it doesn't matter server-side is that you are not trying to exploit your own installation. But the bug is still there.
      - srazzaque 15y ago
        Of course, the JVM is the JVM wherever it runs, but when one is under the impression of a blanket statement like "Java is secure", they're likely to be thinking of server-side processes which rarely get compromised for reasons you've stated - despite having the same "level of security" wrt vulnerabilities.
        ars 15y ago
        You don't know that. Depending on the type of bug (for example a string overflow) simply accepting data from someone else could trigger it.
- wanorris 15y ago
  Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits, along with Adobe products. I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target. Edit: here's one sample article from last year: http://isc.sans.edu/diary.html?storyid=9916 http://isc.sans.edu/diary.html?storyid=9916
- gojomo 15y ago
  Did you update all your Java installations – client and server – to at least Java 6 update 26 in June 2011? There were a dozen "unauthorized Operating System takeover including arbitrary code execution" bugs fixed at that time, some exploitable via untrusted applets, others via tricking server installs to submit certain data to standard APIs: http://www.oracle.com/technetwork/topics/security/javacpujune2011verbose-313350.html http://www.oracle.com/technetwork/topics/security/javacpujun...
  - ldite 15y ago
    I've had the Java plugin disabled in firefox for a long time now. On the very rare occasions I need it, you can re-enable it without restarting the browser (unlike extensions.)
guelo 15y ago
Get off your high horse. An installation of the JRE on Windows will install the Java VM, plugins for several browsers, a Java update scheduler, the Java Web start framework, a control panel and a bunch of other related utilities. In other words, a software suite.

46Bit 15y ago

Well from the point of view of your typical end users, Java is just a random bit of software.

pnathan 15y ago

Java has security problems? That is surprising to me. I have always considered it a relatively secure platform... am I so wrong?

code_duck 15y ago
I'm pretty sure they're exhibiting confusion about the JVM vs. the browser plugin.
- srazzaque 15y ago
  Agreed - this has very little to do with the JVM and server-side Java processes. Java applets.. shudder
  - ars 15y ago
    A bug (exploit) in the JVM is a bug, it doesn't matter if you are running it server side or client side. The only reason it doesn't matter server-side is that you are not trying to exploit your own installation. But the bug is still there.
    - srazzaque 15y ago
      Of course, the JVM is the JVM wherever it runs, but when one is under the impression of a blanket statement like "Java is secure", they're likely to be thinking of server-side processes which rarely get compromised for reasons you've stated - despite having the same "level of security" wrt vulnerabilities.
      - ars 15y ago
        You don't know that. Depending on the type of bug (for example a string overflow) simply accepting data from someone else could trigger it.
wanorris 15y ago
Lately, yes. Over the last couple of years (Read: after Microsoft mostly cleaned up its act), Java has been been one of the primary sources of client exploits, along with Adobe products. I don't know that there's anything special wrong with it other than that anything deployed widely enough makes a good target. Edit: here's one sample article from last year: http://isc.sans.edu/diary.html?storyid=9916 http://isc.sans.edu/diary.html?storyid=9916
gojomo 15y ago
Did you update all your Java installations – client and server – to at least Java 6 update 26 in June 2011? There were a dozen "unauthorized Operating System takeover including arbitrary code execution" bugs fixed at that time, some exploitable via untrusted applets, others via tricking server installs to submit certain data to standard APIs: http://www.oracle.com/technetwork/topics/security/javacpujune2011verbose-313350.html http://www.oracle.com/technetwork/topics/security/javacpujun...
- ldite 15y ago
  I've had the Java plugin disabled in firefox for a long time now. On the very rare occasions I need it, you can re-enable it without restarting the browser (unlike extensions.)

guelo 15y ago

Get off your high horse. An installation of the JRE on Windows will install the Java VM, plugins for several browsers, a Java update scheduler, the Java Web start framework, a control panel and a bunch of other related utilities. In other words, a software suite.