3 ms·
Java and trivially exploitable RCE are certainly believable.
by formerly_proven 5y ago
Java and trivially exploitable RCE are certainly believable.
- chockchocschoir 5y agoJava doesn't make exploitable RCEs more or less possible than any other programming language. Or do you have something to back this up beyond the common "Java be bad" trope?
- formerly_proven 5y agoJava certainly has a long history of RCEs caused by Java Serialization.
- chockchocschoir 5y agoComparing Java Serialization with $language Serialization, and the usage of both of the languages, does Java have more RCEs per line written than $language? Or is it just a function of its popularity?
- xmodem 5y agoThe java ecosystem has a frustrating habbit of solving problems with java's lack of expressiveness with layers of expression and templating languages, and has had some nasty RCE's as a result. (see: OGNL, freemarker) I don't know if it's better or worse than other languages but let's not pretend it's not a problem.
- Traubenfuchs 5y agoAs compared to which language that does it significantly better? https://www.sourceclear.com/vulnerability-database https://www.sourceclear.com/vulnerability-database Everything is a mess, no matter the language.