4 ms·
Java doesn't make exploitable RCEs more or less possible than any other programming language. Or do you have something to back this up beyond the common "Java b
by chockchocschoir 5y ago
Java doesn't make exploitable RCEs more or less possible than any other programming language. Or do you have something to back this up beyond the common "Java be bad" trope?
- formerly_proven 5y agoJava certainly has a long history of RCEs caused by Java Serialization.
- chockchocschoir 5y agoComparing Java Serialization with $language Serialization, and the usage of both of the languages, does Java have more RCEs per line written than $language? Or is it just a function of its popularity?
- xmodem 5y agoThe java ecosystem has a frustrating habbit of solving problems with java's lack of expressiveness with layers of expression and templating languages, and has had some nasty RCE's as a result. (see: OGNL, freemarker) I don't know if it's better or worse than other languages but let's not pretend it's not a problem.