10 ms·

Oracle knew about critical Java flaws since April

179 points by amboar 14y ago

Joeboy 14y ago
Why is java still enabled in browsers by default anyway? Who would notice its absence in 2012?
- slig 14y ago
  There're some banks that still need them. The irony is that, since their applet is signed, the user must click and confirm that he trusts the thing every time. Hackers can leverage that users won't read a damn thing, they will just click next to build an applet with file system access. Why exploit flaws when users will simply click a trust your applet? I don't trust my bank with a signed applet (why the hell do they need that?), so obviously I only access my internet banking using a VM.
  - rbanffy 14y ago
    > I only access my internet banking using a VM Smart thing to do. Also, you can make the VM disk reset itself to a base state on every boot.
- PostOnce 14y ago
  Chrome asks for permission for Java to run, by default: http://support.google.com/chrome/bin/answer.py?hl=en&answer=1247383 http://support.google.com/chrome/bin/answer.py?hl=en&ans...
  - amanvir 14y ago
    I think they should start doing that in Firefox too
    - ZoFreX 14y ago
      They are working on it - the feature exists, but isn't currently exposed through the GUI configuration as it has some issues. You can go to "about:config" and enable the option "plugins.click_to_play" if you want to see it. I disabled it as it caused issues with Flash for me, but I've straight up disabled the Java plugin anyway.
    - omh 14y ago
      Firefox has a separate feature which can completely disable plugins which are known to be malicious or vulnerable. The current list is at https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ They've definitely used this to block older Java versions, but in those cases there was always a newer version available that you could use instead.
      - justinschuh 14y ago
        Plugin management is actually a bit complicated, and in the case of Chrome we've had mulitple levels of it for years. The simplest is click-to-play, where the plugin is replaced with a graphic in the page that you can click to run it. This is the most convenient, but is vulnerable to click-jacking or other trickery. Then there's plugin blocking, which doesn't have the click-to-play weaknesses but is less convenient because you need to enable the plugin through a browser control (ie. infobar, page action, or context menu). Finally there's disabling, which just prevents the plugin from running at all. For out-of-date and perennially vulnerable plugins (like Java) Chrome uses the second mode, which blocks the plugin unless the user accepts it through an infobar. It's not a perfect defense, but we've found it to be extremely effective at preventing exploits because the vast majority of the users don't let the potentially vulnerable plugin run. I'd really like to see this approach catch on more broadly, but other browser makers are understandably cautious about how they should handle plugins.
        omh 14y ago
        As a corporate sysadmin, I should say that the Chrome method is much better than the Firefox one. We often have slightly out of date plugins, simply because it takes a while to get new versions tested and rolled out. When Firefox blocks them it breaks functionality and can cause a few awkward problems. Generally that just means that the user will use IE instead, so the protection is lost.
        justinschuh 14y ago
        I wasn't aware the blocking worked that way in Firefox. We considered going that route as well, but in our testing the optional block was nearly as effective as fully disabling.
    - justinschuh 14y ago
      I talked to some of the Mozilla security guys about it back in February at CanSecWest, since we've been blocking out-of-date and dangerous plugins (more than just Java) for a while in Chrome. They seemed in favor of doing it, so it's definitely on their radar.
  - dminor 14y ago
    Personally I think they should ship with 'Block All' as the default in the plugins settings.
    - TazeTSchnitzel 14y ago
      I already have click-to-run turned on for Flash due to it screwing up page rendering in Chrome on Linux.
- hucker 14y ago
  I don't know how it works in the US, but in Norway most online banks can only be accessed through a Java applet where you enter SSN, password and token-code. Extremely frustrating since whether it works or not in Linux seems like a function of the day of the week, and, well, it's a Java applet.
  - rodolphoarruda 14y ago
    We have the same scenario in Brazil.
    - franze 14y ago
      well, in brazil you even have gbieh.dll - an undeletable, unkillable, always running, mysterious, "security" file/process from banco do brasil. http://www.file.net/process/gbieh.dll.html http://www.file.net/process/gbieh.dll.html that's even (slightly) worse than a java applet.
      - rodolphoarruda 14y ago
        yeah, Banco Itaú has its own DLL too. http://rodolphoarruda.pro.br/d/dll.jpg http://rodolphoarruda.pro.br/d/dll.jpg
        slig 14y ago
        Can't tell if trolling or not. That's an URL and they can name it with whatever name they want (.dll, 1761,1238,196.htm, .php, etc), and has absolutely nothing to do with an actual process running on your machine.
        ioquatix 14y ago
        Why don't you just switch to another Bank?
        b-man 14y ago
        No so easy mate. Brazil has one of the largest bank concentration in the world, orchestraded of course by the central bank. We have the choice of 6 major banks, in this order of size -> Banco do Brasil, Itaú, Bradesco, BNDES, Caixa Econômica Federal, Santander They are all highly regulated and with very little incentive to innovate. So they can screw around and do pretty much nothing at all. The fascist/socialist banking system that exists across the globe is even more pronounced here. For those of you that can read portuguese, I recommend this article: http://www.mises.org.br/Article.aspx?id=1387 http://www.mises.org.br/Article.aspx?id=1387
- amboar 14y ago
  Yeah I don't even remember the last time I used a Java applet. I've disabled the plugins without any repercussions so far.
- justincormack 14y ago
  All those online meeting and screen sharing things that are so popular in the enterprise world...
- raesene2 14y ago
  Most corporates that I've seen make heavy use of Java applet based software for internal software (and have multiple versions installed as a result). Also I've seen a fair number of administrative interfaces for IT kit that work via Java Applets...
- hoogaguy 14y ago
  exactly my word.
- driverdan 14y ago
  I've had Java disabled in browsers for a long time and click to activate for other plugins. I've never noticed its absence. I understand from other comments that banks in some require Java. I have or have had accounts or credit cards with nearly all major banks in the USA and many smaller institutions and none have required any plugins. Some require 3rd party cookies to use services like bill pay or ACH transfers.
- abrahamsen 14y ago
  Danes. It is used by the government electronic id system (nemid), and is the only way to e.g. make corrections to your tax returns (they are by default filled by the tax authority). Most government and many private (e.g. banks) institutions use it. https://www.nemid.nu/om_nemid/about_nemid/ https://www.nemid.nu/om_nemid/about_nemid/
  - diminoten 14y ago
    Then enable it for those sites. Defaulting to enabled seems like overkill. On the other hand, I'm pretty sure my browser asks me every time it wants to run an applet, so I think that as current behavior is fine.
- Jamiecon 14y ago
  Anyone that wants to administer HP network gear via a web interface, to pick one example. But yeah, I take your point.
- danielweber 14y ago
  I have successfully avoided installing Java on many machines, even when installing browsers. The had to break down when it came time to build Android apps.
- zvrba 14y ago
  Norwegians. The BankID system is used by many online banking systems for 2-factor authentication.
beedogs 14y ago
If ever there were a language which was crying out to be open-sourced...
- eckyptang 14y ago
  I thought it already was (OpenJDK)?
  - papercrane 14y ago
    Most of the hotspot VM along with all of the standard library is GPL (plus a classpath exception for the library,) but the JVM that Oracle ships has some closed source additions. Not sure what the final status of their JRockit + Hotspot merge is going to be though.
    - Legion 14y ago
      I'm not too up on the Java world, but starting to poke my toe in with my interest in JRuby and Clojure. So forgive me if this is a dumb question: what is the nature of the Oracle closed source extensions? Are they anything I'm going to care about in playing with JVM languages, or deploying apps in a web startup (ie. non-corporate) environment?
      - papercrane 14y ago
        Nothing you'll miss in those contexts. Most of what is closed source is code that 3rd parties wrote and Sun couldn't open source (code java.awt relies on mostly.) For the actual JVM I don't think there is anything big missing, except maybe some support for SPARC. The big question will be what happens in the future when they start merging JRockit with Hotspot. JRockit has quite a few extensions for monitoring that I think Oracle will keep closed (and expensive.)
      - brazzy 14y ago
        AFAIK it's rather the other way round: the original Sun JDK contained some third party components that could not be released under the GPL. OpenJDK is the result of going through everything and making sure all those parts are replaced with clean-room reimplementations. Note that starting with Java 7, OpenJDK is the reference implementation.
mikle 14y ago
I love when companies behave like that. It just leaves so much room for the small guys to distinguish themselves as better. In a perfect world bugs won't exist. Less perfect - they will be dealt with as soon as someone notifies the company (and there will be no blame on that someone). Our world isn't perfect, but as an optimist I see many great business opportunities in this.
- amboar 14y ago
  I'm sure crackers and scammers think so too ;)
  - mikle 14y ago
    Or in this case botnet operators. They are entrepreneurs too, just less ethical. It is unfortunate that they exist, but once again the optimist keeps saying that their existence is great because they create problems for smart and ethical people to solve.
- alttag 14y ago
  Not just the small guys. Behavior like this may have (in part) led Apple to ignore Adobe's Flash. Five years later, Flash is dying a slow death.
  - ConstantineXVI 14y ago
    Apple stopped caring about Java a long time ago. They deprecated the Java bindings for Cocoa back in '05; stopped bundling it in 10.7 last year, now they've punted the OSX JVM back to Oracle. Not to say that really matters to Oracle, the desktop has never been Java's strong point.
brudgers 14y ago
"Much like Microsoft's "Patch Tuesday," Java's slow-but-steady patch schedule is designed to give enterprise customers time to properly test the fixes before deploying them." Microsoft does not wait for Patch Tuesday when there is a zero day exploit. Or at least not always, as the article implies.
- omh 14y ago
  When Oracle were originally informed about it in April it wasn't a zero day. They could have rolled out a fix on their next scheduled update and it would have been patched for everyone before it became public.
  - ta12121 14y ago
    No, but it could have been without them knowing it. Just because an exploit hasn't been found and publicized by a security firm, doesn't mean black hats couldn't have found the bug and been using it without it being widely known.
    - omh 14y ago
      So should we expect vendors to immediately fix all vulnerabilities and release the fixes immediately? That creates a near-constant stream of updates which is difficult for users & sysadmins to manage, and is why Microsoft and others have a "Patch Tuesday". (I know that Oracle didn't do that here, but that's what the GP post was talking about)
      - daeken 14y ago
        I don't think immediate fixes are reasonable, but expecting a <3mo rollout for critical vulnerabilities (such as this one) isn't unreasonable at all. If they plan to fix this in October, that's 6 months; regardless of a 0-day being out or not, that's pretty abysmal. Of course, Oracle is not the only company that does this, but that doesn't make it okay.
      - rapala 14y ago
rplnt 14y ago
This does seem like a security firm trying to shine for a few minutes. I might be wrong, but I would wait for a response from Oracle before bashing them (even more).
rbanffy 14y ago
BTW, is OpenJDK affected?
- diminoten 14y ago
  I don't believe so but I can't cite anything to back that up.
j_baker 14y ago
Much as I hate to get the government more involved in software development, I really wish someone would hold companies accountable for this behavior. Just think of how many peoples' computers are vulnerable to these exploits.
- zurn 14y ago
  That's how it usually works, companies are liable for damages resulting from defective products. Doens't really require any broadening of "government involvement". A lot has been written about software liability, but not much has happened (except lots of countries have adopted US style "EULA click through makes a contract" stupidity) See eg. this article about a staged debate about it between Bruce Schneier and Marcus Ranum at RSA 2012: <http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?id=1202544288549&Will_Software_Liability_Make_Software_Secure&slreturn=20120730142159&#62 http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?i...;
Zenst 14y ago
Given Oracles tardiness in fixing a remote security issue with there database product this year and they make alot of $ from that product then this is not a supprise. Why woulc Oracle be so tardy in fixing security issues is the big question as it appears there approach recently is: 1) get told of a security issue. 2) ???? 3) Release fix once issue is out in wild/publicly known Given there history and how they got started and there connections thru large contracts then it is not impossible that they were asked to hold back and/or offered to hold back on a patch. Rememebr security issues are more than that these days, they are after all gradualy replaceing Nuclear weapons as they can be used and abused as the fallout is less unferstood and in that they are not the stand-off weapons which nukes are and given that they are opening up entirly new theartes of war. Thing is until Oracle explains there delays in addressing recent security issues in there database and now java, then people will and rightly so speculate as to there motivations in acting in the way they have. [EDIT ADD] some background on Oracles patch approach this year http://www.esecurityplanet.com/network-security/oracle-database-security-flaw-remains-unpatched.html http://www.esecurityplanet.com/network-security/oracle-datab...
- phene 14y ago
  Please learn the difference between "there" and "their."
kaffiene 14y ago
I'm just amazed that this turned into a "we all hate Java" rant. Utterly amazed. I'm sure if all the worlds banks ran on Perl or Ruby, there'd be no bugs ever and the performance would be awesome, and it would run in the browser, too. BTW: I agree with the criticism about Oracle not releasing this fix soon enough (assuming that this is true - it's all hearsay at the moment).

179 points by amboar 14y ago

Joeboy 14y ago

Why is java still enabled in browsers by default anyway? Who would notice its absence in 2012?

slig 14y ago
There're some banks that still need them. The irony is that, since their applet is signed, the user must click and confirm that he trusts the thing every time. Hackers can leverage that users won't read a damn thing, they will just click next to build an applet with file system access. Why exploit flaws when users will simply click a trust your applet? I don't trust my bank with a signed applet (why the hell do they need that?), so obviously I only access my internet banking using a VM.
- rbanffy 14y ago
  > I only access my internet banking using a VM Smart thing to do. Also, you can make the VM disk reset itself to a base state on every boot.
PostOnce 14y ago
Chrome asks for permission for Java to run, by default: http://support.google.com/chrome/bin/answer.py?hl=en&answer=1247383 http://support.google.com/chrome/bin/answer.py?hl=en&ans...
- amanvir 14y ago
  I think they should start doing that in Firefox too
  - ZoFreX 14y ago
    They are working on it - the feature exists, but isn't currently exposed through the GUI configuration as it has some issues. You can go to "about:config" and enable the option "plugins.click_to_play" if you want to see it. I disabled it as it caused issues with Flash for me, but I've straight up disabled the Java plugin anyway.
  - omh 14y ago
    Firefox has a separate feature which can completely disable plugins which are known to be malicious or vulnerable. The current list is at https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ They've definitely used this to block older Java versions, but in those cases there was always a newer version available that you could use instead.
    - justinschuh 14y ago
      Plugin management is actually a bit complicated, and in the case of Chrome we've had mulitple levels of it for years. The simplest is click-to-play, where the plugin is replaced with a graphic in the page that you can click to run it. This is the most convenient, but is vulnerable to click-jacking or other trickery. Then there's plugin blocking, which doesn't have the click-to-play weaknesses but is less convenient because you need to enable the plugin through a browser control (ie. infobar, page action, or context menu). Finally there's disabling, which just prevents the plugin from running at all. For out-of-date and perennially vulnerable plugins (like Java) Chrome uses the second mode, which blocks the plugin unless the user accepts it through an infobar. It's not a perfect defense, but we've found it to be extremely effective at preventing exploits because the vast majority of the users don't let the potentially vulnerable plugin run. I'd really like to see this approach catch on more broadly, but other browser makers are understandably cautious about how they should handle plugins.
      - omh 14y ago
        As a corporate sysadmin, I should say that the Chrome method is much better than the Firefox one. We often have slightly out of date plugins, simply because it takes a while to get new versions tested and rolled out. When Firefox blocks them it breaks functionality and can cause a few awkward problems. Generally that just means that the user will use IE instead, so the protection is lost.
        justinschuh 14y ago
        I wasn't aware the blocking worked that way in Firefox. We considered going that route as well, but in our testing the optional block was nearly as effective as fully disabling.
  - justinschuh 14y ago
    I talked to some of the Mozilla security guys about it back in February at CanSecWest, since we've been blocking out-of-date and dangerous plugins (more than just Java) for a while in Chrome. They seemed in favor of doing it, so it's definitely on their radar.
- dminor 14y ago
  Personally I think they should ship with 'Block All' as the default in the plugins settings.
  - TazeTSchnitzel 14y ago
    I already have click-to-run turned on for Flash due to it screwing up page rendering in Chrome on Linux.
hucker 14y ago
I don't know how it works in the US, but in Norway most online banks can only be accessed through a Java applet where you enter SSN, password and token-code. Extremely frustrating since whether it works or not in Linux seems like a function of the day of the week, and, well, it's a Java applet.
- rodolphoarruda 14y ago
  We have the same scenario in Brazil.
  - franze 14y ago
    well, in brazil you even have gbieh.dll - an undeletable, unkillable, always running, mysterious, "security" file/process from banco do brasil. http://www.file.net/process/gbieh.dll.html http://www.file.net/process/gbieh.dll.html that's even (slightly) worse than a java applet.
    - rodolphoarruda 14y ago
      yeah, Banco Itaú has its own DLL too. http://rodolphoarruda.pro.br/d/dll.jpg http://rodolphoarruda.pro.br/d/dll.jpg
      - slig 14y ago
        Can't tell if trolling or not. That's an URL and they can name it with whatever name they want (.dll, 1761,1238,196.htm, .php, etc), and has absolutely nothing to do with an actual process running on your machine.
      - ioquatix 14y ago
        Why don't you just switch to another Bank?
        b-man 14y ago
        No so easy mate. Brazil has one of the largest bank concentration in the world, orchestraded of course by the central bank. We have the choice of 6 major banks, in this order of size -> Banco do Brasil, Itaú, Bradesco, BNDES, Caixa Econômica Federal, Santander They are all highly regulated and with very little incentive to innovate. So they can screw around and do pretty much nothing at all. The fascist/socialist banking system that exists across the globe is even more pronounced here. For those of you that can read portuguese, I recommend this article: http://www.mises.org.br/Article.aspx?id=1387 http://www.mises.org.br/Article.aspx?id=1387
amboar 14y ago
Yeah I don't even remember the last time I used a Java applet. I've disabled the plugins without any repercussions so far.
justincormack 14y ago
All those online meeting and screen sharing things that are so popular in the enterprise world...
raesene2 14y ago
Most corporates that I've seen make heavy use of Java applet based software for internal software (and have multiple versions installed as a result). Also I've seen a fair number of administrative interfaces for IT kit that work via Java Applets...
hoogaguy 14y ago
exactly my word.
driverdan 14y ago
I've had Java disabled in browsers for a long time and click to activate for other plugins. I've never noticed its absence. I understand from other comments that banks in some require Java. I have or have had accounts or credit cards with nearly all major banks in the USA and many smaller institutions and none have required any plugins. Some require 3rd party cookies to use services like bill pay or ACH transfers.
abrahamsen 14y ago
Danes. It is used by the government electronic id system (nemid), and is the only way to e.g. make corrections to your tax returns (they are by default filled by the tax authority). Most government and many private (e.g. banks) institutions use it. https://www.nemid.nu/om_nemid/about_nemid/ https://www.nemid.nu/om_nemid/about_nemid/
- diminoten 14y ago
  Then enable it for those sites. Defaulting to enabled seems like overkill. On the other hand, I'm pretty sure my browser asks me every time it wants to run an applet, so I think that as current behavior is fine.
Jamiecon 14y ago
Anyone that wants to administer HP network gear via a web interface, to pick one example. But yeah, I take your point.
danielweber 14y ago
I have successfully avoided installing Java on many machines, even when installing browsers. The had to break down when it came time to build Android apps.
zvrba 14y ago
Norwegians. The BankID system is used by many online banking systems for 2-factor authentication.

beedogs 14y ago

If ever there were a language which was crying out to be open-sourced...

eckyptang 14y ago
I thought it already was (OpenJDK)?
- papercrane 14y ago
  Most of the hotspot VM along with all of the standard library is GPL (plus a classpath exception for the library,) but the JVM that Oracle ships has some closed source additions. Not sure what the final status of their JRockit + Hotspot merge is going to be though.
  - Legion 14y ago
    I'm not too up on the Java world, but starting to poke my toe in with my interest in JRuby and Clojure. So forgive me if this is a dumb question: what is the nature of the Oracle closed source extensions? Are they anything I'm going to care about in playing with JVM languages, or deploying apps in a web startup (ie. non-corporate) environment?
    - papercrane 14y ago
      Nothing you'll miss in those contexts. Most of what is closed source is code that 3rd parties wrote and Sun couldn't open source (code java.awt relies on mostly.) For the actual JVM I don't think there is anything big missing, except maybe some support for SPARC. The big question will be what happens in the future when they start merging JRockit with Hotspot. JRockit has quite a few extensions for monitoring that I think Oracle will keep closed (and expensive.)
    - brazzy 14y ago
      AFAIK it's rather the other way round: the original Sun JDK contained some third party components that could not be released under the GPL. OpenJDK is the result of going through everything and making sure all those parts are replaced with clean-room reimplementations. Note that starting with Java 7, OpenJDK is the reference implementation.

mikle 14y ago

I love when companies behave like that. It just leaves so much room for the small guys to distinguish themselves as better. In a perfect world bugs won't exist. Less perfect - they will be dealt with as soon as someone notifies the company (and there will be no blame on that someone). Our world isn't perfect, but as an optimist I see many great business opportunities in this.

amboar 14y ago
I'm sure crackers and scammers think so too ;)
- mikle 14y ago
  Or in this case botnet operators. They are entrepreneurs too, just less ethical. It is unfortunate that they exist, but once again the optimist keeps saying that their existence is great because they create problems for smart and ethical people to solve.
alttag 14y ago
Not just the small guys. Behavior like this may have (in part) led Apple to ignore Adobe's Flash. Five years later, Flash is dying a slow death.
- ConstantineXVI 14y ago
  Apple stopped caring about Java a long time ago. They deprecated the Java bindings for Cocoa back in '05; stopped bundling it in 10.7 last year, now they've punted the OSX JVM back to Oracle. Not to say that really matters to Oracle, the desktop has never been Java's strong point.

brudgers 14y ago

"Much like Microsoft's "Patch Tuesday," Java's slow-but-steady patch schedule is designed to give enterprise customers time to properly test the fixes before deploying them." Microsoft does not wait for Patch Tuesday when there is a zero day exploit. Or at least not always, as the article implies.

omh 14y ago
When Oracle were originally informed about it in April it wasn't a zero day. They could have rolled out a fix on their next scheduled update and it would have been patched for everyone before it became public.
- ta12121 14y ago
  No, but it could have been without them knowing it. Just because an exploit hasn't been found and publicized by a security firm, doesn't mean black hats couldn't have found the bug and been using it without it being widely known.
  - omh 14y ago
    So should we expect vendors to immediately fix all vulnerabilities and release the fixes immediately? That creates a near-constant stream of updates which is difficult for users & sysadmins to manage, and is why Microsoft and others have a "Patch Tuesday". (I know that Oracle didn't do that here, but that's what the GP post was talking about)
    - daeken 14y ago
      I don't think immediate fixes are reasonable, but expecting a <3mo rollout for critical vulnerabilities (such as this one) isn't unreasonable at all. If they plan to fix this in October, that's 6 months; regardless of a 0-day being out or not, that's pretty abysmal. Of course, Oracle is not the only company that does this, but that doesn't make it okay.
    - rapala 14y ago

rplnt 14y ago

This does seem like a security firm trying to shine for a few minutes. I might be wrong, but I would wait for a response from Oracle before bashing them (even more).

rbanffy 14y ago

BTW, is OpenJDK affected?

diminoten 14y ago
I don't believe so but I can't cite anything to back that up.

j_baker 14y ago

Much as I hate to get the government more involved in software development, I really wish someone would hold companies accountable for this behavior. Just think of how many peoples' computers are vulnerable to these exploits.

zurn 14y ago
That's how it usually works, companies are liable for damages resulting from defective products. Doens't really require any broadening of "government involvement". A lot has been written about software liability, but not much has happened (except lots of countries have adopted US style "EULA click through makes a contract" stupidity) See eg. this article about a staged debate about it between Bruce Schneier and Marcus Ranum at RSA 2012: <http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?id=1202544288549&Will_Software_Liability_Make_Software_Secure&slreturn=20120730142159&#62 http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?i...;

Zenst 14y ago

Given Oracles tardiness in fixing a remote security issue with there database product this year and they make alot of $ from that product then this is not a supprise. Why woulc Oracle be so tardy in fixing security issues is the big question as it appears there approach recently is: 1) get told of a security issue. 2) ???? 3) Release fix once issue is out in wild/publicly known Given there history and how they got started and there connections thru large contracts then it is not impossible that they were asked to hold back and/or offered to hold back on a patch. Rememebr security issues are more than that these days, they are after all gradualy replaceing Nuclear weapons as they can be used and abused as the fallout is less unferstood and in that they are not the stand-off weapons which nukes are and given that they are opening up entirly new theartes of war. Thing is until Oracle explains there delays in addressing recent security issues in there database and now java, then people will and rightly so speculate as to there motivations in acting in the way they have. [EDIT ADD] some background on Oracles patch approach this year http://www.esecurityplanet.com/network-security/oracle-database-security-flaw-remains-unpatched.html http://www.esecurityplanet.com/network-security/oracle-datab...

phene 14y ago
Please learn the difference between "there" and "their."

kaffiene 14y ago

I'm just amazed that this turned into a "we all hate Java" rant. Utterly amazed. I'm sure if all the worlds banks ran on Perl or Ruby, there'd be no bugs ever and the performance would be awesome, and it would run in the browser, too. BTW: I agree with the criticism about Oracle not releasing this fix soon enough (assuming that this is true - it's all hearsay at the moment).