4 ms·

It almost sounds like Oracle managed to shoo away all good folks from the JVM team and all they are left with is a bunch of B players. I dont remember it being

• brown9-2 14y ago
  If the vulnerability exists in Java 5, 6 and 7, it seems likely that the underlying problem is pretty old and not a recent development. Version 1.5.0_22 seems to have been released some time around 2009, and that was the end-of-life release for "Java 5" - it's earlier versions were years before this.
  • blinkingled 14y ago
    Good point - but still, isn't it taking Oracle longer to patch the vulnerabilities? (Last one they knew for what - 4 months?)
    • eckyptang 14y ago
      This is normal for Oracle and has been for at least 20 years. They are too busy milking people for new contracts rather than looking after their existing customers.
• stephen 14y ago
  Given what I've seen lately, this is just false. The Java team under Oracle, despite my trollish expectations, is actually doing really well. That they've inherited a huge, complex codebase is unfortunate. I think any program or VM, Ruby, Flash, Python, whatever would end up with the same number of security holes if it had the user base to attract attention from hackers.
  • void-star 14y ago
    Not to diminish your point about Oracle's handling of their inherited codebase (too much). I kindof agree... But, it bears mentioning that Ruby and Python aren't a mainstream part of browsers. And Flash (under Adobe) has actually done some pretty impressive stuff recently with regard to sandboxing.