3 ms·
Well, Java in its very core idea is supposed to be safe in the first place, because of the restrictive programming model that leads also to problems in efficien
by dakimov 14y ago
Well, Java in its very core idea is supposed to be safe in the first place, because of the restrictive programming model that leads also to problems in efficiency. And if the entire idea of abstraction and safety does not work, what's the point of Java overall? I'd better use C++ then.
- MichaelGG 14y agoWhat's being exploited is an insecure API. Can you explain how this is different than finding a bug in a browser's JS implementation, or finding a kernel bug that lets you perform local escalation of privilege?
- dakimov 14y agoIt's simple. Java inventors/developers once said: this new language is entirely safe because it runs on a virtual machine and prohibits any insecure operations, maybe a bit slow, but now we will finally get rid of all the buffer overruns and similar security breaches that we were so used to with the good old C/C++. It's safe now! And here we go again, exploits are routinely found in what used to be the totally safe and isolated environment. C/C++ can be safe and reliable as well, except infrequent bugs and exploits — you cannot absolutely get rid of bugs, because what involves the humans will never be solved at 100%. But in this case Java and native code appear the same from the security perspective: exploits are found here and there. What's the point of Java then entirely? What does it give except slowdown, memory consumption and restrictions? Personally I believe the only proper way to implement security isolation is with hardware support. Native/sandboxed/virtual machine — does not matter, It is proven now by Java's fail.