3 ms·

Oracle is becoming a parody of itself. Can they just hand off the entire Java platform to a capable 3rd party already?

• tptacek 14y ago
  Did Oracle introduce these bugs?
  • gchpaco 14y ago
    Have they been permitting anyone who isn't oracle affiliated to work on the sandbox? I was under the impression that the core development and compiler work was all in house.
    • tptacek 14y ago
      Are you sure these bugs are new? The Java Applet Sandbox doesn't exactly have a spotless security history.
      • saurik 14y ago
        One of the bugs is fairly old, the other (which is required for the overal exploit) is new-ish (introduced in Java 7), but probably not as new as saosebastiao was implying (as the title of this HN post can be parsed as "the bugs were introduced by the patch attempting to fix the other bugs", which is definitely not the case, AFAICT). > Issue 51 affects both Java SE 6 and 7. Issue 52 is for Java SE 7 only. Since both issues are required for the attack to succeed, we treat it as Java 7 specific only. -- http://seclists.org/fulldisclosure/2013/Jan/195 http://seclists.org/fulldisclosure/2013/Jan/195
  • benmmurphy 14y ago
    These bugs may have been added to the source code by Sun before Oracle acquired Sun. However, the first released version of Java that came with these bugs was done by Oracle. Just to add I'm referring to latest zero day bugs and not the ones found by Gowdiak.