8 ms·

What Is Java, Is It Insecure, and Should I Use It?

28 points by maudlinmau5 14y ago

smoyer 14y ago
Here's the money quote: "Java has two parts: the runtime that runs on your computer (and lets you run Java apps), and the browser plug-in that comes along with it. When people talk about Java being insecure, they're talking about the browser plug-in. Java apps themselves aren't inherently insecure, it's the browser plug-in that causes problems." A world in which Java (the run-time) suddenly disappeared would be completely non-functional due to the amount of enterprise software that runs on the JRE. And while Java (the language) is often bashed for it's verbosity, many of the up-and-coming, "cool" languages target the JRE as their run-time environment. Unfortunately, burying that paragraph in a long article and stating "you probably don't need it" is the wrong story to tell. You probably couldn't live (your modern life) without it, but you may not need to have it installed on your computer. EDIT 1: I also should have mentioned that Javascript is not "safe" ... it's "safer" than it used to be because browsers have gotten way better at "sand-boxing" its behavior (I love LocalStorage!). Applets were designed to allow browser-based applications access to the underlying computer's OS, so it should be no surprise that there are more vulnerabilities. And if you think about the biggest attack vectors on the IE browsers (at least the older ones), ActiveX shares this trait (I won't call it a problem). For Android users, you should realize that when you authorize applications to use various features of your phone or tablet, you're explicitly opening holes in Android's default security model (fully sand-boxed). EDIT 2: My favorite quote (so far) on the life-hacker site is "Java does have some legitimate uses (namely Minecraft) ...". The rest of his commentary sounds like the rants typically found in language wars (I won't participate).
- martinced 14y ago
  Spot on. People do not realize that in some countries virtually all the citizen are carrying a Java SmartCard on them at all time (either an ID card or a medical security card). People do not realize that there are billions of devices running Java (like TV decoders) and that Java is even officially part of some specs (e.g. you cannot have a Blu-Ray player without having Java). In addition to basically power the entire banking infrastructure (it's damn near close to impossible to make an electronic payment without having Java involved in the process) and pretty much the entire corporate world, Java also powers a gigantic number of high-target websites (like eBay and FedEx). And even in browsers, without needing applets, Java is also used to generate JavaScript (GWT and ClojureScript being to examples -- at this point ClojureScript still needs the JVM to compile to JavaScript). And Android, of course. Java is going to dwarf COBOL's legacy. Big times. The real sadness here is that the writing was on the wall: any knowledgeable Java programmer knew, 15 years ago, that Java applets were an insecure piece of excremental technology. You don't know how many time I've vomited on Java applet in Usenet's comp.lang.java.programmer years ago, saying how big of a mistake and loss of energy it was... Only to have the likes of Jon Skeet and Roedy Green defending Java applets tooth and nail.
  - drivebyacct2 14y ago
    "TV decoders" written in Java? edit: thanks for the info, repliers.
    - rmrfrmrf 14y ago
      All of Time Warner's Digital Cable boxes, for example.
      - superuser2 14y ago
        Is that why there's 2-3 second lag responding to button presses and biweekly crashed?
        brokenparser 14y ago
        No, programmers can be rushed by management or plain incompetent in any language.
        zoowar 14y ago
        DirecTV has similar lags at times. I would love for them to open source the UI and allow hackers to fix and impove it.
        _djo_ 14y ago
        There are many embedded devices running Java that are quick and efficient, so whatever slowness those cable boxes have is not due to the technology used. It's probably due to the same organisational problems that cause all slow and bloated software. In the case of cable or satellite TV decoders there's usually more focus from management on adding features fast than on making the software bulletproof.
    - OGC 14y ago
      http://en.wikipedia.org/wiki/BD-J http://en.wikipedia.org/wiki/BD-J http://en.wikipedia.org/wiki/Multimedia_Home_Platform#DVB-J http://en.wikipedia.org/wiki/Multimedia_Home_Platform#DVB-J
  - 14y ago
- taeric 14y ago
  Well, to be fair, I think the answer is essentially, "if you do not know why you need it, then you probably do not need it." This is true for pretty much everything on your computer.
  - mich41 14y ago
    Tell this to somebody who doesn't know what kernel is for. Your computer contains lots of stuff you use daily without being aware of it.
    - taeric 14y ago
      I had a feeling I would get that counter point. I would presume that folks can educate themselves on things. I realize that is an optimistic stance that is not shared by the majority around here.
      - blaabjerg 14y ago
        They can, but assuming that people (can) have a perfect understanding of all the technology they use in their daily life is not only optimistic, it is entirely unrealistic.
        taeric 14y ago
        True, but if you hear that folks are having concerns with item X, and you see you have item X, then you should make sure you know why you have it. Hell, I'd consider that to be extended to non computer things, honestly.
    - smoyer 14y ago
      When my eldest children were about 6 and 4 respectively, we got a Windows 98 computer that they could use at home. One of the things I love about kids and computers is that they're fearless. They learn through trial-and-error without the slightest hesitation. In contrast, teaching your parents to use the computer is full of questions about whether they're "allowed" to do something. Anyway, my daughter (four years old at the time) got a new game (probably educational) and when she tried to run it, she was told there wasn't enough hard drive space and her mom told her to "wait until dad gets home". Undaunted, she went looking at the hard drive and recognized most of the programs as games she (or her brother) played, but noticed one they never used ... that game was called "Windows". (The reinstall included an update to Windows XP and restricted user accounts for each of the kids ... I learned something too).
- berlinbrown 14y ago
  I would even go a step further and talk about the Java runtime plugin supplied by Oracle for Windows?
zdw 14y ago
(sysadmin here) I'd totally get rid of Java is so many pieces of hardware didn't have it as their primary user interface. Most equipment in the 2000-2007 range expects to load a Java app in a browser. I have HP and Canon Printers, HP and Qlogic network gear, etc. that all requires Java, in a browser, for at least some of their functionality. There's simply no way around this. The alternate CLI interface on many devices frequently is frustrating - unable to set all features (frequently it's just the network settings), no readline style command line editing support, frequently won't even let you backspace! That said, I shouldn't complain too much. Some gear tried HTML interfaces before they were ready, and as a result only work properly in IE6 (Cisco/Linksys SRWxxxx, I'm looking at you).
tubbo 14y ago
Java is not insecure but one time it asked me if it looked fat.
cwgem 14y ago
Is there a print view or something of this article that doesn't make me feel like I've viewing the mobile version of this website? The text is squished into this narrow column from a confusing layout that it's annoying to read.
ZoFreX 14y ago
"The browser plug-in is the security problem in question, but the Java runtime has its own annoyances—like constantly nagging you for updates, taking up space in your system tray, and (when you first install it) because it likes to install things like toolbars on your system. For these reasons, we generally recommend uninstalling the Java runtime too, just for the convenience." I completely agree with this advice, but it kills me to do so. All of my non-trivial desktop applications are written in Java. They're performant, secure, and easy on the RAM. A huge part of Java's advantage is that it's installed everywhere, and it seems like Oracle are trying their hardest to make sure that's not the case. I really hope I can keep writing applications in Java in the future.
NelsonMinar 14y ago
As a Mac / Chrome user I don't even really have the option of using Java in my browser any more. Can't say I really miss it, although I was fishing around for the command line appletviewer the other day..
berlinbrown 14y ago
And I am assuming this applies to the Oracle web plugin on Windows? E.g. does the Icedtea plugin on Ubuntu have these issues?
jtheory 14y ago
It seems like every other day we get a new article on Java problems, all written for non-technical readers. I know there are new 0day exploits appearing -- but I have no idea what's actually required to activate them. Oracle's oh-crap patch at the beginning of this recent PR mess was to force a user confirmation dialog for running any applet. Are the new exploits bypassing that as well, or are these situations where the sucker has to click "yes, I want to run this possible dangerous content" before bad things happen? It really does make a big difference, but none of the article authors seems to know or care about what actually happens for each exploit to work.
- brazzy 14y ago
  AFAIK most Java plugin exploits are based on a myriad different and arbitrarily involved ways to break out of the applet sandbox. The confirmation dialog should stop those completely.
ved_a 14y ago
Wow- when a lifehacker(finest resource of everything computer science) page hits Hacker News Front Page.
rhplus 14y ago
The LifeHacker article only mentions how to disable on Chrome and Firefox. Instructions for Internet Explorer and Safari are listed here: http://www.java.com/en/download/help/disable_browser.xml http://www.java.com/en/download/help/disable_browser.xml
monochromatic 14y ago
Why is this fluff on HN?
- deleted 14y ago
  [deleted]
- oinksoft 14y ago
  No clue, but Java security seems to be a hot topic right now. OP's post history is very bot-like, a single fluff article every day, never more than one, and one comment on registration day, no more. But it's altogether possible OP is just very consistent and persistent.

28 points by maudlinmau5 14y ago

Here's the money quote: "Java has two parts: the runtime that runs on your computer (and lets you run Java apps), and the browser plug-in that comes along with it. When people talk about Java being insecure, they're talking about the browser plug-in. Java apps themselves aren't inherently insecure, it's the browser plug-in that causes problems." A world in which Java (the run-time) suddenly disappeared would be completely non-functional due to the amount of enterprise software that runs on the JRE. And while Java (the language) is often bashed for it's verbosity, many of the up-and-coming, "cool" languages target the JRE as their run-time environment. Unfortunately, burying that paragraph in a long article and stating "you probably don't need it" is the wrong story to tell. You probably couldn't live (your modern life) without it, but you may not need to have it installed on your computer. EDIT 1: I also should have mentioned that Javascript is not "safe" ... it's "safer" than it used to be because browsers have gotten way better at "sand-boxing" its behavior (I love LocalStorage!). Applets were designed to allow browser-based applications access to the underlying computer's OS, so it should be no surprise that there are more vulnerabilities. And if you think about the biggest attack vectors on the IE browsers (at least the older ones), ActiveX shares this trait (I won't call it a problem). For Android users, you should realize that when you authorize applications to use various features of your phone or tablet, you're explicitly opening holes in Android's default security model (fully sand-boxed). EDIT 2: My favorite quote (so far) on the life-hacker site is "Java does have some legitimate uses (namely Minecraft) ...". The rest of his commentary sounds like the rants typically found in language wars (I won't participate).

martinced 14y ago
Spot on. People do not realize that in some countries virtually all the citizen are carrying a Java SmartCard on them at all time (either an ID card or a medical security card). People do not realize that there are billions of devices running Java (like TV decoders) and that Java is even officially part of some specs (e.g. you cannot have a Blu-Ray player without having Java). In addition to basically power the entire banking infrastructure (it's damn near close to impossible to make an electronic payment without having Java involved in the process) and pretty much the entire corporate world, Java also powers a gigantic number of high-target websites (like eBay and FedEx). And even in browsers, without needing applets, Java is also used to generate JavaScript (GWT and ClojureScript being to examples -- at this point ClojureScript still needs the JVM to compile to JavaScript). And Android, of course. Java is going to dwarf COBOL's legacy. Big times. The real sadness here is that the writing was on the wall: any knowledgeable Java programmer knew, 15 years ago, that Java applets were an insecure piece of excremental technology. You don't know how many time I've vomited on Java applet in Usenet's comp.lang.java.programmer years ago, saying how big of a mistake and loss of energy it was... Only to have the likes of Jon Skeet and Roedy Green defending Java applets tooth and nail.
- drivebyacct2 14y ago
  "TV decoders" written in Java? edit: thanks for the info, repliers.
  - rmrfrmrf 14y ago
    All of Time Warner's Digital Cable boxes, for example.
    - superuser2 14y ago
      Is that why there's 2-3 second lag responding to button presses and biweekly crashed?
      - brokenparser 14y ago
        No, programmers can be rushed by management or plain incompetent in any language.
      - zoowar 14y ago
        DirecTV has similar lags at times. I would love for them to open source the UI and allow hackers to fix and impove it.
      - _djo_ 14y ago
        There are many embedded devices running Java that are quick and efficient, so whatever slowness those cable boxes have is not due to the technology used. It's probably due to the same organisational problems that cause all slow and bloated software. In the case of cable or satellite TV decoders there's usually more focus from management on adding features fast than on making the software bulletproof.
  - OGC 14y ago
    http://en.wikipedia.org/wiki/BD-J http://en.wikipedia.org/wiki/BD-J http://en.wikipedia.org/wiki/Multimedia_Home_Platform#DVB-J http://en.wikipedia.org/wiki/Multimedia_Home_Platform#DVB-J
- 14y ago
taeric 14y ago
Well, to be fair, I think the answer is essentially, "if you do not know why you need it, then you probably do not need it." This is true for pretty much everything on your computer.
- mich41 14y ago
  Tell this to somebody who doesn't know what kernel is for. Your computer contains lots of stuff you use daily without being aware of it.
  - taeric 14y ago
    I had a feeling I would get that counter point. I would presume that folks can educate themselves on things. I realize that is an optimistic stance that is not shared by the majority around here.
    - blaabjerg 14y ago
      They can, but assuming that people (can) have a perfect understanding of all the technology they use in their daily life is not only optimistic, it is entirely unrealistic.
      - taeric 14y ago
        True, but if you hear that folks are having concerns with item X, and you see you have item X, then you should make sure you know why you have it. Hell, I'd consider that to be extended to non computer things, honestly.
  - smoyer 14y ago
    When my eldest children were about 6 and 4 respectively, we got a Windows 98 computer that they could use at home. One of the things I love about kids and computers is that they're fearless. They learn through trial-and-error without the slightest hesitation. In contrast, teaching your parents to use the computer is full of questions about whether they're "allowed" to do something. Anyway, my daughter (four years old at the time) got a new game (probably educational) and when she tried to run it, she was told there wasn't enough hard drive space and her mom told her to "wait until dad gets home". Undaunted, she went looking at the hard drive and recognized most of the programs as games she (or her brother) played, but noticed one they never used ... that game was called "Windows". (The reinstall included an update to Windows XP and restricted user accounts for each of the kids ... I learned something too).
berlinbrown 14y ago
I would even go a step further and talk about the Java runtime plugin supplied by Oracle for Windows?

zdw 14y ago

(sysadmin here) I'd totally get rid of Java is so many pieces of hardware didn't have it as their primary user interface. Most equipment in the 2000-2007 range expects to load a Java app in a browser. I have HP and Canon Printers, HP and Qlogic network gear, etc. that all requires Java, in a browser, for at least some of their functionality. There's simply no way around this. The alternate CLI interface on many devices frequently is frustrating - unable to set all features (frequently it's just the network settings), no readline style command line editing support, frequently won't even let you backspace! That said, I shouldn't complain too much. Some gear tried HTML interfaces before they were ready, and as a result only work properly in IE6 (Cisco/Linksys SRWxxxx, I'm looking at you).

tubbo 14y ago

Java is not insecure but one time it asked me if it looked fat.

cwgem 14y ago

Is there a print view or something of this article that doesn't make me feel like I've viewing the mobile version of this website? The text is squished into this narrow column from a confusing layout that it's annoying to read.

ZoFreX 14y ago

"The browser plug-in is the security problem in question, but the Java runtime has its own annoyances—like constantly nagging you for updates, taking up space in your system tray, and (when you first install it) because it likes to install things like toolbars on your system. For these reasons, we generally recommend uninstalling the Java runtime too, just for the convenience." I completely agree with this advice, but it kills me to do so. All of my non-trivial desktop applications are written in Java. They're performant, secure, and easy on the RAM. A huge part of Java's advantage is that it's installed everywhere, and it seems like Oracle are trying their hardest to make sure that's not the case. I really hope I can keep writing applications in Java in the future.

NelsonMinar 14y ago

As a Mac / Chrome user I don't even really have the option of using Java in my browser any more. Can't say I really miss it, although I was fishing around for the command line appletviewer the other day..

berlinbrown 14y ago

And I am assuming this applies to the Oracle web plugin on Windows? E.g. does the Icedtea plugin on Ubuntu have these issues?

jtheory 14y ago

It seems like every other day we get a new article on Java problems, all written for non-technical readers. I know there are new 0day exploits appearing -- but I have no idea what's actually required to activate them. Oracle's oh-crap patch at the beginning of this recent PR mess was to force a user confirmation dialog for running any applet. Are the new exploits bypassing that as well, or are these situations where the sucker has to click "yes, I want to run this possible dangerous content" before bad things happen? It really does make a big difference, but none of the article authors seems to know or care about what actually happens for each exploit to work.

brazzy 14y ago
AFAIK most Java plugin exploits are based on a myriad different and arbitrarily involved ways to break out of the applet sandbox. The confirmation dialog should stop those completely.

ved_a 14y ago

Wow- when a lifehacker(finest resource of everything computer science) page hits Hacker News Front Page.

rhplus 14y ago

The LifeHacker article only mentions how to disable on Chrome and Firefox. Instructions for Internet Explorer and Safari are listed here: http://www.java.com/en/download/help/disable_browser.xml http://www.java.com/en/download/help/disable_browser.xml

monochromatic 14y ago

Why is this fluff on HN?

deleted 14y ago
[deleted]
oinksoft 14y ago
No clue, but Java security seems to be a hot topic right now. OP's post history is very bot-like, a single fluff article every day, never more than one, and one comment on registration day, no more. But it's altogether possible OP is just very consistent and persistent.