4 ms·

Define "Java proper". The article focuses on Java implementations being exploited without going into root causes behind the vulnerabilities. Skimming http://c

Define "Java proper". The article focuses on Java implementations being exploited without going into root causes behind the vulnerabilities. Skimming http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Java http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Java I'd say there's evidence of fundamental problems, affecting Java insomuch as they influence Java's API design: - Huge attack surface (including native code in implementations) - Insufficiently defensive API design - Opt-into security ethos ("remember to escape, verify required permissions") rather than opt-out ("remember to unfreeze, untaint, verify unrequired permissions")

craigching 13y ago
> Define "Java proper". Java not running in the browser, i.e. running as a service on the target platform. Personally I am not a proponent of running Java in a browser, but I am a proponent of the JVM as a service. So please educate me on the security issues as they relate to running Java not in a browser.
- gsg 13y ago
  The problem is that Java has consistently failed to be secure enough to safely execute untrusted code, that is code coming from unknown, potentially hostile sources. For running trusted code, Java is fine.
- MaulingMonkey 13y ago
  > Java not running in the browser, i.e. running as a service on the target platform. Thank you for clarifying - my initial interpretation was wildly off. > Personally I am not a proponent of running Java in a browser, but I am a proponent of the JVM as a service. So please educate me on the security issues as they relate to running Java not in a browser. I'm afraid I lack the practical detail you're probably after in terms of defending or mitigating attacks against Java services. Sorry! Some of the CVEs would still seem relevant, but you'd be better off turning to them directly instead of having me poorly parrot them.

craigching 13y ago

> Define "Java proper". Java not running in the browser, i.e. running as a service on the target platform. Personally I am not a proponent of running Java in a browser, but I am a proponent of the JVM as a service. So please educate me on the security issues as they relate to running Java not in a browser.

gsg 13y ago
The problem is that Java has consistently failed to be secure enough to safely execute untrusted code, that is code coming from unknown, potentially hostile sources. For running trusted code, Java is fine.
MaulingMonkey 13y ago
> Java not running in the browser, i.e. running as a service on the target platform. Thank you for clarifying - my initial interpretation was wildly off. > Personally I am not a proponent of running Java in a browser, but I am a proponent of the JVM as a service. So please educate me on the security issues as they relate to running Java not in a browser. I'm afraid I lack the practical detail you're probably after in terms of defending or mitigating attacks against Java services. Sorry! Some of the CVEs would still seem relevant, but you'd be better off turning to them directly instead of having me poorly parrot them.