3 ms·

Java is a safer language? Just having a Java interpretor installed on your system opens you up to untold security threats. Honestly, it sounds a lot more like

Java is a safer language? Just having a Java interpretor installed on your system opens you up to untold security threats. Honestly, it sounds a lot more like the majority of the software people on this project simply liked/knew Java, rather than made a informed choice of Java based on security considerations. Not Java-bashing, it just the whole "C has pointers, pointers are not-safe, thus C is not safe, while Java has not pointers, and thus is safe." Has somebody actually compiled statistics of the relative frequency of security threats in respect to language in which they were written.

_delirium 12y ago
> Just having a Java interpretor installed on your system opens you up to untold security threats. That's not the case at all. A Java interpreter doesn't run with any kind of privileges, so it adds no added security threat above those that already exist when you are able to run code as a user. Having it installed is no more dangerous than having libboost or python installed on your system, if you have any kind of sane setup. The part of Java with a bad security track record is the applet sandbox, which is supposed to make it safe to run arbitrary code in a browser. The sandbox has turned out to be pretty leaky. So I would not recommend relying on the applet sandbox to run arbitrary untrusted Java code from the internet. But for a local app it's a perfectly reasonable platform (vaguely in the same category as Microsoft's CLR, which is heavily JVM-inspired).
azakai 12y ago
Sure, the Java VM has seen many security exploits. However, Java does avoid memory corruption errors which are sadly easy to create in C and C++. We see exploits of such things all the time. It does make sense to use a language like Java or Rust (or C# or JavaScript - basically, any modern sandboxed language) for that reason. But yes, Java specifically has seen plenty of exploits, and that is a cause for concern.

_delirium 12y ago

> Just having a Java interpretor installed on your system opens you up to untold security threats. That's not the case at all. A Java interpreter doesn't run with any kind of privileges, so it adds no added security threat above those that already exist when you are able to run code as a user. Having it installed is no more dangerous than having libboost or python installed on your system, if you have any kind of sane setup. The part of Java with a bad security track record is the applet sandbox, which is supposed to make it safe to run arbitrary code in a browser. The sandbox has turned out to be pretty leaky. So I would not recommend relying on the applet sandbox to run arbitrary untrusted Java code from the internet. But for a local app it's a perfectly reasonable platform (vaguely in the same category as Microsoft's CLR, which is heavily JVM-inspired).

azakai 12y ago

Sure, the Java VM has seen many security exploits. However, Java does avoid memory corruption errors which are sadly easy to create in C and C++. We see exploits of such things all the time. It does make sense to use a language like Java or Rust (or C# or JavaScript - basically, any modern sandboxed language) for that reason. But yes, Java specifically has seen plenty of exploits, and that is a cause for concern.