Serious security flaw in JAVA

[MrStraightface]

my work still uses 1.6  :blink:

[Master Disaster]

In other news the sun is burny...

I'd be more surprised if they announced Java had passed a security test, just once, ever.

[Techhog]

One more reason everyone should just build in C++. It's easier to build security if everyone's just using one language anyway.

And it doesn't have stupid irritating restrictions that make some things which take 2-3 lines in C++ require like 10 in Java.

[OuchMyFaceyHole]

What? Java stands for Jiant Ass VulnerAbility. 

[BOT Edward]

I just remember everyone, just a few years ago, saying learning java was the way to go for career seekers, and that's where the jobs would be

 

 

 

 

and called me stupid when I said that wasn't gonna happen 

 

Well you must be stupid then... There are still a shed load of companies wanting JAVA developers for in-house software (for cross platforming reasons).

In my state, the "tree" or programming languages sought after for Developer jobs are as follows:

 

Java

vb.net

C#

[Bloodyvalley]

Adblock to the rescue!

[ionbasa]

Well you must be stupid then... There are still a shed load of companies wanting JAVA developers for in-house software (for cross platforming reasons).

In my state, the "tree" or programming languages sought after for Developer jobs are as follows:

 

Java

vb.net

C#

Really, cross platform?

 

I'll just leave this here:

[Dabombinable]

Well Java is made of broken and unstable code so meh.

[Dabombinable]

Really, cross platform?

 

I'll just leave this here:

And the same goes for that abomination called Adobe Flash.

 

And Unity WebPlayer

[BOT Edward]

Really, cross platform?

 

I'll just leave this here:

 

 

And a lot of inhouse programs were created using Java and Java expertise is needed to keep these maintained and updated.

No-one wants to spend more money on getting it converted to a different language...

[Gob]

Oh it's still happening. With Hadoop batch jobs Java is still the way to go until Google allows C++ executables. The reason they don't is without transactional memory they fear someone could expose their OS and all the secret sauce hiding behind the obscurity provided by their custom JVM and Python Virtual Machine.

 

 

Google's Cloud Computing is not remotely open source.

 

 

I think you missed something critical. When I say knowing Java is still hugely useful for getting a job, I mean lots of the computing done by large businesses today involves map-reduce jobs of big data collections for later analysis. The most common platform for this is Google's Hadoop which doesn't allow C++ interface due to the fact it could expose the operating system in the right hands. That operating system and the libraries Google has built in are some of the major underpinnings for a lot of its infrastructure, basically its trade secrets.

 

I think you have misunderstood what Hadoop is and how it relates to Google. Here's an FYI:

 

Hadoop is actually an open source project spear-headed by the Apache foundation (https://en.wikipedia.org/wiki/Apache_Hadoop).

 

You are correct, though, that Google does offer it on its cloud platform. Further, this platform is closed source, and contains "trade secrets" with regards to the VM implementations you mention above (fun fact, their own implementation of the JVM keeps Oracle at bay).

 

However, Google is just running Apache's Hadoop with some optimizations (https://cloud.google.com/hadoop/what-is-hadoop). Further, because it is open source, you can run Hadoop on your own systems, AWS, DigitalOcean, etc. So you have more freedom than you think.

 

The main reason you don't see Hadoop interfaced with C++ is because Hadoop itself is written in Java, and thus, there is a huge convenience sticking with that language as you do not have to reimplement libraries that are already implemented in the Hadoop packages. So you actually could interface C++ executables, it would just be tedious (and fun with JNI!).

 

 

As for this java vulnerability, my opinion is that java client applets should have been killed years ago. If they had, I bet the "Java is insecure" stigma would be no where near as prevalent. 

[Gob]

Well Java is made of broken and unstable code so meh.

 

Out of curiosity, what makes you say this?

 

I have worked on 2 major Enterprise applications involving java. The first project was a Desktop Application written strictly in java with nearly 15 million lines of code. Further, this project was actually a clone (with many more features added) of a project written in C++. Neither project was more, or less stable than the other. And really nothing about either language affected stability.

 

The second project was a business platform server project written in a mixture of C++ and Java (65% C++, 35% java), roughly 10 million lines of code, cross platform (Linux, WIndows, AIX, Solaris, etc). Once again, bugs/development issues were distributed proportionally.

[patrickjp93]

I think you have misunderstood what Hadoop is and how it relates to Google. Here's an FYI:

Hadoop is actually an open source project spear-headed by the Apache foundation (https://en.wikipedia.org/wiki/Apache_Hadoop).

You are correct, though, that Google does offer it on its cloud platform. Further, this platform is closed source, and contains "trade secrets" with regards to the VM implementations you mention above (fun fact, their own implementation of the JVM keeps Oracle at bay).

However, Google is just running Apache's Hadoop with some optimizations (https://cloud.google.com/hadoop/what-is-hadoop). Further, because it is open source, you can run Hadoop on your own systems, AWS, DigitalOcean, etc. So you have more freedom than you think.

The main reason you don't see Hadoop interfaced with C++ is because Hadoop itself is written in Java, and thus, there is a huge convenience sticking with that language as you do not have to reimplement libraries that are already implemented in the Hadoop packages. So you actually could interface C++ executables, it would just be tedious (and fun with JNI!).

As for this java vulnerability, my opinion is that java client applets should have been killed years ago. If they had, I bet the "Java is insecure" stigma would be no where near as prevalent.

Generally I don't expect people to understand the subtleties, but you wrapped that up quite nicely. Unfortunately you have one detail out of place. Google not only has its proprietary VM software, but it actually rewrote the entire Hadoop system under C++ to maximize its performance. And Google does not allow execution of C++ code through its services. You will be thrown off of your account with them if you do until such a time as they replace all their memory infrastructure with Hybrid Memory Cube or another transactional memory which could prevent the exposure of the underpinnings of its software infrastructure (citing Dr. Keith Fricken, DBA at Google and former Miami University professor and director of cryptographic studies in the CSE department).

[Gob]

Generally I don't expect people to understand the subtleties, but you wrapped that up quite nicely. Unfortunately you have one detail out of place. Google not only has its proprietary VM software, but it actually rewrote the entire Hadoop system under C++ to maximize its performance. And Google does not allow execution of C++ code through its services. You will be thrown off of your account with them if you do until such a time as they replace all their memory infrastructure with Hybrid Memory Cube or another transactional memory which could prevent the exposure of the underpinnings of its software infrastructure (citing Dr. Keith Fricken, DBA at Google and former Miami University professor and director of cryptographic studies in the CSE department).

Yeah, I have used Google Cloud Platfrom before, they support python and java.

Really, how did they get around the Gnu Public License?

[LAwLz]

Really, cross platform?

 

I'll just leave this here:

<image>

The person you are responding to never said Java is good because it's cross platform. He said it is used because it's cross platform.

Used != good

[ionbasa]

The person you are responding to never said Java is good because it's cross platform. He said it is used because it's cross platform.

Used != good

I also used it jokingly, but sometimes tone doesn't get transmitted over the internet well.