﻿ Homeland Security warns Java still poses risks after security fix | ZDNet

Homeland Security warns Java still poses risks after security fix



Read this

How to disable Java in your browser on Windows, Mac

How to disable Java in your browser on Windows, Mac










Update at 3:45 p.m. ET: Oracle told ZDNet in a statement: "Oracle has released Security Alert CVE-2013-0422 to address the flaw in Java software integrated with Web browsers. This is a blog that discusses when the bug was reported and actions that Java users need to take to secure their systems."

Topics: Security, Oracle



Log in or register to join the discussion
  • just as I said

    use android instead or native apps. Oracle ca not be trusted as long as it does not support FOSS.
    LlNUX Geek
    • You do realize that

      Android is based on java too right? I like Android, but seriously, you're trolling, not giving any real advice. Why?
      • The problem isn't with Java itself.

        Java is merely the programming language. The problem is Oracle's horrible implementation of a JVM (Java Virtual Machine), on which the Java code (or more specifically, the bytecode compiled from it) runs. No one has clarified whether or not this affects users of OpenJDK (the default JVM on most non-Oracle Linux distros), nor is this believed to affect Dalvik (Android) users.
        • Redhat confirms OpenJDK is affected.

          • Dalvik likely isn't

            As it does not implement a standard JVM and was clean roomed.

            Besides its browser is c based, and the other vector, Google Play, let's you put your own code on the phone, but has to go through curation. That means malware will work as it always has for Android - subtle Trojan payloads built right into the app.
          • Google Play isn't really curated

            Sorry to break it to you, but Google Play isn't exactly curated. Submit an app, and it will be live within a few hours (probably dependent on some periodic batch process). Try submitting an app to Amazon or Barnes & Noble, on the other hand, and it will take days or weeks. That is curation.
          • By that logic, ...

            ... the best curation would lie in keeping it off the market forever (true, but useless).
        • While good intentioned, you are horribly wrong.

          The problem IS NOT the JVM, not even close. The problem is Java Applets, and how they are still allowed to run in the web browser (without user permission). Java is a server/desktop programming language and can do some incredibly powerful things, such as manipulate your local filesystem, etc. This is something a web-embedded language SHOULD NOT BE ABLE TO DO!

          Java Applets tried to fix this vulnerbility by "sandboxing" the applets. But the problem is, if someone can break out of the sandbox, then they have a full functional programming language at their disposal... do do nasty things.

          Get Java out of the browser. Plain and simple. For now until Oracle decides to do this for us, at least disable it in your browser!
          Jason Sipula
      • "Based on" is not "the same as"

        @KBot, you are aware that "based on" does NOT mean "same as", right ?

        Being both a Java and Android developer can i tell you its not the same in many low-level and technical ways which aren't significant here.

        The point that Linux Geek was trying to make is this :

        Under Sun Microsystems, Java (as a technology) benefited from being a Community-based platform because there were TONS of experts from all related fields working on it together.

        However, ever since it became a proprietary product owned by Oracle, it has SUFFERED from being limited to only being quality checked by Oracle.

        And that's why we have the situation we have right now.

        Even the turnaround time on fixes is MUCH slower now, because there are only Oracle resources working on it, and they obviously have a lot on their plates at any given time.

        Oracle was "smart" in buying Sun Microsystems cos they got both Java and MySQL in the deal.
        However, they didn't maintain the core ideals that Java was created with, in mind.

        So, as Linux Geek said, if Oracle actually supported FOSS, and allowed Java to be more Community-based we'd have a much higher quality of releases.
        • Thank you

          for adding some intelligence to the conversation. :-)
        • I would agree completely.

          You are quite correct in your assessment. Many products created in the computer industry were quite good in their initial release, especially if they were based on an open source model. What happens frequently is that when the company is bought out the software is made proprietary and redesigned into essentially crapware that isn't worth buying, no matter how good it was originally. The price goes up and quality goes down because the originators had a superbly marketable idea that the buyers cashed in on solely to make a PROFIT, not SOFTWARE.
        • Darkne55 dead on

          I started using Java for a living w/ JDK 1.1.5 (not 1.5, not a typo). 1998 until just recently vulnerabilities w/ the JVM never crossed my mind. But after the Big O got control of Java it has steadily gone downhill. Case-in-point: Sun never called EOL support for the version immediately preceding the current release. It is fairly obvious the Big O is not interested in supporting Java because there is no huge direct monetary reward for supporting Java.

          With companies like the Big O the concept of a developer community is not part of the corporate thinking.

          When is the last time someone read the mission statement for a large corporation that included references to the so-called developer community?
    • Use Android

      Exactly. We should all listen to Linux geek and use android instead of Internet Explorer or Firefox or Chrome. This is what I've been telling people for years, recently I uninstalled Internet Explorer on my parents computers and installed Android. They're so much happier now!
      Koopa Troopa
      • How to uninstall IE

        Exactly how do you uninstall Internet Explorer from Windows Machines? IE is a integral part of the OS, and you can't really uninstall all of it. What do you really mean by installing Android? Are you installing Android on a PC?
        • Sarcasm

          Sorry, I though the sarcasm was pretty clear. Perhaps I should have labeled it.
          Koopa Troopa
          • Great

            You Got me there...! I believe there's a better way to get rid of all those security issues, just ask the president to activate the infamous "Internet Kill Switch"... That way we all will be safe...
          • Perhaps..

            You missed the sarcasm based on personal bias'? Nooo... not you.

        • Probably you are new here.

          @bkoop87's statement is sarcasm clearly.
          Ram U
      • What?

        Android is an OS (which could include a native browser); IE is a browser, designed to run in the Windows OS environment. What OS is your parent's PC running? What browser is on your parent's PC? And how does any particular browser make your parents "happier"? Your comments don't make sense. And, this particular article concerns Java RTE, NOT Javascript or related stuff. Yes the Java RTE might be accessed from some web app, but certainly not the same as Javascript!
        • yes, you have to be clearer with the sarcasm!

          If you look through blog comments, there are a lot of truely clueless entries, along with the inevitable shill/trolls/(and related idiots!). So yes, please be careful with sarcasm, as some might think it's just another clueless post!

          BTW, just follow the instructions in the linked article, and disable Java in the browser.