Hacker News Reader

Did Oracle introduce these bugs?

Have they been permitting anyone who isn't oracle affiliated to work on the sandbox? I was under the impression that the core development and compiler work was all in house.

Are you sure these bugs are new? The Java Applet Sandbox doesn't exactly have a spotless security history.

One of the bugs is fairly old, the other (which is required for the overal exploit) is new-ish (introduced in Java 7), but probably not as new as saosebastiao was implying (as the title of this HN post can be parsed as "the bugs were introduced by the patch attempting to fix the other bugs", which is definitely not the case, AFAICT).

> Issue 51 affects both Java SE 6 and 7. Issue 52 is for Java SE 7 only. Since both issues are required for the attack to succeed, we treat it as Java 7 specific only.

-- http://seclists.org/fulldisclosure/2013/Jan/195

These bugs may have been added to the source code by Sun before Oracle acquired Sun. However, the first released version of Java that came with these bugs was done by Oracle.

Just to add I'm referring to latest zero day bugs and not the ones found by Gowdiak.

Reply on news.ycombinator.com