Hacker News Reader

Comment by pjmlp | Hacker News Reader

Every time there is a report for Java security exploits, I would like to see bug listings from other compiler runtimes, specially C and C++ ones.

View on HN

They're not really the same thing. People rely (to a greater or lesser degree) on VM security guarantees for running less than fully trusted code in a variety of contexts - I say VM rather than JVM to include Dalvik, JS engines, etc. People don't run random untrusted C and C++ code.

> People don't run random untrusted C and C++ code.

Yes they do. Every time they start their computer.

No, that's trusted C and C++ code - they've given it permission to break their security.

Trusted by whom?

Fine, go read the bug trackers for them. Your point was? Oh, probably better to spend the time patching your desktop and servers given the massive drive through holes Java has left there.

My point is that it is easy to escalate Java security issues to average Joe, while forgetting it is just the tip of the iceberg of all attack vectors a computer has, regardless of which programming languages are used.

But the criticism isn't that others have no security issues. It is that others fix them with a greater sense of urgency than Oracle.

Do they?

I can tell from the companies I worked for, security fixes are handled like any other bug fix.

>Do they?

The perception is that they do, and I have to say that I share that perception. I'm open to be convinced otherwise ... by facts.

> I'm open to be convinced otherwise ... by facts.

Well, as you might understand I cannot publish the internal backlog of any Fortune 500 company my employer does consulting for.

Either you believe me that security issues get the same priority as any other bug/feature on the backlog, or you don't.

The issue we're talking about has nothing to do with the relative priority of security issues versus other bugs. The OP claimed that Oracle issues bug fixes less frequently (quarterly) than Microsoft or Adobe (monthly). Your claim is completely unrelated to that.

So the world of computing is composed only by Microsoft, Adobe and Oracle, right?

No other software requires security fixes, I see.

I certainly hope that not many of the major vendors take three months to fix critical, remotely exploitable security issues. If they do, they deserve the same criticism that Oracle got.

Not sure what you meant, but almost all recent security holes were client-side. As far as I remember, server-side Java has been fairly robust.

Reply on news.ycombinator.com