Topic: Java Update on Tuesday (Read 16,842 times)
The company says it will release a patch that will fix 86 vulnerabilities in Java 7....86?
- carpe noctem
That's gotta be like a whopping 0.1%!
Oh, what was that language that so many Android programs are written in?Well, the language is Java, but the base libraries are different and Dalvik is different from the Java VM... so I'd be more than a little surprised if a Java exploit would work on Android
- carpe noctemOh, what was that language that so many Android programs are written in?Well, the language is Java, but the base libraries are different and Dalvik is different from the Java VM... so I'd be more than a little surprised if a Java exploit would work on Android
Good point. I didn't mean to point to vulnerabilities, but only to the longevity of Java.Oh yeah, it's not going away anytime soon.
- carpe noctemOracle this week released an update for its widely used Java software, fixing a zero-day vulnerability that was being actively exploited to install malware via drive-by downloads.
But before you begin patting Oracle on the back for its quick response, note two things about that update:
•It might not actually fix the underlying security issues.
•Along with the must-install security update, Oracle continues to include crapware.
Yes, adding insult to injury, Oracle is actually making money and cheapening your web browsing experience by automatically installing the Ask toolbar, which in turn tries to change your default search engine and home page.
I have no idea how much money Ask pays and Oracle collects off this seamy, sleazy practice. I can only assume it's enough to justify selling out Java users.
- carpe noctem
My understanding is that if you install the Java runtime (JRE) with the optional toolbar, any (or maybe just some) JRE automatic updates will include a pre-checked option to include the toolbar in the update - even if you turned off the toolbar option on the initial install. So you have to remember to deselect that thing each time.-
But, if you go to the developer oriented download site:I downloaded my offline version directly from Oracle's site at http://www.java.com/en/download/manual.jsp[/url] , why would that be any different from the technetwork page?
http://www.oracle.com/technetwork/java/javase/downloads/index.html
and choose the JRE download there, you'll get a version that doesn't package the toolbar at all.
That's really strange! WTF?
why would that be any different from the technetwork page?
And then it finally clicked, this is the Developers Kit, which is the one that I, and most ordinary folks don't want or need.why would that be any different from the technetwork page?
Because the more dev-oriented types probably wouldn't want the dratted thing, and it's generally poor practice to tick off your developers?
Of course, Joe User apparently doesn't mind toolbars... (have we had a poll asking the most toolbars you've had to clean off someone's pc?)
But yeah, it's whOracle - #2 on my list of really evil software companies, where crApple still reigns supreme.
Very subtle. Almost CRied laughing! 
why would that be any different from the technetwork page?
Because the more dev-oriented types probably wouldn't want the dratted thing, and it's generally poor practice to tick off your developers?
Of course, Joe User apparently doesn't mind toolbars... (have we had a poll asking the most toolbars you've had to clean off someone's pc?)
And then it finally clicked, this is the Developers Kit, which is the one that I, and most ordinary folks don't want or need.
WHahahaha!At the moment (well, for a pretty long time), Microsoft. The list is based on a mix of evilness, douchebaggery, (wrong) public opinion, and market influence.
Who is #3?
The exploits in question only affect JDK 7, not JDK 6, which is much more secure, to say nothing of more stable.Ah yes, there were never any exploits for Java 6?
Also, these exploits only affect in-browser user, so there is no reason to dump any software that is written in Java and runs on your local system, rather than in a browser.True - no reason to dump Eclipse or Minecraft, you just need to get rid of the browser plugin
. Sure, there's very likely other security holes in the JRE, but if an attacker has reached the level where he's going to compromise non-browser JRE, you've got more serious security issues. - carpe noctemLatest Java Update Broken; Two New Sandbox Bypass Flaws Found
Expect the roar from security experts urging users to abandon Java to reach ear-splitting levels after reports this morning that new sandbox bypass vulnerabilities are present in the latest Java update.
WHahahaha!At the moment (well, for a pretty long time), Microsoft. The list is based on a mix of evilness, douchebaggery, ...
Who is #3?
Original address: https://www.donationcoder.com/forum/index.php?topic=33679.0
