It's time to run Java out of town (Java accounts for more Windows infections than any other source)

Info World ^ | 04/2012 | By Woody Leonhard

[SeekAndFind]

STRICTLY FOR TECHIES ONLY....

[SeekAndFind]

The author then (in the interest of being "fair and balanced"), writes another article excoriating Java's rival -- .NET.

---

See here

It's time to run .Net out of town

I don't know what it is about Microsoft and .Net Framework patches, but it seems that every time we have a sizable .Net patch, it doesn't work on enormous numbers of PCs.

So it was again this week. For reasons unknown and unexplained, Microsoft pushed three .Net patches -- KB 2518864 (MS11-044, June 2011), KB 2572073 (MS11-078, October 2011), and KB 2633880 (MS12-016, February 2012) -- out the Windows Update chute. If you happen to be running Windows XP or Windows Server 2003, with .Net Framework 2.0 SP2 or 3.5 SP 1, and if you're naive enough to leave Automatic Updates turned on, you probably got nailed with a yellow alert icon that says, "Some updates could not be installed." Click through the alert and you see that Automatic Update couldn't install any of the three patches.

I know some admins who have hundreds of customers with yellow alert icons.

Microsoft has assiduously avoided explaining why so many PCs and servers were affected, and only recently have users been able to piece together a workaround. Support forums all over the world are ablaze with complaints and questions.

Yesterday, Microsoft yanked the patches. If you're staring at a yellow warning icon (or if you have scores of customers who are so bedeviled), having the patch yanked may or may not solve your problems. With a lot of help from afflicted Windows XP users and one Microsoft tech, I've come up with five possible remedies for the nagging yellow icon on my AskWoody site, ranging from easy to drastic.

If this is starting to sound like last month's .Net Framework patching debacle, where many people couldn't print their TurboTax forms over the tax weekend, the similarities are uncanny. But they're par for the course with .Net Framework patches. In the past year, I've seen problems with all these .Net patches:

• May 2012: MS12-025/KB 26563638 .Net 4 patch, released via Automatic Update, pulled by Microsoft.
• May 2012: MS12-025/KB 2656373 .Net 3.5.1 patch, released via Automatic Update, pulled by Microsoft.
• February 2012: MS12-016/KB 2651026 .Net 2, 3.5.1, and 4 patches, multiple problems on XP systems, including ATI card control panel software Blue Screen of Death, widespread installer failures.
• August 2011: MS11-069/KB2533523 .Net 4 patch, released via Automatic Updates, pulled by Microsoft.
• August 2011: MS11-066/KB2487367 .Net 2 patch, released via Automatic Updates, pulled by Microsoft. Keeps reinstalling.
• June 2011: MS11-039 and MS11-044, many kilobytes. Enormous array of problems, many of which can't be undone, require removing and reinstalling .Net.

Now we get to add the three new ones, which have been pulled by Microsoft.

I can't even figure out why Microsoft pushed the patches. Microsoft did release a security notification that details changes to three Security Bulletins, MS11-100, MS12-034, and MS12-035. None of those cover the patches that went haywire yesterday, but the revisions mention, "This is a detection change only." Whether the notification has anything to do with the botched patches remains to be seen, but it's the only patch notification that's come out in recent days. If the security notification isn't related to the repushed updates, why did Microsoft push them? They appeared completely unannounced, with no warning whatsoever. And they're buggy as can be -- as befits .Net patches.

Last month, I brought down a firestorm of complaints for saying that it's time to run Java out of town. Sun's (and then Oracle's) inability to keep the Java Runtime Environment patched has driven Java to the top of the infection vector list for Windows systems. Recently, it made the Mac vulnerable. Java deserves to go.

Well, Microsoft, it's time to run .Net out of town, too -- at least the older versions. Why on earth did you make your versions so backwardly incompatible that many Windows customers are forced to run multiple copies of .Net? Right now, almost any well-worn Windows PC sports a copy of .Net Framework 4, .Net Framework 3.5, and .Net Framework 2.0. Some of them also have .Net Framework 3.0 and 1.1. What's wrong with this picture?

If Microsoft can't clean up the .Net mess, it's time to move on to a better technology.

[IronJack]

STRICTLY FOR TECHIES Java-hating doofi ONLY....

Fixed.

[the invisib1e hand]

The first time I ever saw it I said, "java sucks" and I've been saying it since.

however, I don't think it will ever go away until the gods of information (oracle) abandon it. Don't know what it will take to make that happen -- some real competition, I suppose.

[KevinDavis]

Java will never go away.. Android saved Java imho..

[Lady Lucky]

“STRICTLY FOR TECHIES ONLY....”

Unless/until someone posts on how to remove Java (and what we’ll be missing without it and what to use instead....)

I bookmark and await. :)

[Carriage Hill]

Is Java the same as JavaScript? I use Opera v11.64 and now have JS turned-off. Thanks for the article, SAF.

[Dan Nunn]

Is Java the same as JavaScript?

It is not, that is the result of Netscape's unfortunate naming back in the day for ECMAScript (Javascript).

[econjack]

...disable Java in the browser you use...

Of course, virtually everything uses Java on the web but you really don't need to use the web. Oh...wait...let's toss out Java and use Mumps. I don't think I've every heard of a Mumps virus. Of course, a bazillion people use Java and only seven people use Mumps, but that couldn't possibly explain why Java has more viruses.

[SeekAndFind]

RE: Oracle and Java

Ever since Oracle acquired Sun Microsystems last year, Java community members have worried that the database giant would attempt to seize control of the Java platform. The effort to transform Java into an open source, standards-based platform driven by industry-wide consensus and collaboration was long and arduous.

Oracle has never been one to share its markets willingly, and Oracle CEO Larry Ellison made no bones about what he saw as Sun’s failure to capitalize on its Java technology.

And Sure enough, over recent months Oracle has launched its campaign in earnest.

First, it announced an agreement with IBM to collaborate on Oracle’s OpenJDK as the primary open source Java SE implementation, at the apparent expense of the rival Apache Harmony project.

Next it tried to stack the deck of the Java Community Process (JCP) in its own favor by appointing a ringer — a hitherto unheard-of Oracle customer called Hologic — for a position on the JCP Executive Committee.

Now Oracle has announced plans to offer a “premium,” commercial version of the JVM to enterprise customers, including unspecified enhancements that won’t be shared with the community-built version.

So, The Apache Software Foundation (ASF), one of the most important contributors of open source Java tools and frameworks, has issued an ultimatum demanding that the JCP enforce the ASF’s rights as a fair and equal participant in the Java specification process.

The ASF is not the first to object to Oracle’s aggressive, bullying tactics in the Java community. Prominent contributor David Lea withdrew from the JCP Executive Committee last month, claiming, “I believe that the JCP is no longer a credible specification and standards body, and there is no remaining useful role for an independent advocate for the academic and research community on the [executive committee].”

Things don’t bode well if this is what happens when Oracle takes over Java.

On the other hand, Microsoft seems to be going the right direction with their open source — MONO project, which has now successfully ported the .NET platform to LINUX, SOLARIS, ANDROID, IOS, OS X, and some for game consoles such as PlayStation 3, Wii, and Xbox 360.

In fact, Microsoft’s policy for Open Source developers is this — HOW CAN WE HELP TO MAKE .NET MORE OPEN?

The folks at the Open Source Mono project in fact have an office at Microsoft’s HQ.

Things are starting to look interesting from here...

[Carriage Hill]

Thank you so much.

[Michael Barnes]

Maybe client side it will go away eventually, not on the server side however. Way too much WebSphere, Weblogic and JBoss out there running entire sites. Some of Oracle’s latest offerings (GRID for example) are JVM based.

[SeekAndFind]

For those of you who program in other language, here is one main difference between Java and its rival, .NET -— Although both are supposed to be write-once-run-anywhere platforms, you MUST LEARN Java to run on a machine installed with the Java Virtual Machine (JVM), while you DON’T need to learn a new language to run .NET on a CLR-enabled machine.

The design of .NET is such that programmers of ANY language can rebuild (recompile) their application and it will re-assembled the result to .NET Intermediate language, that will allow it to run on ANY .NET machine.

So, to COBOL, PASCAL, ADA, FORTH, MODULA 2, SMALLTALK, C/C++ etc. programmers out there, your life just got easier.

Here is a list of all the programming languages the .NET platform supports — click on the following link :

http://www.dotnetpowered.com/languages.aspx

[Michael Barnes]

Besides Wintel, where else does .net run native without having to use open source?

[SoDak]

YES...java sucks

[SeekAndFind]

RE: Besides Wintel, where else does .net run native without having to use open source?

I believe the answer is NONE.

.NET is Microsoft’s way of acknowledging that there are other operating systems out there other than Windows, and it is using .NET as a vehicle to “conquer” ( for want of a better word ) them.

I just learned today that for the Apple IoS, and even their Smartphones, you don’t have to learn Objective-C ( what most developers of iPhone APPS program in ), C# developers can now write, build and create Apps that run on the iPhone...

Does anybody know if Java can do that?

[the invisib1e hand]

i don’t know if its ms-centric but my exposure to java never, ever felt solid. my exposure to sql server and .net gave the impression of a more stable environment. And I’m not msft fan, believe you me.

[Wayne07]

Very very few sites use Java. Unless you are playing a game or running some embedded application, there is no need.

[SeekAndFind]

RE: but my exposure to java never, ever felt solid. my exposure to sql server and .net gave the impression of a more stable environment.

Let me guess, you have been running your programs under a WINDOWS environment? Well if so, I’m not surprised. After all, that is a where Microsoft OPTIMIZES its products. I’d be surprised if you can say the same in a UNIX or LINUX environment.

[dfwgator]

Why don’t we just stop writing programs altogether, that’ll solve it!