It's time to run Java out of town (Java accounts for more Windows infections than any other source)

Info World ^ | 04/2012 | By Woody Leonhard

[upchuck]

Java exploits top all other infection vectors, on any platform, year after year.

Larry Ellison is deeply saddened.

[SeekAndFind]

Yes, but what will people like me do for a living :)

[dfwgator]

Although both are supposed to be write-once-run-anywhere platforms, you MUST LEARN Java to run on a machine installed with the Java Virtual Machine (JVM), while you DON’T need to learn a new language to run .NET on a CLR-enabled machine.

Wrong! There are JRuby, Scala, Groovy, Jython, and Cloture, just to name a few, that run on a JVM.

[SeekAndFind]

RE: Larry Ellison is deeply saddened.

And I don’t think Bill Gates cares much anymore. He has been out of Microsoft for nearly 6 years.

[the invisib1e hand]

yes, of course. next to exposure to linux or unix. as i said, i suspect a bit of ms-centricism on my part. it’s something they do well — well enough, at least. that notwithstanding, i trust my judgment about java and the java development community — at least in the financial svcs industry.

[DaxtonBrown]

Like I’m going to port 50,000 lines of Java code so I can be forced to buy Visual Studio and probably SQL Server till I die. I’ll take my chances.

[Lazamataz]

dot Net is remarkably secure, and it is the top pick for federal and state programming efforts -- in which security is obviously a huge concern.

I never knew Java was as insecure as this, but I have my concerns about Javascript that connects to SQL. I don't employ any such code. It may be secure, but I cannot see how, allowing a client to connect to a SQL server, is impervious to hacking.

I can collect my SQL results on the dotNet application server, behind a nice robust firewall, then deliver only the finished screen. It just seems like much better practice.

Oh, and don't get be going on "the cloud". Yeah, having someone else host my data, especially when that data contains PII (Personally Identifying Information) is the PERFECT recipe for security, right? NOT.

[Lee N. Field]

So it was again this week. For reasons unknown and unexplained, Microsoft pushed three .Net patches -- KB 2518864 (MS11-044, June 2011), KB 2572073 (MS11-078, October 2011), and KB 2633880 (MS12-016, February 2012) -- out the Windows Update chute. If you happen to be running Windows XP or Windows Server 2003, with .Net Framework 2.0 SP2 or 3.5 SP 1, and if you're naive enough to leave Automatic Updates turned on, you probably got nailed with a yellow alert icon that says, "Some updates could not be installed." Click through the alert and you see that Automatic Update couldn't install any of the three patches.

A bank I support had these show up, right in the middle of an IT audit. 30 machines showing unapplied updates! Teh Panics! It was all over with and resolved, by the time I showed up to resolve it.

[E. Pluribus Unum]

I hate Java.

[Lazamataz]

Is Java the same as JavaScript?

No.

[Hardraade]

They should run Oracle off the planet. A company that full of swindlers and criminals would ideally be listed as organized crime.

[no-s]

while you DON’T need to learn a new language to run .NET on a CLR-enabled machine.

I know this may be hard to swallow for folks who prefer software to be neatly categorized, but inability to learn new languages is a serious down-check on a career in software development. It simply demonstrates a serious lack of "knack". OTOH if you want to go for refusal to learn a new language because you already know the important ones, then you must already know java and lisp at least, in which case you have nothing to fear from either JVM or CLR platform and if successful, you probably don't have an issue with learning new things...

[CaptainK]

You read my mind ahead of time.

[cynwoody]

Is Java the same as JavaScript?

Not even remotely. Except for their C-ish syntax, the two languages have nothing in common.

JavaScript was originally supposed to be called LiveScript, but the marketdroids at Netscape (remember them?) changed its name just before its introduction in an attempt to ride the coattails of Java, which, at the time, appeared to be the Next Big Thing in browserdom.

[Carriage Hill]

Thanks; got it now.

[Dan Nunn]

Oh, and don't get be going on "the cloud". Yeah, having someone else host my data, especially when that data contains PII (Personally Identifying Information) is the PERFECT recipe for security, right? NOT.

Works for state and local governments.

I can't speak for every provider, but Amazon takes security seriously. Even their VP does not have access to the data centers.

[Wuli]

A wile back I uninstalled Java from my PC that was running XP; now maybe I should check what of Java came in my new PC running Win7.

[econjack]

Very very few sites use Java.

I disagree. I taught programming courses in the computer science dept at a Big Ten university and I know what drives most web sites, especially those doing e-commerce, and Java is king.

[Wayne07]

Yes, you are right that java powers a lot of sites on the server side. But what they are talking about is vulnerabilities in the browser when running applets, which are rarely used. Flash and JavaScript are the common choices for browser stuff that can’t be done with just HTML.