Hacker News Reader

It's about time, they should also get rid of Web Start support. I would imagine those 2 account for a good chunk of the security alerts/updates over the years.

View on HN

People keep bashing Java for its security record. And yet, for example:

Firefox 44: 12 security fixes including 3 critical vulnerabilities

Firefox 43: 16 security fixes including 4 critical vulnerabilities

Firefox 42: 18 security fixes including 3 critical vulnerabilities

On the evidence so far, I’m not sure browsers, as they expand to try to do more of the things we used to use plugins for, will necessarily prove to be significantly safer than what we had before.

I think a lot of it is because a lot of the bugs was so easy to exploit.

I'm not actually bashing Java's security record, I'm just hoping they get rid of the obsolete stuff that nobody should be using anymore.

I can see how Web Start can be a security hole. There are a few, very few, times where being able to run code on the client is not only useful but the best way to solve a problem. Is there an easier way to distribute a Java app than Web Start?

Reply on news.ycombinator.com