Hacker News Reader

Comment by yellow_lead | Hacker News Reader

I wouldn't agree that these are "pretty old." Maybe in frontend terms of software, but not backend.

2-3 years is pretty old.

Java backward compatibility is really good, even better when it's on the same major I don't see why you shouldn't update. You have a docker image with java, just pull the base image before you build, you run it bare you/need to update the server packages periodically, better if you have unattended update setup (default in recent ubuntu versions tho might need a server restart for some to apply) It's not like between java updates there aren't any security fixes, there are so you should update.

Nevertheless other mitigations like not exposing internal services to the internet would have blocked these attempts.

> 2-3 years is pretty old.

In the JS or NodeJS world, sure. For pretty much everyone else, not so much.

I wasn't talkin about a 3rd party library, Java is your runtime platform it has security fixes roll out.

If you are an enterprise company that runs 3 year old java version then

1) Your CSO and CIO should all be fired

2) Your security team should be replaced

3) Your ISO 27001 and SOC2 certification among others should be revoked

Glass houses: https://snyk.io/vuln/npm:lodash@4.17.15 / http://ariagno.com/spotify/

Until two months ago the LTS release of Java - Java 11 - was 2 years old.

Not sure what you are talking about.

Java 11 was released on 2018-09-25

Java 11.0.2 that contained the "fix" was released on 2019-01-15

Java 11.0.13 (latest) was released on 2021-10-19

Also Java 8u192 was released on 2018-10-16

I think you and parent(s) kept exchanging messages which conflated major and minor Java versions.

Java 11 as a major is not old, it’s probably the best GA version right now, 17 is at a very early adoption stage.

Openjdk 11.0.0 would be too old, though.

If it's an enterprise running a 3y old JVM, what makes you think they have a CSO, CIO, or security team?

For internet connected software, it's pretty old. If you don't update for 3 years and expect to still be secure, you are in for a shock.

Obviously you shouldn't go three years without security patches. But it's perfectly reasonable to not update to a new major version for three years.

Not keeping up with patch versions of your runtime.

As other comments mentioned even with a patched JDK you are still vulnerable in other ways, but the specific method this whole thread is about seems to have patches in Java 8 and 11 releases.

I understand that lagging new major releases by years and be prudent for different apps, but there is no excuse not to be updating your patch versions.

Something that's 2-3 years old maybe has enough bugs worn off it by the early adopters that enterprise users might start thinking about maybe using it in Q4 of next year. After a massive pilot program to do a test rollout and lab deployment.

They are. You should have an up-to-date runtime to prevent vulnerabilities or just to have more-or-less accurate TZ databases if anything else.

It can be Java 8, but please use one with actively developed security patches.

Reply on news.ycombinator.com