Hacker News Reader

Java and trivially exploitable RCE are certainly believable.

Java doesn't make exploitable RCEs more or less possible than any other programming language. Or do you have something to back this up beyond the common "Java be bad" trope?

Java certainly has a long history of RCEs caused by Java Serialization.

Comparing Java Serialization with $language Serialization, and the usage of both of the languages, does Java have more RCEs per line written than $language? Or is it just a function of its popularity?

The java ecosystem has a frustrating habbit of solving problems with java's lack of expressiveness with layers of expression and templating languages, and has had some nasty RCE's as a result. (see: OGNL, freemarker)

I don't know if it's better or worse than other languages but let's not pretend it's not a problem.

As compared to which language that does it significantly better?

https://www.sourceclear.com/vulnerability-database

Everything is a mess, no matter the language.

Reply on news.ycombinator.com