Hacker News Reader

Comment by ar9av | Hacker News Reader

Gist: ``` JDK 20 introduces six features: - Scoped values for safe sharing of data across threads - Record patterns for declarative data navigation and processing - Foreign function and memory API for interoperation with code and data outside the Java runtime - Virtual threads for lightweight concurrent programming - Structured concurrency for simplified multithreaded programming - Pattern matching for switch statements and expressions for concise and safe complex data-oriented queries ```

View on HN

...but also thousands of other stability, performance, and security updates.

Don't worry, someone will still manage put in a bug that results in a zero day in the next 2 years.

While the Java community has had some high profile vulnerabilities, I can't recall a major one that was actually tied to the JVM itself since dropped applets. Instead it's usually a popular library or framework.

> I can't recall a major one that was actually tied to the JVM itself since dropped applets.

Not exactly tied to the JVM, but IIRC one of the prerequisites for the Spring4Shell vulnerability was the existence of a new method added by Java 9. If you were still on Java 8, you were not affected.

Correct, but the reason those happen is because JDK, despite being on version 17 is still missing core features that are necessary for modern day use, like logging, backend web stuff, json parsing, e.t.c. So delegation to that is left to a large number of 3d party developers, and risk of pollution goes up, especially when you consider that there is financial incentive in the case of orgs like Apache to keep developing new features.

There should be no reason why someone deliberately writes code for a logging library to go fetch and execute code over the internet, and make that the default behavior. The fact that someone did that, and it got approved and published to production, should be an indicator for anyone competent to stay away from Java completely. There is plenty of other compiled languages out there for whatever use case you need.

As opposed to what, powering off your servers so they can never get vulnerable?

As opposed to not using an enterprise, outdated language that is only used to essentially create jobs.

Reply on news.ycombinator.com