Hacker News Reader

Comment by robomartin | Hacker News Reader

Is there an up-to-date document of Java security issues somewhere, preferably with explanations?

I don't use Java much these days but I am teaching my kids OOP using Java. I'd like to also take the opportunity to show him where the warts are.

View on HN

In the service of "teach him to walk prior to attempting to teaching him to run", maybe you could start with a discussion of software security, and then show him an example of how bad guys can use good code that looks trivial to do things you don't want them to do. You can come up with numerous vulnerabilities in application code using any reduced subset of Java which he understands. Without that background, he'd have to learn an awful lot of Deep Magick about J2EE to understand what is happening here.

For a simple example, write a bare bones web server where localhost/dir/file.html serves documentroot/dir/file.html.

Extend it with directory browsing, if you want.

Then, show them the joy of localhost/../../secret/mydiary.txt

> I am teaching my kids OOP using Java.

I'd suggest doing it with Smalltalk, Ruby or Python. If I had to learn to program with Java, I'd open a restaurant.

Tons of people have learned to program with Java. Might not be as elegant as other languages but the fundamentals are the same.

Why not use something nice if you have the chance? Using your arguments about fundamentals, it's not even necessary to treat him computer science, he could just learn maths and he has all the foundations he needs.

> Tons of people have learned to program with Java

http://en.wikipedia.org/wiki/Argumentum_ad_populum

> the fundamentals are the same.

Only if all your fundamentals are restricted to what Java implements. A student that knows only Java may have trouble using multiple inheritance, first-class functions or prototype-based inheritance. I've seen a lot of Java programmers who cannot grasp these ideas and get utterly lost. It's not fun to watch.

Or at least Scala...

Not quite sure Scala is a good language to learn in. Learning curve is higher than other languages.

I'm biased as I already knew Java when I learned Scala, but Scala, if you ignore the crazy parts (e.g. don't look at the scala own sources for example) then it's quite a simple language. Much simpler than Java in my very humble opinion, it feels a lot like Ruby / Python to me actually. Another advantage I find in Scala, is that for new learners, they get the safeguard of a typed language and all the protection that comes with it, if you write incorrect syntax, you get an immediate feedback, and for new learners, I think it's a great feedback loop. Although I really like Python, I found that implementing things in it for the Udacity CS courses for example, is much harder for me (just because I'm less familiar with Python probably) than Scala, I tried implementing the same homework in Scala, and it was much more intuitive, especially collection handling, and writing "functional style" code, and I didn't have to go to the web and read the docs every seconds because of the notorious, loved to be hated, heavy but yet spoiling comfort of the IDE's content assist. Anyway, it's a matter of taste, and I like the Scala flavor. But here I am spending more time on the Ruby tutorial than on the Play framework tutorial, so I guess the language itself is not all that matters...

Not sure that showing them security vulnerabilities in the JVM is going to do much good if they are still in the learning phase.

http://www.metasploit.com/modules/framework/search?utf8=%E2%... is a good start.

That's a nice site, thanks.

Reply on news.ycombinator.com