Oracle releases 127 security fixes, 51 for Java alone

Bryan Cantrill on Oracle:

"As you know people, as you learn about things, you realize that these generalizations we have are, virtually to a generalization, false. Well, except for this one, as it turns out. What you think of Oracle, is even truer than you think it is. There has been no entity in human history with less complexity or nuance to it than Oracle. And I gotta say, as someone who has seen that complexity for my entire life, it’s very hard to get used to that idea. It’s like, ‘surely this is more complicated!’ but it’s like: Wow, this is really simple! This company is very straightforward, in its defense. This company is about one man, his alter-ego, and what he wants to inflict upon humanity — that’s it! …Ship mediocrity, inflict misery, lie our asses off, screw our customers, and make a whole shitload of money. Yeah… you talk to Oracle, it’s like, ‘no, we don’t fucking make dreams happen — we make money!’ …You need to think of Larry Ellison the way you think of a lawnmower. You don’t anthropomorphize your lawnmower, the lawnmower just mows the lawn, you stick your hand in there and it’ll chop it off, the end. You don’t think ‘oh, the lawnmower hates me’ — lawnmower doesn’t give a shit about you, lawnmower can’t hate you. Don’t anthropomorphize the lawnmower. Don’t fall into that trap about Oracle." [1]

[1] http://news.ycombinator.com/item?id=5170246

> I just get the feeling that Oracle doesn't really give a shit about anything other than that god damned boat.

I was helping out a cousin install Oracle on Oracle Linux, and I found it way too complicated to set up. Installing their flagship product on their official distribution was a pain. All they could have done is provide proper repos/rpms. It's sad that they couldn't get that right.

Personally, I think they ended up getting excellent advertising value for their money. Especially with the win and that being a big news story.

That whitepaper isn't really FUD. It's basically just explaining 'open source' to people who don't really get it. The paper explains that Oracle software includes open source software and then Oracle is arguing that they do a better job of developing, leveraging, integrating, and supporting FOSS than IT workers in gov't offices can. It's a fairly reasonable argument.

You claim you read it, but they don't say that at all.

What they're specifically saying is that government is not the ideal entity to be shepherding OSS projects. More specifically - Large Scale OSS projects that require a rigorous process and are mission critical. They observe that OSS Projects exhibit high quality primarily (though not exclusively) when there is a large financial motive to make the project high quality. (E.g. Linux, Firefox, and the other big hits).

Now, Oracle might be against-OSS in general, but this paper is not the "FUD" that you're looking for.

That whitepaper is for management and purchasing. The security patches are for the poor sysops who have to look after the mess left behind by the former.

Every large commercial software company is just as bad. It was only a few years ago that Microsoft were doing the same, until they realised they could monetize open source software themselves[1] as well and decided to stop the badmouthing.

[1] through azure and buying into major open source ecosystems to gain mindshare.

It basically was Sun's way to make budget. I would hope Oracle just does away with it.

https://jonathanischwartz.wordpress.com/2009/05/18/will-the-...

We signed a contract through which we’d make their toolbar optionally available to our audience via the Java update mechanism. They paid us a much appreciated fee, which increased dramatically when we renegotiated the contract a year later. Distribution was becoming quite valuable to us and to them – and given the “take” rates, or the rates at which consumers were choosing to install new content, the Java audience saw value in the new application.

The year following, the revenue increased dramatically again – when an aspiring search company (again, you can figure out who) outbid our first partner to place their toolbar in front of Java users (this time, limited to the US only). Toolbars, it turns out, are a significant driver of search traffic – and the billions of Java runtimes in the market were a clear means of driving value and opportunity. The revenues to Sun were also getting big enough for us to think about building a more formal business around Java’s distribution power – to make it available to the entire Java community, not simply one or two search companies on yearly contracts.

And that’s what Project Vector is designed to deliver – Vector is a network service to connect companies of all sizes and types to the roughly one billion Java users all over the world. Vector (which we’ll likely rename the Java Store), has the potential to deliver the world’s largest audience to developers and businesses leveraging Java and JavaFX. What kinds of companies might be interested? If you talk to a Fortune 500 company or a startup, pretty much everyone craves access to consumers – which is the one problem we’ve solved with the Java platform. Most folks don’t think of Sun as a consumer company, and largely we’re not, but our runtimes reach more consumers than just about any other company on earth.

-Jonathan Schwartz

Just get the JRE from

http://www.oracle.com/technetwork/java/javase/downloads/inde...

That garbage is just from the consumer web site and no different than bundlings from other corporations, like Adobe and Google.

I also don't want the Google Toolbar or McAfee installed.

If you posted a comment to HN with 127 spelling mistakes, which you then corrected, should you be applauded for that?

I think that's because the Java Control Panel updates the JRE, but that just updates the plugins and stuff. The manually downloaded JDK pkg definitely will update the java you invoke in the shell.

Most of it is politics. Applets aren't fundamentally more insecure than other competing technologies like Flash or Silverlight. They just got a lot of hate, first due to the Microsoft "embrace and extend" attempts in the 90s (shipping its own awful JVM) and now again due to the buyout by Oracle with its horrible PR.

It's nonsense that modern browsers treat Java applets as if they were radiactive material, showing lots of warnings and scary dialogs (and even forcing you to update) while they do nothing of the sort with Flash.

Because the full power of Java exists in Applets. Browsers do their best to sandbox it and to make sure users give permission before it is allowed outside the sandbox. There are probably other reasons too, but that's afaik the basic reason.

I think it's a little unfair how the whole industry has treated Applets vs. Flash. Applets were pretty nice but Sun couldn't really fight it out like Adobe did against the other larger players.

Anyhow, I disabled Applets and Flash recently myself too. The web works ok, thanks to Apple I guess, but I still need to flip on Flash occasionally.

Java was invented as a full fledged vm with libraries that provide disk access, start and stop processes, taking screenshots etc.

In contrast, Javascript didn't even have these ideas. The only file access it has are through APIs like reading and writing cookies, and file uploads. Another example is Silverlight. Silverlight only provides a limited set of APIs that access the file system. For example, you cannot read any file unless it was initiated through user interaction via OpenFileDialog.

Sandboxing, i.e. preventing untrusted code from calling privileged libraries like disk access through walking the call stack and making sure the call originated from a trusted source. This was tricky but it worked. In Java 7, a new object was invented, called the MethodHandle. This is functions as a first class object, and I suspect that when Oracle bought out the Sun, they lost some key engineers and there has been a slew of exploits via MethodHandle. Hopefully, this patch caught all of them.

If the JRE allows someone to make a system call, it's a feature. If the plugin allows the same call, it's a critical software bug.

They're not really the same thing. People rely (to a greater or lesser degree) on VM security guarantees for running less than fully trusted code in a variety of contexts - I say VM rather than JVM to include Dalvik, JS engines, etc. People don't run random untrusted C and C++ code.

Fine, go read the bug trackers for them. Your point was? Oh, probably better to spend the time patching your desktop and servers given the massive drive through holes Java has left there.

What does "remotely exploitable" mean, though?

What would "authentication" mean, in this context?

I think what this must mean is that IF you click through the various dialogs to enable an applet or Java webstart application to run in your browser (or be launched from it), at that point the running code could do something bad. Perhaps these are ways to escape the normal applet sandbox?

And "exploitable without authentication" I guess must be about... what, signed JARs? That's a sort of authentication, and I can't imagine what else this could be talking about.

That's not so amazing, really, or even very scary, because the user has to explicitly click at least one (usually more) dialogs before the code will run. On some browsers, there are many more steps involved because Java is disabled by default (and even re-disabled by default if you don't use it for a while), and you have to figure out how to enable it first. On some browsers (like Chrome on OS X) Java simply doesn't work, so it's out of the question.

This is where a lack of detail really harms the point -- if they walked through the actual steps involved in using any of these exploits, people would have a much better idea of what was actually at risk. My suspicion is that for anyone who doesn't approve applets on shady sites, the risk is negligible.

About half of them have been patched in Java 5, more details here:

http://www.oracle.com/technetwork/topics/security/cpuoct2013...