Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by logn | Hacker News Reader

Parent Full thread

logn·

Desktop Java apps should just bundle a JRE.

Launch4j: http://launch4j.sourceforge.net/

Legality: http://www.oracle.com/technetwork/java/javase/readme-142177....

View on HN

At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac-like attitude though.

Almost all exploitable vulnerabilities are related to the browser plugin. There's no danger of keeping outdated JRE inside some application.

Unless you need Java Secure Sockets Extension to work - see smacktls.com.

But you only need to update the JRE's that interface with the outside world, and unless there are bugs in the JVM's network code that would be only your Java browser plugin.

There have been bugs in networking related code in the JRE. For example, I believe it was recently discovered that their SSL implementation was completely and utterly broken and enabled a MITM attacker to totally disable encryption (the SKIP-TLS attack). Guess what most software is probably relying on to protect their auto-updater?

They SSL implementation was broken against an active attacker - this is very different from being broken totally. Obviously it is still very, very bad but it doesn't mean you shouldn't use it if you are not going to replace it with anything else.

New versions of IntelliJ IDE EAPs come with a JRE runtime if you choose that option. Jetbrains developers had major problems with subpixel font rendering on post-Apple JREs so they forked OpenJDK I think to fix it.

Nothing in that link claims that apps have to 'just' bundle the JRE only.

Reply on news.ycombinator.com