Re: Java Security issues

Hello Rob,

Am 30.09.2021 um 14:08 schrieb Rob Berendt <rob@xxxxxxxxx>:

This makes java globally. This is where the tinfoil hat crowd has an issue.

The issue is real and not a question about being overly cautsuspicious. If you look at the long history and frequency of Java updates from Oracle, it's hard to believe all security issues are fixed by now. I was always facepalming myself when I saw Oracle Java installer's advertisement that Java is running on billions of devices — so I assume they know how important it is. But they still didn't push enough resources into a wholesome code audit and maybe a rewrite from scratch.

I can't prove, only guess, that all derived Java implementations suffer from similar issues. Oracle Java is convenient, because it alerts whoever is sitting in front of the computer that yet another update is available. This is not the case with other implementations, AFAIR. Which in turn might create a probably wrong sense of security.

It's good that Java has been banned as plugin from most browsers today, lessening the attack surface considerably.

Java looks good on power point. But in reality, it leaves much to be desired. Still, there are applications like iACS, or yEd which stand out as well designed and which I'm using myself, despite my dislike against Java.

You could also install java locally to the application itself. iACS supports this. Makes it a lot easier for those who hike around with iACS on a thumb drive. When installed locally java will not be activated by clicking on links on websites.

Yes, and is a waste of resources like every application brings its own set of DLLs. To me, your proposal is just another workaround

No personal offense meant!

:wq! PoC