41–50 of 70 posts
Earlier quoted context omitted.
Any public-facing Java server affected by this bug that accepts floating point numbers from the user as a string can be hung by this bug. This is going to be a big problem.
I tried to dig up a list of websites with a java-backend but my google-fu is not strong enough. I don't think that there are actually many big sites running on java.
I remember when everyone was bashing PHP ( http://news.ycombinator.com/item?id=2066084 ) when they were bitten by the same issue. Then there were articles about this being maybe a GCC bug or at least design issue but people were still saying that it's PHP's duty to take care of this. I was always afraid that this might bite other environments too as the code that caused the issue in PHP was apparently taken from else…
Rasmus just tweeted about it: Java's turn to deal with the x87 register issue. Here's a hint Oracle, "volatile" http://twitter.com/rasmus/status/32365768603602944
Volatile keyword in Java does not guarantee writing to memory and reading it back (http://java.sun.com/docs/books/jls/third_edition/html/classe...), but using strictfp as a modifier to the method should cause the usage of strict IEEE 64-bit floating point.
Earlier quoted context omitted.
So they're not falling over themselves to fix a bug which no one has noticed for 10+ years, and which hardly anyone is going to hit in actual use. Maybe they're spending their time fixing problems which are actually affecting developers.
Any public-facing Java server affected by this bug that accepts floating point numbers from the user as a string can be hung by this bug. This is going to be a big problem.
I expect a lot of teams will have to rush out a patch. I feel for them...
Incidentally, I haven't seen a simple workaround posted anywhere. Has anyone seen a regexp or code snippet that can identify strings which would trigger this bug?
If I'm not mistaken, this is bad : it enables a trivial DOS attack against any web service that accepts floating-point input. (For instance, one of the commenters on the OP noted that Google Spreadsheets backends are vulnerable.) This includes, as a special case, any service that accepts JSON input. I expect a lot of teams will have to rush out a patch. I feel for them... Incidentally, I haven't seen a simple workaro…
Earlier quoted context omitted.
I tried to dig up a list of websites with a java-backend but my google-fu is not strong enough. I don't think that there are actually many big sites running on java.
There are tons of sites running on java. Possibly more than php.
Anecdotally, a lot of those [\w+]tube porn sites probably run on a Java server considering the heavy lifting that goes on there.
What about android?
Earlier quoted context omitted.
Any public-facing Java server affected by this bug that accepts floating point numbers from the user as a string can be hung by this bug. This is going to be a big problem.
And yet...in 10+ years...it hasn't been a problem? Certainly the need to fix it but saying it is going to be a "big problem" is a bit theatrical.
Imagine your response, but about a kernel privilege escalation bug:
"And yet...in 10+ years...it hasn't been a problem? Certainly the need to fix it but saying it is going to be a "big problem" is a bit theatrical."
If I'm not mistaken, this is bad : it enables a trivial DOS attack against any web service that accepts floating-point input. (For instance, one of the commenters on the OP noted that Google Spreadsheets backends are vulnerable.) This includes, as a special case, any service that accepts JSON input. I expect a lot of teams will have to rush out a patch. I feel for them... Incidentally, I haven't seen a simple workaro…
Maybe I'm dense, but why does this affect apps that use JSON?