Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Java Pain

tbray.org

Post reply on HN
Print view View original

81–90 of 151 posts

Re: Java Pain

#81

Post by scotty79 »

Java is Enterprisey. Enterprises survive and operate only because they by freak accident at some point began earning way too much money. They employ lots of people who have no incentive to save work. We are paid for our work. Effects of the work are secondary to almost everybody in corporate world. Why trouble yourself with figuring out code if you can get paid all the same for tinkering with claspaths and poms for few days.

Java is a decent language but its developers have way too much tolerance for pointless hoopjumping.

Re: Java Pain

#82

Post by jcape »

skywhopper wrote: post #75

I know Java well, though I'm not primarily a developer. As a DevOps guy, there are a few places where I'd love to be able to write a quick program in Java to take advantage of one API or another, or to ensure compatibility with the app I'm trying to manage or what have you, but between the boilerplate, the classpath, the compilation step, and the awkward command line, it's almost never worth it, and I write it in Rub…

No. HTTPS should be secure out of the box. If you want to break HTTPS then you should have to do work.

Re: Java Pain

#83

Post by Eridrus »

skywhopper wrote: post #75

I know Java well, though I'm not primarily a developer. As a DevOps guy, there are a few places where I'd love to be able to write a quick program in Java to take advantage of one API or another, or to ensure compatibility with the app I'm trying to manage or what have you, but between the boilerplate, the classpath, the compilation step, and the awkward command line, it's almost never worth it, and I write it in Rub…

I'm not sure why Java is taking a bullet on this.

The default in other languages is often to not do any certificate validation.

That seems like the worse approach since no-one can tell their code is insecure. Maybe fine for a scripting tool, but I wouldn't want that on my production boxes.

I'm not sure why every language needs to be useful as a scripting tool. If there are things that help the common case and also scripting (eg classpaths being a pain), there's obviously an argument for "why the fuck hasn't this been fixed yet", but in other cases there are either fundamental tradeoffs or resource constraints.

Re: Java Pain

#84

Post by Eridrus »

idbehold wrote: post #71
jakozaur wrote: post #63

Quite a lot of languages let's you do https, but just give you illusion of security. Not really validating it, which is trivial to spoof with certificate signed by "your own authority". "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software" https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Wow, does this imply that the Heartbleed bug might end up being even more damaging that previously thought? This paper shows that even if you've already revoked your old certs, many pieces of widely used software don't even bother validating them.

This has nothing to do with heartbleed. This means you can just generate certs on your own machine that a lot of software will simply accept.

Re: Java Pain

#85

Post by exabrial »

suprgeek wrote: post #80

Given Suns history with EJB 2.0, I would humbly submit that "ease of use", work out-of-the box etc should not be the default expectations with Java. Having said that (snarky response) having worked with Java from 1.1, I think the language is moving in the right direction. The latest release (8) adds a ton of syntactic sugar and there is a real impetus towards easier more dev friendly features. Plus Java needs a non-b…

Amen for breaking backwards compatibility. Needs to happen soon so the CRUFT can be cut out of JEE.

Re: Java Pain

#86

Post by Eridrus »

simonw wrote: post #16
CmonDev wrote: post #7

"Dear Java: I can run Ru­by and Python and Go and JavaScript and C code from the com­mand line on my Mac." - to be fair most of those languages are scripting languages.

In my opinion, the difference between "scripting" languages and other languages hasn't been relevant for about a decade.

I think the issue is now more one of language philosophy than language implementation now.

In my mind languages tend to have an optimal code size where they work well, and what works at <1000 lines often does poorly at even 10k lines.

Re: Java Pain

#87

Post by jcape »

scotty79 wrote: post #79
sid- wrote: post #39

In java to be able to crawl a https url you have to do the following - http://www.coderanch.com/t/134619/Security/JDK-trust-Certifi... Its easier in other languages but its not that hard in java. Just export certificate via IE and save to disk and from the jre/lib/security folder and issue one command keytool -import -alias mycert -keystore cacerts -file d:\mycert.cer. (default password is changeit) Done.

Why must you do that? And why you don't have to do that for environments of modern llanguags?

tl;dr: Other environments are insecure out of the box, and require applications specifically opt-in to security. Java requires you opt-out of the security.

HTTPS is built on top of PKI, which involves a list of trusted root authorities who verify that the certificate for blahblah.com is actually for blahblah.com. A self-signed certificate won't have that, and any application that doesn't validate that the certificate is signed by a trusted authority and not expired, etc. has no security.

If an application doesn't validate it's certificate, anybody sitting between you and the HTTPS server can step in between you and your traffic, give you a phony certificate, and then proxy all your "secure" traffic to the HTTPS server. And, of course, "sitting between you and the HTTPS server" means not only the NSA with their low-latency network specifically built to conduct these types of attacks, it also means the guy in the corner at Starbucks too (because WiFi is a radio).

Java only actually started checking if certificates were valid very recently (IIRC it was J7, r51). Prior to that, Java was just as lax as every other toolkit---probably specifically to address complaints like Bray's: "testing HTTPS is tough".

Re: Java Pain

#88

Post by syncsynchalt »

xxs wrote: post #34
tjr wrote: post #31

Earlier quoted context omitted.

Referring to things like unusual command line options as "incantations" has been reasonably common across the history of computer usage at least from the 1970s or so, if not earlier. See: http://www.catb.org/jargon/html/I/incantation.html

what's so unusual about -cp (or "-classpath")

That's unixese for -c -p, for one. -C or --classpath= would be more typical.

Re: Java Pain

#89

Post by brendano »

x0x0 wrote: post #47
schmichael wrote: post #15

The confusing series of shell scripts most Java services (Cassandra, Kafka, Elasticearch) come wrapped in are a constant annoyance. Not only do they rarely if ever follow common shell command idioms, but trying to configure production services turns into tracing environment variables through a series of shell scripts sprinkled across my system. It's nothing wrong with Java the language, but the platform just seems to…

I was about to say "omg yes" -- as someone who writes piles of java code, this is a constant pain. However, look at the other tools: I run python out of a virtualenv. I use rvm to run multiple rubys, and that shit breaks all the time for me. (Or rather, I use it infrequently enough that I never learn it well enough; I use it for the first time again every 2-3 months). That said, java is a special bit of shit. Those s…

    1 - why can't I import a directory full of jars? eg
       --classpath ./lib/jars/*
    or better yet, recursively descend
       --classpath ./lib/jars/**
I usually do this as (in zsh):

   -cp "$(print -l ./lib/jars/**/*.jar | tr '\n' :)"

Re: Java Pain

#90

Post by haddr »

x0x0 wrote: post #47
schmichael wrote: post #15

The confusing series of shell scripts most Java services (Cassandra, Kafka, Elasticearch) come wrapped in are a constant annoyance. Not only do they rarely if ever follow common shell command idioms, but trying to configure production services turns into tracing environment variables through a series of shell scripts sprinkled across my system. It's nothing wrong with Java the language, but the platform just seems to…

I was about to say "omg yes" -- as someone who writes piles of java code, this is a constant pain. However, look at the other tools: I run python out of a virtualenv. I use rvm to run multiple rubys, and that shit breaks all the time for me. (Or rather, I use it infrequently enough that I never learn it well enough; I use it for the first time again every 2-3 months). That said, java is a special bit of shit. Those s…

Ad 2: Things evolve. If you stopped somwhere in the mid 90, you won't notice. But in Java 8 you can do null checking easily using Optional. Your example would be: String address = a.map(A::b).map(B::c).map(C::d).orElse("UNKNOWN");
Post reply on HN