New Java 0-Day Vulnerability Being Exploited in the Wild • Hacker News Board

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#71

Post by Encosia » Sat, Mar 02, 2013, 1:34 AM UTC

tomjen3 wrote: post #64

Mahn wrote: post #58

World would be such a better place if we could get rid entirely of Flash and Java for the web. It's not only the exploits, the fact that they are so frequent also means users got to update both Java and Flash almost every single day, which is a terrible user experience.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

There are solutions in the works, but precisely timed audio (like games need) is still problematic in HTML5.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#72

Post by kicktheshoe » Sat, Mar 02, 2013, 5:56 AM UTC

0x2232 wrote: post #68

The best thing to happen to Java was Google supporting Android. Now we have probably 5 more years of this mess until we get good adoption of a real linux phone, then Java will be tossed onto the already rotting corpse of flash.

Hardly worth bothering to reply to this sort of nonsense, but applets are a tiny tiny fraction of a percent of what Java is used for. Java and other JVM languages are use in most backend systems today and also by the likes of google, amazon etc.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#73

Post by tomjen3 » Sat, Mar 02, 2013, 8:28 AM UTC

Encosia wrote: post #71

tomjen3 wrote: post #64

Earlier quoted context omitted.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

There are solutions in the works, but precisely timed audio (like games need) is still problematic in HTML5.

That is funny, but we haven't had that problem.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#74

Post by tomjen3 » Sat, Mar 02, 2013, 8:29 AM UTC

_delirium wrote: post #67

tomjen3 wrote: post #64

Earlier quoted context omitted.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

Flash still seems more popular for webgame development. I've run across a handful of HTML5 games, but many more Flash games. Not entirely sure why. Libraries, maybe? Is there something comparable to Flixel for HTML5?

Createjs?

Or just write your own.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#75

Post by coldtea » Sat, Mar 02, 2013, 10:20 AM UTC

I would guess those Java "0-day" vulnerabilities have been known for months or years.

It's just that now, because of the previous spread of 2-3 vulnerabilities, the publicity and the extra scrutiny placed upon Java bugs by Oracle, those holding on to them started selling/using them in fear that they will be discovered and patched soon.

It's a use-it-or-lose-it kind of thing.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#76

Post by stock_toaster » Sat, Mar 02, 2013, 10:36 AM UTC

mdaniel wrote: post #29

sc0rb wrote: post #27

Earlier quoted context omitted.

I use Java in the browser. The way you use your computer is not the same other people may use theirs. We have a web based VPN tool that has to use Java.

I've had good experiences so far by keeping a dedicated browser for use with "legacy" services (such as school) that require Java. I haven't tried it, but I would suspect the profile manager in Firefox may help with that kind of setup, too.

Maybe a dedicated vm for anything that requires java would be safer these days. :/

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#77

Post by Liongadev » Sat, Mar 02, 2013, 12:00 PM UTC

tomjen3 wrote: post #64

Mahn wrote: post #58

World would be such a better place if we could get rid entirely of Flash and Java for the web. It's not only the exploits, the fact that they are so frequent also means users got to update both Java and Flash almost every single day, which is a terrible user experience.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

99% of all Webbased gaming is flash. Why? Because HTML5 is about at a point where flash was 5 years ago. Thats not just my opionion but facts (see all game portals, FB game etc.) and what the big guys say (http://www.wooga.com/press/releases/wooga-html5-project-goes...)

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#78

Post by kedean » Sat, Mar 02, 2013, 6:58 PM UTC

speeder wrote: post #44

Java should change their logo from a coffee to some swiss cheese. I want to know two things, first: Why huge banks (the sort that net profit 10 billion) and other big organisations (like, governments) insist in using Java Applets for browser security and auth? second: Why JVM is full of holes while JVM clones (like Dalvik and open source JVM substitutes for desktops) seemly are so much less affected?

Banks are notoriously bad about updating their technology practices. They didn't really stop using DES in their ATM's until it was required by law that they update to 3DES in 2002 (DES encryption has been theoretically broken since the 80's and practically, that is it was done in something like 17 days, broken since the 90's). For them, the potential losses from java exploits just don't outweigh the price of switching the infratstructure in place.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#79

Post by radd9er » Sat, Mar 02, 2013, 9:39 PM UTC

tomjen3 wrote: post #64

Mahn wrote: post #58

World would be such a better place if we could get rid entirely of Flash and Java for the web. It's not only the exploits, the fact that they are so frequent also means users got to update both Java and Flash almost every single day, which is a terrible user experience.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

Using the html 5 video player sucks pretty bad in my experience (coursera).

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#80

Post by mdaniel » Sat, Mar 02, 2013, 11:21 PM UTC

stock_toaster wrote: post #76

mdaniel wrote: post #29

Earlier quoted context omitted.

I've had good experiences so far by keeping a dedicated browser for use with "legacy" services (such as school) that require Java. I haven't tried it, but I would suspect the profile manager in Firefox may help with that kind of setup, too.

Maybe a dedicated vm for anything that requires java would be safer these days. :/

I have two observations about that kind of plan.

First, it would be significantly more of a hassle to boot up a separate OS for the purpose of executing a short-lived task (such a submitting homework, or doing banking, as others have mentioned). Related to that, there is a slight disconnect between the host filesystem and the guest filesystem. The more convenience one has (e.g. greater transparency and sharing) the greater the risk.

Related, but separate from that: how would you know the VM was compromised and thus should be destroyed? One could presumably just periodically destroy (or revert to snapshot). Perhaps even if it was compromised, maybe the short lifespan of the VM would limit the damage to others.