"Get Java Fixed Up"
This was a quote from a recent conference call hosted by Oracle (details on the call are here http://www.scmagazine.com/oracle-speaks-promises-to-get-java-fixed-up/article/277898/ ) In that call, Oracle's full quoted statement is “The plan for Java security is really simple, it's to get Java fixed up, number one, and then, number two, to communicate our efforts widely. We really can't have one without the other.”
This sounds very positive, right? With Java 6 rolling into "unsupported" status soon, and real problems (and no emphatic fix in sight) in Java 7, this sounds like good news for folks who need Java day-to-day, in support real business functions.
Ummm - not so much for me. <personal opinion follows> They make it sound like this might be something they can do in a couple of weeks, and fix with a service pack or a version update. When Microsoft was in a similar situation, they shut down development completely and re-tooled their methodology. I think Oracle is in a similar situation right now, but aren't coming clean like Microsoft did back in the day (2002 - it doesn't seem that long ago to me ...)
While the current round of vulnerabilties in Java can certainly be resolved in the current framework, I think that if they don't retool their Development, Test and QA methodologies to place a higher emphasis on Security in the final product, we'll be having this same discussion again and again.
Putting a change freeze in for new features would be another excellent thing to do. Given recent events, freezing dev for an audit and security effort is likely a really good idea. I get the impression that in the race for new features, there's a significant "technical debt" on the security side that is coming home to roost.
I think that Oracle, and a few others while we're discussing it, need to take a close look at what Microsoft did those few short years ago, and make some big changes on how things get written and rolled out.
Again, just my opinion. Feel free to set me straight (or even agree with me) in our comment form.
===============
Rob VandenBrink
Metafore
Comments
Phil
Jan 29th 2013
1 decade ago
Adobe is on my hit parade these days also, on my Macintosh I can get away with using Quicktime's partial implementation of flash most of the time and avoid the almost daily Adobe patches. Most other users are not so lucky.
The crazy thing about all of this is that if these companies focused on doing things right then probably 70% of our software security problems would disappear overnight. Think of how much money is tied into all the extra application security layers we buy because all our software is so buggy. Think of how much money is stolen because of these same problems. While not 100% it is the closest by far to a silver bullet for security, buy software designed to be solid and secure from the start. Spend a little more now and save a ton later.
BGC
Jan 29th 2013
1 decade ago
1- Just because we can do it, should we
2- How can we make it secure
It seems to me that they are not asking themselves either one because all the new code, which is a mess IMHO, is where all the vulnerabilities and recent 0-day issues lie.
I think Oracle is where Microsoft was in 2002 but lacks the commitment and possibly the expertise needed to properly do what is needed to correct this whole mess. Time will tell, but right now that time is in rather short supply and running out very quickly.
toymaster
Jan 29th 2013
1 decade ago
Sean
Jan 29th 2013
1 decade ago
http://www.oracle.com/technetwork/java/javase/7u13-relnotes-1902884.html
Ken
Feb 1st 2013
1 decade ago