When reading up on this article when the news broke....I stumbled on some article stating that Oracle knew about this particular vulnerability at least 6 months ago.
That's insane, irresponsible, and shameful... almost sounds like Java is being developed and maintained by the government.
I think the explanation for Java, VBA before that etc. is far simpler than that: the vendors (Microsoft, Sun/Oracle) are really only trying to push their tech.
VBA was the first big one and Microsoft basically used it to bolster Office's dominance by allowing various programmers (meaning not a big software house) to build on Office for 'custom' solutions. But in their rush to market security was a distant third or fourth. Once a few hackers realised how insecure it was, exploits were quick.
Of course, this was in the 90s before all viruses / hacks were about stealing credit card details and while those early viruses did cause lots of harm but the culprits were probably not tied in with mafias and were rather surprised when the FBI showed up at their door armed to the teeth: but then there was little chance of the FBI showing up like that in Redmond and dragging off the head of VBA for Office - even if Microsoft had written very insecure software which was almost universally deployed - because that's not the way the system works!
Java has always claimed 'security by design' but it really hasn't been any better than VBA. Business apps written in Java should be fairly secure but there's enough online Java content out there that running a browser without it (or without Flash the other top virus vector) can be problematic.
Microsoft recommending people to uninstall Java might have more to do with them currently pushing Silverlight though. Haven't heard of any Silverlight exploit until I just googled it but cvedetails.com list seven criticals, but I think the reason for not hearing about those has more to do with Microsoft not having had much success with it.
Last edited:
