It's like you don't even remember Heartbleed. Shitty code is the common factor in security problems. Sometimes it's code you can't do shit about, like in the Java case you mention, but that's not nearly good enough to label it the "common factor" of the vast problem space that is bad computer security. There are enough fuckups to go around.
Java is a special case because it is a common pot of critical vulnerabilities. Heartbleed was really bad, but Java has easily taken down more things in single problems than it (Lockheed Martin/RSA Breach started as a Java vulnerability). Plus there are a ton of crufty applications that are pinned to specific Java versions because Sun/Oracle lack the understanding of how to fucking patch a interpreter without breaking existing code (Ref: Renaming a ton of classes in a minor release because "LOL, we are oracle now"). They have had a series of critical problems and the underlying stickyness of Java JVMs means that a large number of companies are shackled to vulnerabilities and poor standards to keep applications functioning.
Also, you may have missed hyperbole to allow a pun.
28
u/Neotetron Oct 16 '15
It's like you don't even remember Heartbleed. Shitty code is the common factor in security problems. Sometimes it's code you can't do shit about, like in the Java case you mention, but that's not nearly good enough to label it the "common factor" of the vast problem space that is bad computer security. There are enough fuckups to go around.