Re:JDK 10 Early Access Release Notes
by vbezhenar on Saturday February 24, 2018 @12:58PM
(#16454398)
Honestly I never needed any java updates on server side. I'm sure that they are fixing something important, but I've yet to encounter any bugs. My recent projects should run on Win32 and given that they dropped support, I won't migrate from Java 8 even if it won't be updated.
[ Parent
| on HN ]
You may not have encountered any bugs but what about the vulnerabilities they’re fixing - do you not care to have those fixes?
Re:JDK 10 Early Access Release Notes
by vbezhenar on Saturday February 24, 2018 @04:43PM
(#16455588)
Can you provide examples of those vulnerabilities? All vulnerabilities I'm aware of are from Java applet technology and not applicable to server applications. The only vulnerability that I can remember is something about parsing float, but even that was very low risk.
All those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example.
https://www.oracle.com/technetwork/topics/security/poodlecve...
There's a lot more but it of course depends on the subset of the JDK that you're using. Look over the release notes for historical JDK updates.
Re:JDK 10 Early Access Release Notes
by vbezhenar on Saturday February 24, 2018 @07:21PM
(#16456361)
I don't use TLS and even if I would use it, I would use nginx frontend. My subset is fairy common, Spring+JDBC, sometimes Hibernate, sometimes pure servlets, but basically all interaction between outer world is via HTTP interface implemented in Tomcat.
A targeted attack would probably hole you fairly easily then. Cleartext means you’re likely open to all sorts of replay attacks and data leaks, which can then be escalated to exploit vulnerable libs and jvm.