Bugtraq mailing list archives
Re: PHP security (or the lack thereof)
From: Tonnerre Lombard <tonnerre.lombard () sygroup ch>
Date: Tue, 27 Jun 2006 07:47:29 +0200
Salut, On Sun, 2006-06-25 at 08:42 +1000, Darren Reed wrote:
There have barely a *handful* of JRE/JVM security problems.
I know for the fact that there are quite some though. Also, what should one think about a company that didn't manage to fix a simple path traversal vulnerability in their jar(1) utility in almost a year? The same goes for the serialization DoS. I really like Sun Fire servers, but I can't agree that Java is the bug-free issue-free big white horse. Especially not if you need a couple of hundreds of megabytes of RAM just to run java -version... As to useable Java applications: there are such nice things like Tomcat, the Java web server. The funniest thing about it is that it starts up so unbelievably slowly, and while everyone tells you that the JIT business is going to optimize the slowness away in just a day or two, it needs a restart every 20 hours or it will stop responding. Maybe this is the -fomit-instructions optimization the Gentoo people are so fond of? The same goes for my java.core collection. I keep it right next to my bash.core and cc1.core files. So, by "free of issues", are you talking about a Java implementation from a parallel universe? Tonnerre -- SyGroup GmbH Tonnerre Lombard Loesungen mit System Tel:+41 61 333 80 33 Roeschenzerstrasse 9 Fax:+41 61 383 14 67 4153 Reinach BL Web:www.sygroup.ch tonnerre.lombard () sygroup ch
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: PHP security (or the lack thereof), (continued)
- Re: PHP security (or the lack thereof) Jessica Hope (Jun 21)
- Re: PHP security (or the lack thereof) Jose Nazario (Jun 17)
- Re: PHP security (or the lack thereof) Geo. (Jun 19)
- Re: PHP security (or the lack thereof) kicktd (Jun 21)
- Re: PHP security (or the lack thereof) Geo. (Jun 21)
- Re: PHP security (or the lack thereof) Crispin Cowan (Jun 22)
- Re: PHP security (or the lack thereof) Geo. (Jun 19)
- Re: PHP security (or the lack thereof) Neil Neely (Jun 19)
- Re: PHP security (or the lack thereof) john mullee (Jun 23)
- Re: PHP security (or the lack thereof) Darren Reed (Jun 26)
- Re: PHP security (or the lack thereof) Ronald Chmara (Jun 27)
- Re: PHP security (or the lack thereof) Tonnerre Lombard (Jun 28)
- Re: PHP security (or the lack thereof) Darren Reed (Jun 28)
- Re: PHP security (or the lack thereof) Darren Reed (Jun 26)
- Re: PHP security (or the lack thereof) Geo. (Jun 23)
- Re: PHP security (or the lack thereof) Crispin Cowan (Jun 23)
- Re: PHP security (or the lack thereof) Daniel Hulme (Jun 26)
- Re: PHP security (or the lack thereof) Tobias J. Kreidl (Jun 26)
- Re: PHP security (or the lack thereof) Glynn Clements (Jun 27)
- Re: PHP security (or the lack thereof) Ronald Chmara (Jun 26)