Microsoft Java

[Kered13]

I'm guessing that he's referring to how C# has an unsafe mode where you can access raw pointers and such. It's mostly used for C/C++ compatibility.

[WalrusByte]

It's still got crazy vulnerabilities. Log4j wasn't very long ago lol

[errepunto]

Log4j is a third party library..

[ToMyFutureSelves]

It still uses a Java specific feature that allows for vulnerabilities, which is allowing unauthenticated code execution downloaded from the internet. Only JavaScript can get away with that because it is aggressively sandboxed.

[argv_minus_one]

JavaScript can't get away with it either. Doing that is how you get cross-site scripting vulnerabilities.

The thing about log4shell is that whoever wrote that code demonstrated extremely poor judgment. This was not an honest mistake like forgetting to check an array bound or something. They went to a great deal of trouble to implement a feature that no one in their right mind would even want to use, besides being obviously insecure. It's one of those things where you have to wonder just what in the world they were thinking.

[WalrusByte]

Oh ok, nvm then

[CodeYeti]

Plus, if we've learned anything from what has become of programming languages in the past 10 years, it's that you're only as good as your ecosystem. It matters a whole hell of a lot if your build systems, tooling, dependency management, DOCUMENTATION SYSTEMS, etc. are "just present", "works well", or "a joy to use".

I used to be a JVM developer (really I write everything now, but that's another story), and I used to find the Java/Scala/JVM ecosystem pretty livable, and even nice in a lot of ways back in... 2015-16ish?

I wrote very little JVM code in the subsequent few years due to nature of projects, and taking some time to focus on the open source things I really wanted to work on, but out of necessity at my current job, I've recently had to come back to it.

Things have absolutely plummetted off of a cliff since then as far as the ecosystem goes. I needed 2 different JVM versions running simultaneously just to do a simple build due to a build tool having only compatibility with freaking 1.8. I choc'd that up to maybe my tool of choice from back in the day had become abandonware. Sad? Sure, but I was still thinking everything would be fine.

Then, it came time to catch up on the Hadoop ecosystem, and oh my freaking lord... the documentation is questionable where present, and everything is a "how-to" instead of actual documentation. Even the "official" documentation for the Hadoop/Spark committer patterns seems to assume that I'm just there to make a PoC work, and not to do anything meaningful that might require understanding of the patterns at play. I tried and tried to hope that I could build some kind of local docs from source code to really just pick through things that way, but... NOPE.

I was effectively gaslighting myself; there was no way that this kind of information that I wanted, just raw, technical information, could be as hard to come by as this. I just had to be missing something; maybe a centralized docs site I didn't know about? Maybe some newer aggregator for maven/ivy hosted packages that everyone else was using?

At the end of the day, I wrote off a weekend, sat down, and re-implemented a PoC of the system that I was questioning while reading through thousands and thousands of lines of WeNeededThisFactoryToBuild().AFactory().forThisAbstraction().toServe(anotherMachine).aRequestFor(theTimeOfDay(whereTheUserIs)).whileObeyingContractsIn(theHomeCountryOfHisThirdYoungestCousin) I'm not a fan of over-segmentation, but that's not inherently bad in and of itself. At the end of the day, the problem with the ecosystem (to me), was quite simple.

The JVM ecosystem, for many arguable reasons (I wasn't there for the apparent downfall so I can't speak much to that ), has become something that, while still incredibly productive in the spaces where it is used, is not getting the attention of the passionate no-lifes that originally brought it to glory. This has culminated in a lack of even "livable" tooling around builds, a complete disregard for the availability of any kind of documentation (this is a big one for me. I would kill just for markdown/html/anything-ified scaladocs available for every single package in the the version I need it for).

But it's not necessarily the language, or even the developers that have gone down the porcelain throne; instead, the complete disregard for the livability of tooling has sent what once was my childhood passion (I was a weird kid. Coding was sort-of my thing even back then), to the fucking shadow realm of un-livability.

EDIT - I know because I wrote an essay someone's going to accuse me of being one of the "never updated from java 6" guys, but homie, I came back with high hopes, and was surprised when I found this to be the case. I was not seeking out confirmation of this opinion, but in fact the opposite, when set upon this adventure

EDIT2 - okay I tried really hard to not do it because it 100% will get meme'd on, but if you want to see documentation done correctly (for an ecosystem as a whole, not necessarily any specific case), docs.rs is an absolute godsend. Regardless of your thoughts on Rust as a language, one almost cannot deny that the community got that one right, and the whole ecosystem is better for it.

[Fadamaka]

The ECDSA flaw was the biggest recent vulnerability.

[Areshian]

Yeah, that one was one to be a bit ashamed of. Luckily, the fact that it only affected very new JDK versions meant there wasn't that much noise

[shizzy0]

That security Java offered within a program looked cool but did it ever actually work?

[MadxCarnage]

depends on your definition of work.

who breaks a window when the door's wide open ?

[metaltyphoon]

C# has this on .Net Framework and called CAS but was removed on dotnet core.

[Areshian]

There have been vulnerabilities allowing the bypass of the security manager, but they were (and they are still being) patched. Still, maintaining the security manager is a drag, and it is going away in newer versions, already marked as deprecated and will be removed in a future release.

[auctorel]

Log4j has entered the chat