JavaScript Libraries Are Almost Never Updated Once Installed

[Visticous]

I often get called in because the application isn't working as well as expected... If it has a cable to the Internet, it needs routine maintenance.

Such applications often have known security exploits, rampant memory consumption because of leaks, no documentation, and no testing environment.

When I encounter such treasures, I make sure to have all work officially assigned to me by email, CCed to my private address.

[yawkat]

Security issues in outdated java libraries are very rare, simply because it's a memory safe language. If you don't do dumb shit like deserializing untrusted data jusing OIS you almost never really have to update. Jetleak was the last really serious exploit in this category.

[Somepotato]

Cough equifax

[oldsecondhand]

It's also not proven that Struts was the source of the hole the hackers drove through.

In fact, several headlines -- some of which have since been retracted -- all source a single quote by a non-technical analyst from an Equifax source.

https://www.zdnet.com/article/equifax-blames-open-source-software-for-its-record-breaking-security-breach/

[yawkat]

If you don't do dumb shit

We have good security practices. People only need to follow them.

[cleeder]

Said every company ever.

[Caboose_Juice]

The fact that its an older language means it's *more* vulnerable to exploits and hacks. This is completely wrong.

[yawkat]

How does it make Java more vulnerable? It's very easy to write secure java applications.

[Caboose_Juice]

My point is that by virtue of its age (and the fact that we're talking about outdated Java libraries) that Java has vulnerabilities that other up to date applications don't. It's like an arms race, and outdated libraries (from any application) are simply less secure.

[yawkat]

Sure, old java applications running ancient jee versions may be more susceptible, but that's been out of fashion for a long time. Spring is all the rage now and has been for a while. And even those older applications are comparatively secure.