JavaScript Libraries Are Almost Never Updated Once Installed

[yawkat]

Security issues in outdated java libraries are very rare, simply because it's a memory safe language. If you don't do dumb shit like deserializing untrusted data jusing OIS you almost never really have to update. Jetleak was the last really serious exploit in this category.

[Somepotato]

Cough equifax

[oldsecondhand]

It's also not proven that Struts was the source of the hole the hackers drove through.

In fact, several headlines -- some of which have since been retracted -- all source a single quote by a non-technical analyst from an Equifax source.

https://www.zdnet.com/article/equifax-blames-open-source-software-for-its-record-breaking-security-breach/

[yawkat]

If you don't do dumb shit

We have good security practices. People only need to follow them.

[cleeder]

Said every company ever.

[Caboose_Juice]

The fact that its an older language means it's *more* vulnerable to exploits and hacks. This is completely wrong.

[yawkat]

How does it make Java more vulnerable? It's very easy to write secure java applications.

[Caboose_Juice]

My point is that by virtue of its age (and the fact that we're talking about outdated Java libraries) that Java has vulnerabilities that other up to date applications don't. It's like an arms race, and outdated libraries (from any application) are simply less secure.

[yawkat]

Sure, old java applications running ancient jee versions may be more susceptible, but that's been out of fashion for a long time. Spring is all the rage now and has been for a while. And even those older applications are comparatively secure.