Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28102 > unrolled thread

new JDK versions

Back to article view | Back to comp.lang.java.programmer

Contents

  new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-16 05:29 -0700
    Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-16 23:15 -0400
      Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-17 17:12 -0700
        Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-18 00:12 -0400
          Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-18 03:21 -0700
            Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-18 17:27 -0400
            Re: new JDK versions Arne Vajhøj <arne@vajhoej.dk> - 2014-04-18 19:35 -0400
              Re: new JDK versions "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-20 10:40 +0100
                Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-20 06:22 -0700
                  Re: new JDK versions Simon Lewis <simonlewis2001@gmail.com> - 2014-04-20 14:38 +0100
                  Re: new JDK versions Jan Burse <janburse@fastmail.fm> - 2014-04-20 15:46 +0200
                  Re: new JDK versions Jukka Lahtinen <jtfjdehf@hotmail.com.invalid> - 2014-04-20 20:55 +0300
                  Re: new JDK versions v_borchert@despammed.com (Volker Borchert) - 2014-04-21 20:29 +0000
                    Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-21 23:38 -0400
                      Re: new JDK versions - OT Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-04-22 18:34 +0000
                        Re: new JDK versions - OT Martin Gregorie <martin@address-in-sig.invalid> - 2014-04-22 23:28 +0000

#28102 — new JDK versions

JDK 1.8.0_05 and 1.7.0_55 are out.

see http://mindprod.com/jgloss/jdk.html
http://mindprod.com/jgloss/jre.html
for hints on installing if you can't do it in your sleep my now.
-- 
Roedy Green Canadian Mind Products http://mindprod.com
"Don't worry about people stealing an idea; if it's original, you'll
 have to shove it down their throats." 
~ Howard Aiken (born: 1900-03-08 died: 1973-03-14 at age: 73)

[toc] | [next] | [standalone]

#28113

On 4/16/2014 8:29 AM, Roedy Green wrote:
> JDK 1.8.0_05 and 1.7.0_55 are out.
> 
> see http://mindprod.com/jgloss/jdk.html
> http://mindprod.com/jgloss/jre.html
> for hints on installing if you can't do it in your sleep my now.
> 

I'd be cautious before installing 8U5.  While downloading,
I was reading the release notes for JDK 8U5, and saw the
new feature on the Jar manifest attribute.  The link to
<http://docs.oracle.com/javase/8/docs/technotes/guides/jweb/security/manifest.html>
works, but one you start reading that page, it appears
to have been hacked/corrupted by someone, scrambling the
text.  For example:

"The Applicacation-Name aexte tmpts tbin tund. This attribute is used to
determine seconis listed in the Lh2>lot presentsed. If neither that is snt into
vide awhen the JAR file plicationcode> ain a different than the JNLP fileg
isHTML page that startscationcodf the JARfiles ais presin the e Apbuted,"

I'm going to wait a bit before updating, to see what (if anything)
happens.  I'm nervous lately about hacked websites.  (I wrote to
Oracle, but received no reply.)

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#28122

On Wed, 16 Apr 2014 23:15:09 -0400, Wayne <nospam@all.invalid> wrote,
quoted or indirectly quoted someone who said :

>.  For example:
>
>"The Applicacation-Name aexte tmpts tbin tund. 

It looks fine to me. Either they have fixed it, or it got scrambled
somehow on its way to you. Some kind of encoding problem?
-- 
Roedy Green Canadian Mind Products http://mindprod.com
"Don't worry about people stealing an idea; if it's original, you'll
 have to shove it down their throats." 
~ Howard Aiken (born: 1900-03-08 died: 1973-03-14 at age: 73)

[toc] | [prev] | [next] | [standalone]

#28125

On 4/17/2014 8:12 PM, Roedy Green wrote:
> On Wed, 16 Apr 2014 23:15:09 -0400, Wayne <nospam@all.invalid> wrote,
> quoted or indirectly quoted someone who said :
> 
>> .  For example:
>>
>> "The Applicacation-Name aexte tmpts tbin tund. 
> 
> It looks fine to me. Either they have fixed it, or it got scrambled
> somehow on its way to you. Some kind of encoding problem?
> 

Oracle fixed it.  I noticed they also changed their SSL certificate.
They never did reply to my email.  I was nervous due to Heartbleed,
but it's been a few days and nobody has announced any issues.  So
I'm going assume I was worried for nothing, and will install the
update.

Thanks for checking and reporting back.

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#28128

On Fri, 18 Apr 2014 00:12:08 -0400, Wayne <nospam@all.invalid> wrote,
quoted or indirectly quoted someone who said :

>Oracle fixed it.  I noticed they also changed their SSL certificate.
>They never did reply to my email.  I was nervous due to Heartbleed,
>but it's been a few days and nobody has announced any issues.  So
>I'm going assume I was worried for nothing, and will install the
>update.

I think the cert companies are offering replacement certs free to
everyone. 

I have a program that spiders the links on my site looking for solidly
broken links and redirects. The most common kind of redirect is http;
-> https:  I think http's days are numbered. This is too bad. You
can't tell a thing watching https: streams with Wireshark.

-- 
Roedy Green Canadian Mind Products http://mindprod.com
"Don't worry about people stealing an idea; if it's original, you'll
 have to shove it down their throats." 
~ Howard Aiken (born: 1900-03-08 died: 1973-03-14 at age: 73)

[toc] | [prev] | [next] | [standalone]

#28133 — Re: new JDK versions - OT

On 4/18/2014 6:21 AM, Roedy Green wrote:
> I have a program that spiders the links on my site looking for solidly
> broken links and redirects. The most common kind of redirect is http;
> -> https:  I think http's days are numbered. This is too bad. You
> can't tell a thing watching https: streams with Wireshark.
> 

There's a good Firefox extension for that, "HttpFox".  It can capture
HTTPS requests and responses, in clear.

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#28134

On 4/18/2014 6:21 AM, Roedy Green wrote:
> I have a program that spiders the links on my site looking for solidly
> broken links and redirects. The most common kind of redirect is http;
> -> https:  I think http's days are numbered.

I don't think much is changing.

It has always been and still are:

security needed => HTTPS
else => HTTP

>                                               This is too bad. You
> can't tell a thing watching https: streams with Wireshark.

That is exactly why HTTPS is preferred!

Arne

[toc] | [prev] | [next] | [standalone]

#28140

Arne Vajhøj wrote:

> security needed => HTTPS
> else => HTTP

Argh!  No!

;-)

But seriously:

security definitely known not to be required or desirable (by anyone) => HTTP
else => HTTPS

    -- chris 

[toc] | [prev] | [next] | [standalone]

#28141

On Sun, 20 Apr 2014 10:40:00 +0100, "Chris Uppal"
<chris.uppal@metagnostic.REMOVE-THIS.org> wrote, quoted or indirectly
quoted someone who said :

>
>security definitely known not to be required or desirable (by anyone) => HTTP
>else => HTTPS

For web browsing, most people would rather have the speed. Programmers
would prefer to see what is going on clear text.

If I am reading catalogs, material on how to use java, etc, I can't
think of any reason why I might want to keep that secret, though I am
sure somebody would.
 
I could see wanting to keep secret that I visited some porn site, but
it is not that important exactly what the images looked like. HTTPS
does not hide that for you.

When I send passwords, I would like that part encrypted. I never use
credit cards on the net. IT is like handing over books of blank
cheques.  But for those that do, those conversations should be
automatically HTTPS.

I wonder if there could be a way to run a site both in http/https
where which protocol used = user wants HTTPS || webmaster wants HTTPS.

You really should not need to duplicate everything with minor
differences.

Politically, I tried to talk people into routinely sending email
encrypted. I figured if you encrypted even spam, it would overwhelm
the bad guys blanket snooping. The move to routine HTTPS may have the
same effect.
-- 
Roedy Green Canadian Mind Products http://mindprod.com
"Don't worry about people stealing an idea; if it's original, you'll
 have to shove it down their throats." 
~ Howard Aiken (born: 1900-03-08 died: 1973-03-14 at age: 73)

[toc] | [prev] | [next] | [standalone]

#28143

Roedy Green <see_website@mindprod.com.invalid> writes:

> On Sun, 20 Apr 2014 10:40:00 +0100, "Chris Uppal"
> <chris.uppal@metagnostic.REMOVE-THIS.org> wrote, quoted or indirectly
> quoted someone who said :
>
>>
>>security definitely known not to be required or desirable (by anyone) => HTTP
>>else => HTTPS
>
> For web browsing, most people would rather have the speed. Programmers
> would prefer to see what is going on clear text.

The "speed" increase in general web browsing would be totally and
utterly unnoticeable for the great majority of "non secure" needs
assuming we're not streaming video over a dodgy link.

That said I see no reason for https in the vast majority of cases -
especially since it probably still doesnt work....

[toc] | [prev] | [next] | [standalone]

#28144

Roedy Green schrieb:
> I wonder if there could be a way to run a site both in http/https
> where which protocol used = user wants HTTPS || webmaster wants HTTPS.

See for example tomcat web.xml:
   security-constraint Tag

   See for example:
       http://docs.oracle.com/cd/E19798-01/821-1841/bncbk/index.html
       See in particular
          Specifying Separate Security Constraints for Various Resources

You can of course externally provide two different
URL which map to the same content, one URL which
always switches to https and another URL which does
not and stays with http.

The single source contents must be delivered by
some servlet, and the servlet need to do some
content rewriting, such as rewriting links to the
apropriate external URL. (*)

I did something similar not for security, but to
provide a non-mobile and a mobile view of the same
content. Its still experimental, but basically it
works.

Don't know whether there are better solutions around,
or whether basically other solutions amount to the
basically to the same approach.

Bye

(*) You could of course also precompute two different
contents. And store them in the web server in two
different locations.

[toc] | [prev] | [next] | [standalone]

#28146

Roedy Green <see_website@mindprod.com.invalid> writes:
> On Sun, 20 Apr 2014 10:40:00 +0100, "Chris Uppal"

>>security definitely known not to be required or desirable (by anyone) => HTTP
>>else => HTTPS

> If I am reading catalogs, material on how to use java, etc, I can't
> think of any reason why I might want to keep that secret, though I am
> sure somebody would.

My rule of thumb: 
If you need to log in, or send personal information -> HTTPS.
Otherwise, I don't care which one.

-- 
Jukka Lahtinen

[toc] | [prev] | [next] | [standalone]

#28168

Roedy Green wrote:

> Politically, I tried to talk people into routinely sending email
> encrypted. I figured if you encrypted even spam, it would overwhelm
> the bad guys blanket snooping. The move to routine HTTPS may have the
> same effect.

They'd just pay some software vendor or freeware programmer to introduce
another backdoor. I'm not yet fully convinced that Heartbleed really was
an accident... Besides, They [TM] are, by definition, The Good Guys [TM]

-- 

"I'm a doctor, not a mechanic." Dr Leonard McCoy <mccoy@ncc1701.starfleet.fed>
"I'm a mechanic, not a doctor." Volker Borchert  <v_borchert@despammed.com>

[toc] | [prev] | [next] | [standalone]

#28170 — Re: new JDK versions - OT

On 4/21/2014 4:29 PM, Volker Borchert wrote:
> Roedy Green wrote:
> 
> 
> They'd just pay some software vendor or freeware programmer to introduce
> another backdoor. I'm not yet fully convinced that Heartbleed really was
> an accident... Besides, They [TM] are, by definition, The Good Guys [TM]
> 

I am convinced it was an accident.  A failure to validate a length
parameter was the problem.  (It made a great teaching point about
validation.)

Of course, the fact that it was an accident doesn't mean TGG (the good guys)
didn't know about it or take advantage of it.  I don't suppose we'll
ever know for certain.

-- 
Wayne

[toc] | [prev] | [next] | [standalone]

#28185 — Re: new JDK versions - OT

Wayne <nospam@all.invalid> wrote:
> On 4/21/2014 4:29 PM, Volker Borchert wrote:
>> They'd just pay some software vendor or freeware programmer to introduce
>> another backdoor. I'm not yet fully convinced that Heartbleed really was
>> an accident... Besides, They [TM] are, by definition, The Good Guys [TM]
> I am convinced it was an accident.

What would be even the point of having the server echo back a
specific string, rather than just e.g. a counter value, if it
wasn't as a stage for retrieving extra "data"?

Even if that buffer overflow is now fixed, the very feature 
of having the server say (and encrypt) a given string, independent
of the actual protocol, may be a helper for future attacks.

[toc] | [prev] | [next] | [standalone]

#28188 — Re: new JDK versions - OT

On Tue, 22 Apr 2014 18:34:54 +0000, Andreas Leitgeb wrote:

> Wayne <nospam@all.invalid> wrote:
>> On 4/21/2014 4:29 PM, Volker Borchert wrote:
>>> They'd just pay some software vendor or freeware programmer to
>>> introduce another backdoor. I'm not yet fully convinced that
>>> Heartbleed really was an accident... Besides, They [TM] are, by
>>> definition, The Good Guys [TM]
>> I am convinced it was an accident.
> 
> What would be even the point of having the server echo back a specific
> string, rather than just e.g. a counter value, if it wasn't as a stage
> for retrieving extra "data"?
> 
> Even if that buffer overflow is now fixed, the very feature of having
> the server say (and encrypt) a given string, independent of the actual
> protocol, may be a helper for future attacks.

I see on El Reg that the BSD gang have just forked the Open SSL library 
and are now promising a completely rewritten/refactored version with all 
cruft and support for obsolete OSen removed. They say the first published 
version of Libre SSL will be BSD only and released with v 5.6 but that 
they anticipate it will be ported to other OSen after that:

http://www.theregister.co.uk/2014/04/22/openssl_fork_libressl/


-- 
martin@   | Martin Gregorie
gregorie. | Essex, UK
org       |

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.programmer

csiph-web