We all know that primarily due to politics, if you are using a Microsoft JVM you aren't running Java above 1.1.8. Steven Vaughan-Nichols has been looking at the record of Microsoft's JVM, and he wants you to take action. We may not be able to get them to upgrade their JVM, but we can make our code not run on their VM.

"By my count, there have been 10 patches for serious security problems in Microsoft’s JVM since 1999. That’s getting close to about a patch a quarter. That’s more than Internet Explorer, which is no major model of security itself. Is it just me, or is there something fundamentally wrong here?

These aren’t little problems. This isn’t a matter of the fonts not displaying properly. According to the documentation accompanying the Microsoft patches, these flaws have included enabling “an attacker to gain control over another user’s system” (MS02-069)—the most serious of which could enable an attacker to gain complete control over a user’s system (MS02-052) and “run code of an attacker’s choice” (MS02-013). That certainly makes me feel warm and fuzzy about Microsoft’s JVM."

Read: Dump Microsoft's JVM

f**k microsoft and their evil ways. someone should have came up with this brilliant idea much sooner. never again will i write a java program that runs on ms JVM. maybe we should have someone run a website where java programmers can pledge their allegiance to such a great and wonderful cause. if anyone else wants such to have such a glorious website available and doesn't know anyone else who will do it, let me know and i'll do it. all hail java.

"By my count, there have been 10 patches for serious security problems in Microsoft’s JVM since 1999"

May I ask?

How many security patches has been released for Sun VM? Zero?

Hmm..

Regards
Rolf Tollerud

>
> Hmm..
>
> Regards
> Rolf Tollerud

Hard to count. The current version is 1.1.8_16 I think or something like that. How many it was from 1.1.4? probably around 30 or so. How many were security related? At least half a dozen as I remember. As a matter of fact one of the main reasons to ditch 1.1 and move to 1.2 was broken security model, wasn't it?
Now, guess who designed this security model? No, it ain't M$ ...
All I'm saying is that it's very difficult to design things 100% right the first time, so early releases will have problems. Now for many in Java world this is absolutely logical and acceptable ... unless it is done by Microsoft. I just don't understand it.

 -- Krzysztof

-Krzysztof ,

(i think) Rolf was implying that by failing to release patches and fixes for it's jvms Sun does not support it's software.

I am not ahppy with Sun's level of support for it's jvm's either, they could do a lot to fix the number of outstanding defects, and performance problems in their old vms, rather then forcing customers to waiting over a year for the next incompatible version to be released. But what more can you expect from an outdated hardware company. There is no doubt that ms provides much better support for it's products then sun.

Regarding this article... It was yet another TheServerSide sponsered waste of time. What was his point? That we sohuld not use the msjvm becuase it is outdated, and has security problem? well thats just silly stupid reasoning. We don't include a timebomb in our software to prevent it running on old pentiums, just because we like what AMD is doing. Regardless of how high and righteous you think you are for saving the user from the perils of using old software.

Steven J. Vaughan-Nichols, you are a moron. If you don't want to test or support the msjvm, fine thats probably a good move and will save your company money. But don't think you are doing ANYBODY a favor by explicitly preventing your software from running on it just becuase you think nobody should use it. **** you and your self important ass.

I have to agree with anonymous on this one... I couldn't believe my eyes when I read this article. Rather than say "use Java 1.2+ and don't worry about MS's vm" he sais "check specifically for MS's vm and don't allow the client to install if he has it". If you write a program for Java 1.2+ and the client really can't run with the MS vm, so you should (obviously) issue a warning. Just like if you require 1.3 and the client has 1.2 you would. But if your application can run on the MS vm, you have no right to stop the application from installing. What if Microsoft made the Office installation stop in case Netscape is installed? That's just silly... And probably illegal (Microsoft has been sued for less...)

Gal

Hey,
     Microsoft really know what is the meaning security?. F**k them, all they have done in information technology is fooling around with customers and try to make them blind.
   If I ever have to learn any Microsoft technology for my coding job in IT, I just leave my profession aside do some thing else. I hope you go answer for your f**king question. Get out serverside.com and go to seattle dude, there might be somebody who know all about your MS dreams

he can become one of those M$ lurkers.

---------------
Chris O'Rourke, a Microsoft employee, described attending LinuxWorld, a trade fair in California, where he "purported to be an independent computer consultant" working with several public school districts, according to an e-mail message he sent on Aug. 20, 2002.

"In general, people bought this without question," O'Rourke wrote. "Hook, line and sinker."
-----------------------------------------------------

>>> http://news.com.com/2100-1016_3-1001845.html?tag=rn

First of he's probably counting patches not flaws,
online solutions alone found more then 10

http://www.onlinesolutions.fi/index.cgi/news_2002_09_09?lang=eng

And I am pretty sure Internet explorer has has many many more flaws then msjvm


Ironicly the bytecode verifier flaw that was mentioned in the article, discovered by LSD bug was also present in suns jdk 1.1 - 1.3 be it in a slightly different form. read all about it at

http://lsd-pl.net/java_security.html

at least microsoft has microsoft update that will notify you when you need to patch something and publicly anounce these kind of things. I am betting many people are running vulnerable vm's without even knowing about it. Particularly nasty if you are running untrusted code over the network

Here may be a good indicator:

My wife's PC running Windows XP has 13 patches/fixes installed in a period of 3 months. You do the numbers... :)

My laptop running linux has 4 patches installed in a period of 2 years....

... and I even use my laptop as server for our family web page!!!

Roberto!

this report is from november 22, 2002
(http://www.eweek.com/article2/0,3959,720530,00.asp)

"Of the 29 advisories issued through October by the CERT Coordination Center at Carnegie Mellon University in Pittsburgh, 16 of them addressed vulnerabilities in open-source or Linux products. Seven of the advisories were related to Microsoft products.

Open source software is now the major source of elevated security vulnerabilities for IT buyers," the Aberdeen report says. "The poster child for security glitches is no longer Microsoft; this label now belongs to open source and Linux software suppliers."

A little naive to presume that Linux should have less vulnerability just because they not are reported, don't you think?

MS was vulnerable because it was attacked more than other operating systems.
"All that does not kill you makes you stronger"

And now there is Windows Server 2003..

Regards
Rolf Tollerud

MS was vulnerable because it was attacked more than other operating systems.

Yeah.

But Cameron! Are you still here? I though you was so ashamed over your latest trick so you had gone into hiding somewhere..

But do not be afraid, I will answer your “Top Ten Reasons to use Java”, it will be a lot of fun!

I hope you do keep up your reading?

Regards
Rolf Tollerud

"A little naive to presume that Linux should have less vulnerability just because they not are reported, don't you think? "

>> I haven't said so. I guess it is a bit naive of you to presume things when they are not said.

Actually Rolf, Linux does have less holes. Lest dwell on this.
First Linux is open source. So any hacker would easily find any holes in Linux very easily. Just look at the source code. Windows is closed source. Hacker find the holes by trying and trying until they succeed.

Second: Apache (on bsd or Linux) covers 60% of the web servers out there. That is beside the amount of mail servers and routers that also implement Open source stuff. That makes is a very viable target. When was the last time you heard about a worm that brought down these servers??

Your counter argument should start with .... But 96% of the client machines are Windows. And most end users don't have a clue about security. Then I will point out linux install with this in mind. Take the major distributions like Redhat and Mandrake that install with security in mind. Then you will say 'But what about Lindows'...etc.etc etc.

The fact remains. Microsoft is hacked more than Linux and its easier to hack as well. Remember Hacker are lazy programmers. They will look for the easiest target with the biggest result. ie Microsoft's operating systems. Look at all the big names in the Trojan/worm category for the last 2 years. ALL the big ones target Microsoft products.

We may not be able to get them to upgrade their JVM, but we can make our code not run on their VM.

So, all you have to do is use assert, or LinkedHashMap and it won't work.
What's the big deal here? Do folks have to support java apps that are restructed to 1.1.8?

This is one of those articles from people treating programming as a religion.
Microsoft JVM at its time was far better than whatever Sun could produce (at least in terms of performance).
Using Microsoft JVM still has significant benefits, like out of the box COM integration, which is very useful in many cases.
All security problems refer to applets, which I believe is a small fraction of Java programs, as a matter of fact I don't care about them.
You can of course use Java 2 collections and Swing on MS JVM, but this is not mentioned in the article.
I don't understand why people are so against Microsoft that they cannot see the arrogance of Sun. Just look at the comment for design by contract feature request. (in short: developers: "we want DBC, assert is not enough even Gosling thinks so", Sun: "be happy to have assert, we are smarter than you and we know better, now f**k off")
Why don't anyone complain about CMP EJB, which took a few years to become barely usable? Wasn't it clear move to sell more high-end hardware? And recent move to put Sun ONE logo everywhere where Java word appears?

Sun is losing everywhere, look at the stock? Linux on intel is killing solaris. Just wonder what will happen to Java, when company that controls it goes chapter 11?

No, I don't like MS practices, but the truth is that neither Sun nor IBM nor HP nor (put any almost any other company name here) is very different. It's just that MS tends to hire really talented and smart programmers.

I manage a group that has a 0.5 man century of J2EE development under it's belt and I must say it is quite possibly the most expensive way to produce software. Independent of the elegance of the design it sucks for productivity. The market has spoken unix is dying and Sun has both feet in the grave. I would be paying attention to .NET, it will live a lot longer. Give up the dogma, get on the winning team for a change, or do you have a masochistic desire to be a habitual loser.

I have been doing Unix for 19 years and java so I am by no means a M$Soft aficionado.

\Giles\
I manage a group that has a 0.5 man century of J2EE development under it's belt and I must say it is quite possibly the most expensive way to produce software. Independent of the elegance of the design it sucks for productivity. The market has spoken unix is dying and Sun has both feet in the grave. I would be paying attention to .NET, it will live a lot longer. Give up the dogma, get on the winning team for a change, or do you have a masochistic desire to be a habitual loser.
\Giles\

Experience is valuable, but in and of itself doesn't mean much - a hundred year old man isn't necessarily wise, he's just lived a long time :-)

As for productivity - I personally discovered a long, long time ago that productivity is more a product of the people and the culture than the actual technologies being used. Not that a technology can't be inherently "easy" or "hard" - that's certainly true. But what I've seen is that good shops invariably smooth out the differences at the technology level. For example, if out of the box J2EE is "hard", the team adapts scripts, approaches, procedures, frameworks and coding styles that tames the difficult parts. Likewise, people stuck doing C++ work use all sorts of tools and frameworks to make their lives easier, and make them less vulnerable to the languages quirks. Tech can make a difference of course - C++ will always be very different and offer unique challenges that Java developers will have to face - but I think you're overstating them. The difference of what you get out of the box tends to not matter so much over time, because developers are smart enough to develop tools and approaches to make their own lives easier (enlightened self interest).

That said - if you compare J2EE/Java vs. .Net, you'll find the technologies quite comparable in most ways. Comparable enough that it's not like a Java/C++ comparison at all, but you're getting somewhat close to apples and apples. And in that sort of comparison, the lovely intangibles start to make all the difference.

The difference to me is robust, evolutionary change. There are so many companies in the Java space, so many competing vendors, so many agendas, and such a sheer mass of developers that Java development gets better by leaps and bounds every year. And the "evoluationary pressure", if you will, is held back (mostly) by the various standards out there. The end result is an environment quite unlike anything I've seen in the past, a pretty decent balance between pushing forward on new frontiers and not degrading into utter chaos.

Unix is seeing the same sort of evolution, thanks to pressure from Linux. There's enough common ground that an app developer grunt like me can move from one variant to another with ease, and at the same time open source groups and commercial implementations like Solaris, AIX, and HP-UX are pushing the technology forward to get a competetive edge (or just plain get new jobs done :-)

In comparison, the Microsoft world is flat, static, and boring, and increasingly shrinking. Unlike Java (or Unix), there really is only one true way (the Microsoft way), and no matter how great Microsoft does on any one piece, they're still just one company. By definition, they can only move in a limited number of directions per release, and the diversity shown pales in comparison to the Java space and Unix space.

In direct contrast to what you've stated, I see .NET and every other Microsoft initiative withering on the vine compared to just about every non-Microsoft solution. They are slowly (oh so slowly!), but surely, becoming just another player. And the rules are different when you go from the only game in town to being just another option.

Microsoft will rule the consumer computing world for the foreseeable future, but in any area that touches business they're losing ground daily. The worst move anyone could make at this point in time would be to bet the bank on Microsoft, because in Microsoft vs. The World, The World is finally winning.

     -Mike

Well said Mike - mostly agree, may be not as sure as u about .Net being a .Not some where down the line. The thing I like about the Java space is that you have so many choices, from 1st Tier vendors to Opensource (so you can play according to your budget). Take MVC frameworks as an example - there must be tons of these (opensource or commercial), but over time, a few catches the limelight as these are generally accepted as useable and adoptable enough to the masses (e.g. Struts). The beauty of it is that now Struts has matured, I have discovered some really useful opensource applications based on it, and it has allowed me to come up with solutions of real business value to my company, at an incrediable cost. I am not convinced I can enjoy such dynamic evolution in the MS world.

Wow!!!
     Hey George,
          I am sure, you are a great mama's boy who still use diaper and follow mama's word about talking to stranger. How many times in a day you think about mama's word "don't talk to stranger!!!". Java or any other smart technology is not for people like you, so you better be happy with Microsoft and manage it. Wow what a wonderful mama's boy

Krzystzof says that Ms is no different from the IBMs or HPs of the world except that 'MS tends to hire really talented and smart programmers.'

Yeah the rest of the software industry just hires McDonalds rejects right? If the MS programmers are so smart, explain Windows 95, explain NT 1-4 , Dll hell, buffer overflows and all those other shoddy technologies that we have to put up with.

Microsoft has never really innovated. The innovation comes from the industry and Microsoft just copies what other people have done. Standing on the shoulders of giants.

Microsoft does have some talented programmers, just like HP,IBM,Sun,Sybase and other industry companies.

But to say that they are okay because others in the industry are arrogant is to miss the point. They are a convicted monopolist. Sun, IBM, or HP don't have the dominant position that MS do. That of owning the operating system. If Licensing 6 wasn't an example of arrogant gouging of customers then I don't know what is.

Don't be an apologist.

Sometimes people ask me: “Why do you persist on TSS when you only get abuse?”

Your post can serve as an example. As long as there is people that believe the crap you put in your post (and thousands others, similar), I will continue.

Microsoft has the highest density of IQ/m2 on the planet. Unix companies on the other hand, - do you know why Unix users go two by two?

"One can read and write and the other enjoy intellectual company."

Regards
Rolf Tollerud

You say:

1.Microsoft has the highest density of IQ/m2 on the planet
2.You dont work for Microsoft

then... ==>

3.Your IQ does not deserve to be used by MS. :-)

Do you know how many MS support engineers are required for handling a support call?
One for picking up the phone.
Another one for asking the number of your support contract
One more for suggesting you to reboot your PC
two more to tell you that it must be some hardware problem
+ a nice call center executive to let you know you will be billed for the call you just made. :-)

Dont laugh buddy. This is OUR real experience when dealing with MS.

It is a bit childish to say that MS is the smartest organisation on the planet.

Ask yourself how much does MS spend on R&D both as a complete total, and a percentage of turnover. Then look at other companies like IBM, HP etc. Look at the innovations that arise out of the IBM skunkworks, Xerox Parc labs and others. Compare and contrast to the R&D that Redmond does.

I would ask you why you persist on TSS when you only post rubbish.

P.s

In a straight look at PHDs look at Qinetic (formerley Dera, the British Defense Evlaution Research Center). Possibly the smartest organisation in the world.

A few people here have stated that a very good thing about MSJVM was "Out of the box COM integration." That was the very problem with MSJVM. One of the must important aspects of Java is its ability to run on any hardware or operating system that has a JVM. In order for that to happen the JVM and the Java app written to use it must not use OS proprietary technologies. The JVM itself can use proprietary technologies in order to improve it performance, but not pass those abilities on to the apps. By providing COM support in their JVM, Microsoft made there JVM proprietary. If an app is written to use the proprietary features of MSJVM, including COM support, that app will only run on Microsoft Systems. If you are going to write an app to run exclusively on MSOS why would you use Java? There are many programming languages better suited for that task (VC++, VB, Delphi, C++ Builder, etc). Use the right tool for the job. Sometime that tool is Java, sometimes its not.

One more thing. Microsoft’s .NET is proprietary too. Thought some would have us believe that that UNIX is dead, it is stronger now then it was 15 years ago. Why standardize an such a propriety technology. Why limit your self.

/***
You can of course use Java 2 collections and Swing on MS JVM, but this is not mentioned in the article.
***/

Would you mind sharing your experience on how to use Swing on MS JVM? Doesn't matter use it in an applet application or standalong application.

Thanks,

chai

Well, take the swing jar file and put it in your classpath ...

However my customers/users tend to extremely dislike anything written in Swing. So given that my priority is to deliver what they want (and not to "use Java for everything") I stopped even trying to write GUI in Java long time ago. I tend to write engines in Java (by engine I mean any component that does all that heavy lifting behind the scenes, providing a clear and simple API). That's why I like and need COM integration, so my client who asks for ASP page or VB GUI can still use the engine.

For collections API I used to use JGL a lot. I personally don't like Sun's Java2 attempt and thus I prefer to expose Enumerations or arrays. That's why I usually can run my engines on MS JVM.

IMO the most important thing missing from MS JVM is Proxy class. But I use Java in a very specific way, so your experience and priorities may vary.

 -- Krzysztof

It's about as relevent as saying dump Turbo C or stop using 8 inch disk, who the hell uses Java 1.1 code any more anyway? If you're using Java 1.1 then you're not really going to be caring about the version, or are you? Almost any decent application uses 1.4 and on that basis you're a bit screwed if you want to use Micro$oft's JVM.

Is that so? Are you saying that there are no "decent" J2EE applications (as far as I know very few J2EE servers are certified with 1.4).

My client only very recently allowed officialy (corporate standards) to use 1.3. Those people don't think in terms: "there is a new version on java.sun.com, let's use it". They wait for the thing to settle down before investing big $ into building solutions on it. Are you aware of StringBuffer "features" in 1.4 that broke JDOM (among others)? 1.4 is still very new and risky to use.

 -- Krzysztof

Are you aware of StringBuffer "features" in 1.4 that broke JDOM (among others)? 1.4 is still very new and risky to use.

Are you talking about bug 4724129? If so, StringBuffer isn't broken, but it's behavior has changed. The HotSpot FAQ even advises against pools of objects.

I think the point of his argument wasn't "everyone uses 1.4 anyway" so much as "no one uses the MS JVM". I can't think a a single app server that would use it. The only things I know that use it are applets (which as everyone knows are pretty rarely used these days) and MAYBE some custom stuff that links up with COM, from back in the J++ days. For the most part, everyone has migrated to Java2, which includes 1.2 on up.

I do agree with your earlier point, however, about the religious nature of this "debate". I think people get way too excited about the programming "religions" they adhere to. Microsoft especially seems to generate a lot of emotion. They're just a company, and an effective one, even if you don't like them. I don't think Oracle or IBM would be any different if they were in the same situation. I know that when compared to Oracle, I'd rather have MS on top. At least it's a software and product driven company rather than a sales-driven company. Not that Oracle product is bad, because it's not. But their drive comes from sales, not from product development.

If people feel the need to get religious, they should go to church or something. The software industry has enough problems without dealing with schoolyard debates.

I believe that MS JVM comes in handy for the purpose of COM integration, there are other implementations out there, but MS JVM is the only free and reliable way to integrate Java-COM. Security can be addressed in different ways in Enterprise environment, but when COM integration is needed in a hurry, MS JVM has been very helpful to me.

Krzysztof,
    I think you missed my point or perhaps I just made it badly. You mention J2EE, have you even seen any version of J2EE work on 1.1? I was talking about application that could use MS' JVM, i.e. mostly Swing based applications. No one on the right mind is going to run a J2EE application on MS-JVM!
I know there are plenty "decent" apps that work on 1.1, just visit the old "jars.com" site, most of them though are just "nice" graphics demos. A few good ones remain but they tend to be custom clients writen for a specific tasks.
Im my expirience I've seen more lunar eclipses in the last 24 months than applications running on MS' JVM, so I can't see why it's worth making a fuss about. I have a great dislike of MS, I have a reputation for it but seriously, there are far more interesting thing to moan about!

And, yes, I'm well aware of the StringBuffer issue but I can tell you there are plenty of "very serious" applications running on 1.4.

-John-

Don't touch a thing. A Microsoft JVM security hole is a Windows security hole. It's not like they are holding Sun's JVM hostage and poking it with a fork. It only adds gas to the fire publically and legally that MS is not secure and promotes gross negligence.

I have to ask this because ever since Java first came out I have always leaned towards using non MS JVMs..

I even test and use non MS JVms in MISIE..

If you actual goal is to have the java applet or other java code work on every platform why would you use MS JVMs that break that standard?

and before you cough and holller .. I use many JVms not just Suns' such as IBM's , Blackdown's, and etc..

>

There resons I use (or used to use really) Microsoft JVM:
1. COM integration
2. performance
3. -cp:a and -cp:p options - just briliant
4. no default maximum heap size
5. Visual J++, the IDE I missed a lot (untill I tested IDEA).

I also believe that latest JVM has .NET integration (meaning it compiles to CLR), but I have not used it so I cannot say anything.

To be honest Sun decision to keep Java away from MS hurted the JVMs a lot. Thinking how good MS JVM was in 1999 comapring to Sun's or IBM's ones one have to wonder where would we be now if MS kept developing it.

 -- Krzysztof

Are people still using that crap?

We have to realize it's the users who chose what they want to use, what risks they want to take. You don't force users not to use IE because it has a serious security bug.

my 2 cents

Well, the MS JVM is about ten times faster (or even more) than Sun JVM. I would not call it a crap and ignore it because it is just MS. If you do applets you would never want that snail speed Sun JVM run it when you can run it much faster. There should be competition between different JVM's instead of forcing one's implementation onto another, no one will win from Sun's monopoly on JVM. That is just sad that we have actually lost many times in performance of JVM because of it. If there were a decent competition JAVA could have been truly popular also on client side.

Vahur: Well, the MS JVM is about ten times faster (or even more) than Sun JVM.

In 1996, the MS JVM was the fastest available. It wasn't 10x as fast as (for example) Sun's, but it was faster. Do you have any benchmarks that show 10x the performance on the MS JVM than on current JVMs?

Peace,

Cameron Purdy
Tangosol, Inc.
Coherence: Easily share live data across a cluster!

well i recently wrote a trivial game applet, it runs about 60% slower on the latest 1.4 jvm. So for certain it still beats sun in a number of areas
also suns jdk's seem to be buggy, i really tried to like it but just too many things broke

I personly have never encounterd a JVM bug with Sun JVM. I have not used 1.4 for anying yet, but up throught 1.3 I have not had any problems. Maybe I am just lucky, or maybe it bacause I have never downloaded the first release of a new JVM and implmented it.

This question goes along with my "Why use COM with java" question.

GUI apps, which is what the Windows GUI really is, rely on a close integration with the OS in order to provide good performance. If Windows Explorer and the Apple GUI where not so closely tied to the OS they would be unbearably slow. This is the problem with Java GUI apps. In order to provide universal graphics support, Java swing had to be widely removed from the OS. Microsoft tied their JVM closely with their OS, and in doing so created non-standard code that the app programmer could use to create relatively fast GUI screens. Such apps would only run on MSJVM.

Java’s strengths do not lie in apps that require a GUI. Remember, the whole point to this web sight is server side apps. Java makes for great server side apps, and server side apps should never be created with any type of user interface. You just start them and let them do their thing. No need to interact with them at the server, just from across the wire. If you are creating a desktop app there are far better tools for that task. It is, however, nice to write a single program that will run on Windows, Apple, Linux, UNIX, and others. Of course, if that is you intention then writing an app that uses a proprietary JVM like MSJVM totally defeats the purpose.

Now, I am pretty sure the performance difference between MSJVM and Sun JVM is mostly with GUI apps. If that is the case, then you are comparing apples to oranges.

One point no-one seems to have made yet...Microsoft's JVM has one advantage (for now) over Sun's, which is that it is available on very many corporate desktops compared to the Java plug-in.

I've worked on several application deployments where an intranet app was being developed that needed some specific functionality best provided by an applet. To require or force the use of a Sun JVM would not have been practical for the end users, who would have had to install the Java plug-in on hundreds of desktops. Remember, most desktops are Microsoft-centric, as are most operational IS departments which are not terribly Java-aware when it comes to the client side.