Linked by Thom Holwerda on Wed 10th Oct 2012 23:47 UTC, submitted by MOS6510
Thread beginning with comment 538383
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
kwan_e,
"Java (but you can probably say the same for other cross platform VMs) runs almost the same on any platform, basically amounting to a monoculture."
Oh ok...yeah I guess monocultures can be bad for security, competing implementations and variety can help limit the scope of a given attack. The same should be said for operating systems, applications, hardware vendors, etc.
We do have some choice in JVM's today. If I were to guess, the Java diversification is probably somewhere between PHP (few competing implementations) and Javascript (many competing implementations). Who knows if we should count android or not, it is a Java language implementation after all, even if its files are not binary compatible.




Member since:
2007-02-18
I would think that having a portable malicious program is a completely different kind of worse. Java (but you can probably say the same for other cross platform VMs) runs almost the same on any platform, basically amounting to a monoculture. Whereas a C program would be hard pressed to work exactly as designed even for POSIX compliant operating systems, let alone in a realistic environment where there's a mix of different server operating systems.