Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ask HN: Is Oracle Java 7 no longer secure?
4 points by spydum on Oct 29, 2012 | hide | past | favorite | 1 comment
Unless I missed something, it seems Oracle's Java 7u9 JRE no longer enables checking of SSL Certificate Revocation Lists (CRLs)[see: http://docs.oracle.com/javase/7/docs/technotes/guides/deployment/deployment-guide/jcp.html#security - search for CRL, notice the default]. Does this mean any ssl certificate that may have been compromised and placed into CRL is no longer validated?


Yeah, probably. But CRLs were always unreliable (how much software do you think blocks the connection if the CRL/OCSP/... cannot be found? You need to twiddle a well-hidden switch in Firefox to make it check, and the results are not pretty - big CAs like Verisign time out all the time). Something like https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-... is far more likely to actually bite you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: