© arquera

Apple this week finally released a patch for a serious Java security flaw that's been around since December of last year.

"The flaw is fixed in Mac OS X 10.5.7 and Mac OS X 10.4.11, available from Apple's website or via OS X's built-in software update mechanism... The bug (designated CVE-2008-5353 in the Common Vulnerabilities and Exposures database) was first reported to Sun in August of last year, and was patched by Sun in December," writes ZDNet's Matthew Broersma. "It allows a remote attacker to take over a system, and was ranked as 'highly critical' by security vendor Secunia."

"Apple regularly comes under fire for its sluggish pace," writes Computerworld's Gregg Keizer. "Last month, a security researcher angered by the delays posted attack code that exploited one of the unfixed bugs. The vulnerability exploited by Landon Fuller, a San Francisco-based researcher, was one of the many that Sun fixed Dec. 3, 2008, but that Apple only got around to patching yesterday."

"While OS X is still arguably safer than Windows, safety and security are not necessarily the same thing," writes TheAppleBlog's Charles Jade. "A more aggressive attitude towards security by Apple now might help protect Mac users in the future..."

More here from The Register ... and more here from InformationWeek.

Genuitec this week released version 7.5 of both MyEclipse Enterprise Workbench and MyEclipse Enterprise Workbench Blue Edition.

"For our Blue Edition customers we're proud to share new design and advanced layouts that IBM shops will feel comfortable adopting," says Genuitec vice president Wayne Parrot. "The utility of Blue Edition is its lightweight footprint, it can run on a laptop; and now we're happy to include remote WAS deployment and UML2, both promise to enrich the application development process."

"Both 7.5 releases have added a Java profiler, called VisualVM Java Profiler, for profiling and checking memory consumption of code... the tool previously was limited to working with the open source NetBeans tool platform, according to Genuitec," writes Computerworld's Paul Krill. "Also featured is Visual SQL Query Builder, a visual tool for devising complicated SQL queries."

The press release is here.

© A Y U M i (LoveLiveLaugh)

At last week's JavaOne conference, Microsoft execs did their best to woo the Java developers in attendance.

"'I want to say, absolutely, we come in peace,' pledged Steven Martin, one of a pair of Microsoft executives to address the crowd at JavaOne on Thursday in San Francisco," writes InformationWeek's Charles Babcock. "It may have been said in jest, but no one at the keynote address laughed.
Nevertheless, the earnest tone and serious examples presented... left JavaOne attendees impressed with Microsoft's desire to have Windows and .Net fully interoperate with Java."

"One of the reasons that Microsoft and Sun have focused on interoperability is because companies like Google are creating an emerging set of Web-based APIs (application programming interfaces) that are starting to eclipse Java and .Net," notes PC World's Robert McMillan. "How technologies like Google Wave will interoperate with Java and .Net is unclear. Google is not a sponsor of JavaOne and the search giant has a minimal presence at this year's show."

More here from Seeking Alpha.

At this week's JavaOne conference in San Francisco, Oracle CEO Larry Ellison raised the idea of creating Java-based netbooks.

"The expansion into computers is considered a logical offshoot by Ellison given Sun's experience in hardware and other fields outside of Oracle's preferred database apps," according to Electronista. "'I don't see why some of those [netbook] devices shouldn't come from Sun-Oracle,' he said."

"Ellison threw his full support behind Java, reminding the crowd at JavaOne that Oracle's middleware makes good use of Java," writes CNET's Lance Whitney. "He called it an 'attractive platform' because of its openness and the ability to extend it. 'Everything that sits on top of our database - all our products - are Java-based,' he said. He added that Oracle's whole next generation of business applications is built entirely on Java."

More here from PC World ... more here from The Register ... and more here from the WSJ.

Sun Microsystems CEO Jonathan Schwartz this week announced plans to launch an app store (currently called Project Vector) for Java software.

"It will be modeled after Apple's iPhone App Store and will allow users to download and install new software over the Internet," writes Ars Technica's Ryan Paul. "The store will use Sun's Java runtime updater as a deployment mechanism, providing a distribution channel that Schwartz says will reach an audience of billions."

"While details on the Java store otherwise remain scarce, Schwartz added candidate applications will be submitted via the web, evaluated by Sun for safety and content and presented under free or premium terms to the broad Java audience," writes FierceMobileContent's Jason Ankeny.

"Further details of Project Vector's business model, technology and roadmap will be made available at the JavaOne Conference in San Francisco on 2 June," writes ZDNet's David Meyer.

More here from JavaWorld ... and the announcement is here.

© bfick

Apple has been slow to fix a key Java vulnerability which has remained unpatched for months, according to a security memo released this week by Intego.

"While Apple's safety record is pretty good — that is to say the actual number of security breaches on the platform is small — it still has some work to do in terms of its reputation for security," writes Macworld's Dan Moren. "The company is often close-mouthed about its process for dealing with security fixes, and though it does issue updates throughout the year, vulnerabilities sometimes go unpatched for months at a time. Case in point: a Java vulnerability first patched by Sun over six months ago that's still open in Mac OS X."

"I would say, 'Folks, it's time to patch your systems,' but Apple has yet to provide such a patch," writes About.com's Mary Landesman. "Your best bet is to stop using Safari, switch to Firefox and install the NoScript addon to guard against hostile Web sites..."

More here from TUAW ... more here from Computerworld ... more here from InformationWeek ... and more here from TechWhack.

Enterprise Java vendor SpringSource has purchased Hyperic. Terms of the deal were not disclosed.

"The move will expand SpringSource's Java offerings and allow the company to provide a more comprehensive open source stack," writes Ars Technica's Ryan Paul. "SpringSource's core business revolves around selling an enterprise version of the Apache-licensed Spring framework, but the company has been steadily expanding its reach. Last year, SpringSource acquired G2One — the company behind the Java-based Groovy programming language — and Covalent, a company that provides support for Apache's Tomcat application server."

"Hyperic has grown in popularity in the five years since it was created, and it has won numerous accolades from analyst firms, such as Gartner, which named it a 'company to watch in 2009,'" writes SD Times' Alex Handy. "At the heart of Hyperic is Hyperic HQ, a distributed Java application that discovers, analyzes and monitors systems and network components in a data center. The HQ product can be administered through a Web-based interface, allowing IT operators to monitor networks from anywhere in the world."

More here from GigaOM ... more here from ZDNet ... more here from Network World ... more here from CNET ... more here from JavaWorld ... and the press release is here.

The Java Community Process (JCP) Program Management Office (PMO) today announced the 2009 Star Spec Leads, recognizing JCP Spec Leads who maintain high quality along with exceptional service to the community.

The awards are based on feedback from fellow Spec Leads, Expert Group members, Executive Committee members, JCP Community members, and PMO staff.

The new Star Spec Leads are Ed Burns of Sun Microsystems, Mike Milikich of Motorola Mobile Devices, and David Nuescheler of Day Software.

The press release is here.

Following Oracle's $7.4 billion purchase this week of Sun Microsystems, what does the future look like for both companies?

"Sun made its name as a supplier of server hardware during the dot-com heyday, but its best-known technology is software: the Java programming language," notes CNET's Steven Musil. "The two companies said Java is the 'most important software Oracle has ever acquired.'"

"Few expect the Redwood Shores, Calif. database giant to mess with Java," writes ZDNet's Paula Rooney. "It is a well established industry standard and recently open sourced programming engine. But when it comes to MySQL and Sun's other open source offerings, the jury is out."

More here from InformationWeek ... more here from BusinessWeek ... more here from the WSJ ... and more here from The Register.

PreEmptive Solutions today announced the release of DashO Version 5.

"DashO 5 offers the same runtime session and feature monitoring that PreEmptive's Dotfuscator does for .NET developers," writes SD Times' David Worthington. "That includes instrumenting Java applications for tracking feature use, enabling time limits on application use, and detecting and defending against tampering. Data is served up to a Windows-based portal, said chief marketing officer Sebastian Holst. Visual Studio and .NET have been PreEmptive's top targets, so its Java product has lagged behind, he acknowledged. Other new features include support for the Hibernate and Spring frameworks, JSP Tag Libraries, and WAR (Web Application Archive) files. DashO also offers code protection, as well as feature measurement and management for the Android platform."

"This release represents the culmination of a year's worth development investment in the DashO product suite," says company vice president Michael Moores. "Our clients have long recognized the importance of protecting intellectual property and securing applications, but there is a lot of excitement about the prospect of combining application security with application monitoring to better establish R&D priorities and ultimately increase the return on application development investments."

More here from JAVA Developer's Journal.