NetApp founder brushes off Sun threat
361736
Dave Hitz hits back at Sun Chief Executive Jonathan Schwartz. Next up: Sun's countersuit.
203592
Red Hat, Dell, IBM and HP get SAMPed Analysis Almost five years ago, Sun's then CEO Scott McNealy told me his company had little intention of entering the great database fray. "You know, we haven't decided that is a war we want to go fight," he said. "Why not let them all beat each others' brains in?".â¦
247561
Ziff Davis - Sun's plans to offer Solaris code to the open-source community leaves some analysts scratching their heads.
550936
Sun exec: "If we want to keep Java relevant, we have to support this newer programming model."
300577
This user has been known to install software that crashes workstations and delete shared network directories -- and he's been blasted by IT support people. But this pilot fish wants to change that.
68608
Security bugs in Sun Microsystems' telnet service could allow attackers to gain unauthorized access to a user's system.
155909
I believe you have my stapler Sun Microsystems has gone very granola by buying desktop virtualization software player innotek. (The small 'i' stands for big innovation or something like that.)â¦
501907
Sun Microsystems Inc. is putting millions of Java users at risk by staggering the release of security patches for the software, security vendor eEye Digital Security Inc. said Monday.
288797
(InfoWorld) - SunÂ is putting millions of Java users at risk by staggering the release of security patches for the software, security vendor eEye Digital Security said Monday. To illustrate the problem, eEye points to a recent flaw in the Java Runtime Environment, used to run programs that are written in Java. In January, eEye discovered a serious bug in the Java Network Launching Protocol, which is used to run Java programs over the Web. Hackers could exploit this flaw by setting up a malicious Web site that could install unauthorized software on any Java-enabled PC that visited it, according to eEye. The flaw was patched in late June, but Sun has yet to push out the fix to its millions of Java users worldwide. Instead, Sun has made a developer release available on its Java.sun.com download page and is holding off on a more widespread release of the fix. The reason? So that developers can make sure that the update itself is bug-free. "There's an additional round of testing that happens before we blast it out to consumers," said Sun Spokeswoman Jacki Decoster. The problem with this approach is that a staggered release schedule gives criminals a window of opportunity to reverse engineer the Java bug and then create attack code that can be targeted at the millions of unpatched users, said Marc Maiffret, CTO with eEye. "Sun has such a horrible update process that they released patches for this flaw a couple weeks ago, and more patches for different versions [after that]," he said. "If people were reverse-engineering the patch a few weeks ago, they have a head start on the good guys." Microsoft releases security patches for all versions of its products simultaneously, but Sun is not the only company to stagger updates. Oracle, for example, habitually releases database patches for some of the less-popular operating system platforms weeks after its initial security updates. Leaving Java users unprotected like this not a good idea, said Cesar Cerrudo, CEO of Argeniss Information Security. But with Sun expecting to push out a fix for the problem later this week, hackers are not getting a lot of time to develop attack code, he said.
440203
Open source split Speculation is growing that one of Sun Microsystems' most influential figures has quit following the decision to open source Java.â¦
313797
BusinessWeek Online - Tech industry mavens had their doubts about Jonathan I. Schwartz when he was promoted to chief executive of Sun Microsystems Inc. (NASDAQ:SUNW - News) in April, replacing longtime CEO Scott McNealy. There was the ponytail, which helps Schwartz look a lot younger than his 40 years. He also has a brash style that seemed to be out of sync with Sun's grim realities. Did this Web 2.0 CEO have enough gravitas to run a struggling computer company?
276851
Linux creator Linus Torvalds doesn't trust Sun or its motives when it comes to open-source, and Sun CEO Jonathan Schwartz wants to change his mind -- with some home cooking.
344979
Solaris tools breath easy The release of the 6.0 version of the Sun Microsystems-sponsored, open-source NetBeans IDE last week sounded the death knell for two other Sun-spawned development tools: Java Studio Enterprise and Java Studio Creator.â¦
627854
OS under attack from families Exclusive A pair of Sun's top Solaris executives have scurried right on out of the company, The Register can reveal.â¦
509769
News.com&#39;s John Borland lays out the issues with shelving Microsoft&#39;s insecure Internet Explorer with a non-MS brower, such as Firefox... The problem is that many Web developers create their sites so they
431089
Kodak&#39;s claim that Sun&#39;s use of Java violates three patents it holds could cast a cloud over Java&#39;s future direction. By Charles Babcock.
145331
(InfoWorld) - Is your software vendor doing everything it can to secure its products? As Sun MicrosystemsÂ learned this week, there is always room for improvement. Sun changed the way it releases security updatesÂ to its desktop Java SE (Standard Edition) platform this week following pressure from customers and security expertsÂ such asÂ Marc Maiffret, chief technology officer with eEye Digital Security. Maiffret had blasted SunÂ a few months ago for releasing Java fixes to developers ahead of regular users -- a practice that he said could give the bad guys a golden opportunity to reverse-engineer the developer code and uncover new ways of attacking Sun's 800 million Java SE users. With Sun now pledging to release all of its Java SE updates at the same time, IDG News Service asked Maiffret what suggestions he'd offer the software industry on improving security. Following are his top five tips: 1. Make it easy for the hackers to tell you what they know. According to Maiffret this is the No. 1 way to improve your relationship with the security community and it's easily done: "Have the secure@ and security@ e-mail addresses listed under your contacts page or some sort of security landing page," he said. 2. Do what Sun did. Make sure that you fix the bugs in all of your products at the same time so that you don't accidentally hand over security details in code that could be reverse-engineered, then used to attack customers who haven't yet been given the fix. 3. Make sure there is a very straightforward way that the customer is notified of security fixes -- either via e-mail or through the product itself. 4. Separate security updates from feature updates. This is especially important for consumer products. "A lot of times you'll have a vendor trying to tell you, 'You want this new photobook album functionality?' and you'll say no without realizing that it actually contains critical security updates," Maiffret said. 5. List your upcoming security fixes as soon as you've identified a new issue. Yes, it may make for some bad PR at first, but by notifying users as soon as a vulnerability has been verified, you document your ability to patch the problem. "When you have that public timeline, it actually allows customers to see if someone's taking too long so they can put pressure to have it fixed more quickly," he said.