Why is Java labeled as a "secure" language?

Question

I guess this is a general question, but I am going through introductory courses to java (SE/ME) and the study material claims that java is often used for "security purposes". It does not explain however what they mean by claiming that java incorporates good security.

Is it hacker proof? Does it produce highly stable software? What?

Security from my point of view (at the moment) is that it's in the hands of the developer writing the code, not the language itself?

Answer 1

Because Java compiles as bytecode which then runs inside a Virtual machine, it cannot access the computer it runs on like a natively compiled program can.

Answer 2

IMHO, that's a very misleading statement. In Java, you cannot access out-of-bound arrays, and you don't have pointers, and thus several security flaws like stack corruption or buffer overflow is impossible to exploit in Java. But Java is not inherently more secure than any other language; it's just there is less chance to make mistakes that can cause security flaws. In effect, this reduces security flaws, but it's totally misleading to say Java is secure.

Answer 3

The general reason why Java is considered to be more secure than, say C, is because it handles memory management for you. In other languages, programmers allocate their own memory and often fail to do it correctly, causing buffer overflows, etc. Of course the Java VM could still contain the very same types of bugs, but it's well tested over time, unlike every user written program.

So in that respect, it is more secure. But you can still write insecure code, because no language could ever protect you from writing just plainly erroneous code.

Answer 4

Several languages, most notably C and C++, have a class of bugs that can allow arbitary code to be executed when exploited - such bugs are quite common, and they're easy to make. These bugs are often some form of buffer overflow .

Java, and many other languages/platforms eliminate that class of bugs(bar potential exploitable bugs in the VM itself), which many will claim makes it more secure.

Answer 5

There are two things that make Java "more secure" than other language in certain aspects:

• Automatic array bounds checking and the lack of manual memory management make certain classes of programming mistakes that often cause serious security holes (such as buffer overruns) impossible. Most other modern languages share this feature, but C and C++, which were dominant (and still are major) application development languages at the time Java first appeared, do not.
• The Security Manager concept makes it relatively easy to run Java applications in a "sandbox" that prevents them from doing any harm to the system they are running on. This played an important part in promoting Java during its early days, since Applets were envisioned as a ubiquitous, safe way to have client-side web applications.

Answer 6

There is a nice overview at http://download.oracle.com/javase/6/docs/technotes/guides/security/overview/jsoverview.html .

Some examples:

• No buffer-overflow exploits
• Byte-code verification
• Security permissions for different codebases
• Security-related APIs

Answer 7

It is marketing)