TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Java.sun.com is down again - breaking bad apps across the land

97 点作者 zorlem大约 13 年前
This is a notice to fellow HN readers.<p>This morning around 8:00 UTC Nagios alerted me, that the thread count on a number of Apache Tomcat servers I support for a client started to rise dramatically. I've discovered that a library that is part of the application was trying to fetch DTDs like http://java.sun.com/dtd/properties.dtd from java.sun.com. The servers are unreachable so each request thread was taking 30+ seconds to time out. I've worked around the problem by putting an iptables rule for 192.9.162.55 port 80, that would reject the request immediately and informed to client to look for a permanent solution.<p>In case the library can't be fixed (I don't know who developed it), I'm planning on putting the relevant DTD files on a local HTTP server and redirect all requests for java.sun.com to that virtual host (eg. through relevant entries in the hosts file).<p>Check your application servers and the software you use if it processes XML documents. One way to check:<p><pre><code> $ netstat -ant | grep -E '192.9.162.55:80[[:space:]]+SYN_SENT' | wc -l 184 $ </code></pre> SYN_SENT is because the 192.9.162.55 (java.sun.com) is not responding ATM. If it becomes reachable again, just s/[[:space::]]+SYN_SENT// .<p>Relevant URLs for more information:<p>http://www.w3.org/blog/systeam/2008/02/08/w3c_s_excessive_dtd_traffic/<p>http://www.oasis-open.org/committees/entity/spec-2001-08-06.html<p>And a previous discussion here about the same problem:<p>http://news.ycombinator.com/item?id=3094075

7 条评论

ShabbyDoo大约 13 年前
More generally, it ought to be easier to constrain apps running on the JVM to declared sandboxes. I once looked at the Java security model and found it to be totally inadequate for such purposes as it seemed to have been designed for ensuring that desktops could not be compromised by rogue applets running in browsers. Specifically, I was surprised by the coarse-grainedness of the security settings. Want to limit access to the network by disallowing use of the Socket class? Done. Want to only allow access to a whitelist of hosts? No dice. No filesystem access at all? Easy. Limit the app to only reading and/or writing to certain directories? Not a chance.<p>I want to define whitelists for each environment in which my app will run -- development, QA, production, etc. To which hosts may it connect? Where may it access files? What else might I wish to constrain as way of avoiding inadvertent dependencies? Particular queues/topics on messaging buses? Database schemas within a particular server (network restrictions are too coarse for this)? When asking this question, I'm not trying to protect myself from rogue developers with malevolent intentions -- I just want to avoid a scenario like the one described by the OP.<p>Recently, I started-up the Java app upon which I am currently working and watched its network behavior via Microsoft's Wireshark-esque network monitoring tool. It turns out that EHCache now asks one of Terracotta's servers for the most recent EHCache version number so that it can spit an out-of-date warning in the logs. Benign and useful, but I still had to spend a few minutes in the EHCache source to make sure that, if Terracotta's servers were down, our app would still start-up.<p>Should one do this at the OS level (jails, perhaps)? I'm not limiting this idea to just Java apps, but I'm really only an expert in the Java space.<p>I also argue that the whitelist would help codify inter-app dependencies in large IT environments. A few years ago, the large IT shop for which I worked did a disaster recovery drill where they literally deployed 10's of apps in an IBM-provided datacenter as a dry run. One thing they learned was that a particular production app was erroneously configured to log certain audit events to a server in a QA environment (which was not part of the disaster recovery plan for obvious reasons). Whitelists would have prevented this issue.
评论 #3905559 未加载
评论 #3909046 未加载
评论 #3905589 未加载
评论 #3905497 未加载
blinkingled大约 13 年前
As a best practice applications should reference dtds from local filesystem. Most sane data centers would have outbound (App-&#62;Internet) access locked down - only needed hosts/ports are allowed after the application developer specifically requests for it.
评论 #3904962 未加载
评论 #3904889 未加载
ShabbyDoo大约 13 年前
Around 2005, I was semi-forced to use Xalan/Xerces (the Apache reference implementation of SAX, DOM, XPath, XSLT, etc.) for a project. These libraries were included in the JDK [edited from orig post]<p>To make sure that these libraries did not attempt to talk servers outside my company's control, I had to dig through the code and implement "neutered" forms of schema look-up interfaces, etc. I can't recall exact details. The default behavior was promiscuity and presumption, and making sure that these libraries didn't strike-up conversations with random servers was not trivial or terribly well documented. So, I'm not surprised by the current state of affairs.
sxtxixtxcxh大约 13 年前
you can pass -c to grep to get a count, you don't need to pipe it to `wc`
评论 #3905570 未加载
rshm大约 13 年前
virtualbox.org is down as well.
评论 #3904796 未加载
ryandvm大约 13 年前
They're probably busy switching everything over to an Oracle stack...
soc88大约 13 年前
I like how Oracle educates developers about the proper handling of DTD's. (They didn't break it by accident for the third time already, right? RIGHT?!)
评论 #3905413 未加载