Criticism of Java
The Java programming language and Java software platform have been criticized for design choices including the implementation of generics, forced object-oriented programming, the handling of unsigned numbers, the implementation of floating-point arithmetic, and a history of security vulnerabilities in the primary Java VM implementation, HotSpot. Software written in Java, especially its early versions, has been criticized for its performance compared to software written in other programming languages. Developers have also remarked that differences in various Java implementations must be taken into account when writing complex Java programs that must work with all of them.[1]
Language syntax and semantics
Checked exceptions
Java introduced checked exceptions where a method must declare the checked exceptions it throws in the method signature. This can result in unnecessarily verbose boilerplate code. No major language has followed Java in implementing checked exceptions.
Generics
When generics were added to Java 5.0, there was already a large framework of classes (many of which were already deprecated), so generics were implemented using type erasure to allow for migration compatibility and re-use of these existing classes. This limited the features that could be provided, compared to other languages.[2][3]
Because generics are implemented using type erasure the actual type of a template parameter E is unavailable at run time. Thus, the following operations are not possible in Java:[4]
public class MyClass<E> {
public static void myMethod(Object item) {
if (item instanceof E) { //Compiler error
...
}
E item2 = new E(); //Compiler error
E[] iArray = new E[10]; //Compiler error
}
}
Additionally, in 2016, the following example was found revealing Java to be unsound and in turn making JVMs which threw ClassCastExceptions or any other kind of runtime error technically non-conforming.[5] This was corrected in Java 10.
class Nullless<T, U> {
class Constrain<B extends U> {}
final Constrain<? super T> constrain;
final U u;
Nullless(T t) {
u = coerce(t);
constrain = getConstrain();
}
<B extends U>
U upcast(Constrain<B> constrain, B b) {
return b;
}
U coerce(T t) {
return upcast(constrain, t);
}
Constrain<? super T> getConstrain() {
return constrain;
}
public static void main(String[] args) {
String zero = new Nullless<Integer,String>(0).u;
}
}
Noun-orientedness
By design, Java encourages programmers to think of a solution in terms of nouns (classes) interacting with each other, and to think of verbs (methods) as operations that can be performed on or by that noun.[6] Steve Yegge argues that this causes an unnecessary restriction on language expressiveness because a class can have multiple functions that operate on it, but a function is bound to a class and can never operate on multiple types.[7]
Many other
Unsigned integer types
Java lacks native
Operator overloading
Java has been criticized for not supporting user-defined operators.[citation needed] Operator overloading improves readability,[11] so its absence can make Java code less readable, especially for classes representing mathematical objects, such as complex numbers and matrices. Java has only one non-numerical use of an operator: +
and +=
for string concatenation. However, this is implemented by the compiler, which generates code to create StringBuilder instances. It is impossible to create user-defined operator overloads.
Compound value types
Java lacks compound value types, such as
Large arrays
Java has been criticized for not supporting arrays of 231 (about 2.1 billion) or more elements.[16][17] This is a limitation of the language; the Java Language Specification, Section 10.4, states that:
Arrays must be indexed by int values... An attempt to access an array component with a long index value results in a compile-time error.[18]
Supporting large arrays would also require changes to the JVM.[19] This limitation manifests itself in areas such as collections being limited to 2 billion elements[20] and the inability to memory map continuous file segments larger than 2 GB.[21] Java also lacks (outside of its 2D arrays) multidimensional arrays (contiguously allocated single blocks of memory accessed by a single indirection), which limits performance for scientific and technical computing.[13]
Integration of primitives and arrays
Arrays and primitives are somewhat special and need to be treated differently from classes. This has been criticized[22] because it requires many variants of functions when creating general-purpose libraries.
Parallelism
Per Brinch Hansen argued in 1999[23] that Java's implementation of parallelism in general, and monitors in particular, does not provide the guarantees and enforcements required for secure and reliable parallel programming. While a programmer can establish design and coding conventions, the compiler can make no attempt to enforce them, so the programmer may unwittingly write insecure or unreliable code.
Serialization
Java provides a mechanism for
Floating point arithmetic
Although Java's
strictfp
modifier, such as Exception Flags and Directed Roundings. The extended precision types defined by IEEE 754 (and supported by many processors) are not supported by Java.[27][28][29]Lack of tuples
Java does not natively support tuples, resulting in a proliferation of third-party implementations which must be imported and handled by the programmer.[30]
Lambda expressions
Until Java 8 introduced lambda expressions, it was difficult to pass a method as a parameter to another method.
Abstracted relationship between code and hardware
In 2008 the United States Department of Defense's Center Software Technology Support published an article in the "Journal of Defense Software Engineering" discussing the unsuitability of Java as the first language taught. Disadvantages were that students "had no feeling for the relationship between the source program and what the hardware would actually do" and the impossibility "to develop a sense of the run-time cost of what is written because it is extremely hard to know what any method call will eventually execute".[31] In 2005 Joel Spolsky criticized Java as an overfocused part of universities' curricula in his essay The Perils of JavaSchools.[32] Others, like Ned Batchelder, disagree with Spolsky for criticizing the parts of the language that he found difficult to understand, claiming that Spolsky's commentary was more of a 'subjective rant'.[33]
Performance
Before 2000, when the
Performance has improved substantially since early versions.
Java bytecode can either be interpreted at run time by a virtual machine, or be compiled at load time or run time into native code which runs directly on the computer's hardware. Interpretation is slower than native execution, but compilation at load time or run time has an initial performance penalty. Modern JVM implementations all use the compilation approach, so after the initial startup time the performance is similar to native code.
Game designer and programmer
Security
The Java platform provides a security architecture
In 2010, there was a significant rise in malicious software targeting security flaws in the sandboxing mechanisms used by Java implementations, including Oracle's. These flaws allow untrusted code to bypass the sandbox restrictions, exposing the user to attacks. Flaws were fixed by security updates, but were still exploited on machines without the updates.[40]
Critics have suggested that users do not update their Java installations because they don't know they have them, or how to update them. Many organisations restrict software installation by users, but are slow to deploy updates.[40][41]
Oracle has been criticized for not promptly providing updates for known security bugs.[42] When Oracle finally released a patch for widely-exploited flaws in Java 7, it removed Java 6 from users' machines, despite it being widely used by enterprise applications that Oracle had stated were not impacted by the flaws.[43]
In 2007, a research team led by Marco Pistoia exposed another important flaw of the Java security model,[44] based on stack inspection. When a security-sensitive resource is accessed, the security manager triggers code that walks the call stack, to verify that the codebase of each method on it has authority to access the resource. This is done to prevent confused deputy attacks, which take place every time a legitimate, more privileged program is tricked by another into misusing its authority. The confused-deputy problem is a specific type of privilege escalation. Pistoia observed that when a security-sensitive resource is accessed, the code responsible for acquiring the resource may no longer be on the stack. For example, a method executed in the past may have modified the value of an object field that determines which resource to use. That method call may no longer be on the stack when it is inspected.
Some permissions are implicitly equivalent to Java's AllPermission
. These include the permission to change the current security manager (and replace it with one that could potentially bypass the stack inspection), the permission to instantiate and use a custom class loader (which could choose to associate AllPermission
to a malicious class upon loading it), and the permission to create a custom permission (which could declare itself as powerful as AllPermission
via its implies
method). These issues are documented in Pistoia's two books on Java Security.[45][46]
Parallel installations
Before Java 7, the installers would not remove older Java installations. It was common on a Windows system to see multiple installations of Java on the same computer.[47][48][49] Multiple installations were permitted and could be used by programs that rely on specific versions, including malicious programs. This issue was addressed in Java 7: with the user's permission, the installer removes earlier installations.[50]
Automatic updates
This section possibly contains original research. (November 2017) |
As of 2014, common third-party tools (such as Adobe Flash and Adobe Reader) have been the subject of scrutiny for security vulnerabilities. Adobe and others have moved to automatic updates on Windows. These don't need any user action, and assure that security issues are promptly resolved with minimal effort by users or administrators.
As of 2015, Java 8 still requires users to update Java themselves. But on Windows only those with administrator privileges can update software. The Windows Java updater frequently triggers a disruptive User Account Control elevation prompt: whatever users choose, they still get the same "Java needs to be updated" message.
JIT compilation fundamentally uses executable data, and thus poses security challenges and possible exploits.
See also
- Comparison of Java and C++
- Comparison of Java and C#
- Comparison of the Java and .NET platforms
- Java performance
- Write once, run anywhere
- Scala, a programming language designed to address criticisms of Java
Notes
- ^ Wong, William (27 May 2002). "Write Once, Debug Everywhere". electronicdesign.com. Archived from the original on 21 March 2009. Retrieved 3 August 2008.
So far, the "write-once, run-everywhere" promise of Java hasn't come true. The bulk of a Java application will migrate between most Java implementations, but taking advantage of a VM-specific feature causes porting problems.
- ^ "Generics in Java". Object Computing, Inc. Archived from the original on 2 January 2007. Retrieved 9 December 2006.
- ^ "What's Wrong With Java: Type Erasure". 6 December 2006. Archived from the original on 22 July 2012. Retrieved 9 December 2006.
- ^ "Type Erasure".
- ISSN 0362-1340.
- ^ "Java SE Specifications".
- ^ Yegge, Steve. "Execution in the Kingdom of Nouns".
- ^ "Java libraries should provide support for unsigned integer arithmetic". Bug Database, Sun Developer Network. Oracle. Retrieved 18 January 2011.
- ^ Owen, Sean R. (5 November 2009). "Java and unsigned int, unsigned short, unsigned byte, unsigned long, etc. (Or rather, the lack thereof)". Retrieved 9 October 2010.
- ^ "Unsigned Integer Arithmetic API now in JDK 8 (Joseph D. Darcy's Oracle Weblog)". Retrieved 15 May 2016.
- ^ "C++ Operator Overloading". 7 April 2016. Archived from the original on 5 February 2020. Retrieved 5 February 2020.
- ^ Java Grande Forum Panel (November 1998). "Java Grande Forum Report: Making Java Work for High-End Computing" (PDF). SC98. Archived from the original (PDF) on 18 May 2013. Retrieved 10 February 2012.
- ^ .
True rectangular multidimensional arrays are the most important data structures for scientific and engineering computing.
- ^ Hutchinson, Ben (14 June 2008). "The JVM needs Value Types". Retrieved 3 February 2012.
- ^ "java.util.HashMap Source Code". JDK 8. zGrepCode. Retrieved 6 August 2018.
- S2CID 14672978.
...it is not possible in Java to have arrays with more than 231 entries...
- ^ "Why does Java's Collection.size() return an int?". Stack Overflow. Archived from the original on 26 March 2013. Retrieved 10 February 2012.
- ^ James Gosling; Bill Joy; Guy Steele; Gilad Bracha. "The Java Language Specification" (Third ed.). Addison Wesley. Retrieved 6 February 2012.
- ^ Lowden, James (24 March 2009). "Proposal: Large arrays (take two)". Java.net coin-dev mailing list. Retrieved 10 February 2012.
- ^ "java.util.Collection". Java™ Platform, Standard Edition 7 API Specification. Retrieved 10 February 2012.
- ^ "java.nio.ByteBuffer". Java™ Platform, Standard Edition 7 API Specification. Retrieved 6 February 2012.
- ^ Sherman R. Alpert (IBM) (1998). "Primitive Types Considered Harmful". Java Report, November, 1998 (Volume 3, Number 11). Retrieved 18 November 2015.
- ^ Brinch Hansen (April 1999). "Java's Insecure Parallelism" (PDF). SIGPLAN. Retrieved 13 October 2012.; alternate url
- ^ Serialization and Deserialization in Java with Example by geeksforgeeks website
- ^ Serialization Must Die Security issues and problems with serialization of random objects. by dzone.com
- ISBN 978-0-13-468599-1.
- ^ Kahan, W.; Joseph D. Darcy (1 March 1998). "How Java's Floating-Point Hurts Everyone Everywhere" (PDF). Retrieved 9 December 2006.
- ^ "Types, Values, and Variables". Sun Microsystems. Retrieved 9 December 2006.
- ^ "Java theory and practice: Where's your point? Tricks and traps with floating point and decimal numbers". IBM. 1 January 2003. Retrieved 19 November 2011.
- ^ "What's Wrong in Java 8, Part V: Tuples - DZone". dzone.com. Retrieved 18 March 2023.
- ^ Robert B.K. Dewar; Edmond Schonberg (1 January 2008). "Computer Science Education: Where Are the Software Engineers of Tomorrow?". CrossTalk Jan 2008. U.S. DOD Software Technology Support Center. Archived from the original on 12 April 2009. Retrieved 15 March 2015.
The Pitfalls of Java as a First Programming Language [...] Students found it hard to write programs that did not have a graphic interface, had no feeling for the relationship between the source program and what the hardware would actually do, and (most damaging) did not understand the semantics of pointers at all, which made the use of C in systems programming very challenging.
- joelonsoftware. Retrieved 18 November 2015.
It's bad enough that JavaSchools fail to weed out the kids who are never going to be great programmers, which the schools could justifiably say is not their problem. Industry, or, at least, the recruiters-who-use-grep, are surely clamoring for Java to be taught. But JavaSchools also fail to train the brains of kids to be adept, agile, and flexible enough to do good software design
- ^ Ned Batchelder (1 January 2006). "Joel Spolsky is a crotchety old man". nedbatchelder.com. Retrieved 2 February 2016.
Why does Joel pick out pointers and recursion as the two gatekeeper concepts? Because he found them difficult? As Tim Bray points out, Java is perfectly adept at recursion, and concurrency may be a more important and difficult concept to master in any case. The emphasis on recursion in Lisp languages is a bit over the top, and doesn't carry into other programming cultures. Why do people think it's so important for software engineering? Don't get me wrong: I love recursion when it's the right tool for the job, but that is just not that often to warrant Joel's focus on it as a fundamental concept.
While we're hunting around for tough concepts that separate the men from the boys, what about the one that got Joel and I into a tussle two years ago: Exceptions. He doesn't like them, basically, because they confuse him. Is this any different than a Java guy not liking pointers? Yes, you can avoid exceptions and use status returns, but you can also try really hard to avoid pointers. Does that mean you should? So Joel's got the concepts he likes (pointers and recursion), and laments their decline, but doesn't seem to notice that there are newer concepts that he's never caught on to, which the Java kiddies feel at home with. - ^ "Computer Language Benchmarks Game: Java vs Gnu C++". benchmarksgame.alioth.debian.org. Archived from the original on 13 January 2015. Retrieved 19 November 2011.
- ^ a b J.P.Lewis & Ulrich Neumann. "Performance of Java versus C++". Graphics and Immersive Technology Lab, University of Southern California.
- ^ "The Java Faster than C++ Benchmark". Retrieved 15 May 2016.
- ^ FreeTTS - A Performance Case Study Archived 25 March 2009 at the Wayback Machine, Willie Walker, Paul Lamere, Philip Kwok
- John D. Carmack (27 March 2005). "Cell phone adventures". John Carmack's Blog. armadilloaerospace.com. Archived from the originalon 24 November 2015. Retrieved 10 November 2015.
- ^ Java SE Platform Security Architecture. Oracle. Retrieved 2013-04-23.
- ^ a b "Researchers Highlight Recent Uptick in Java Security Exploits".
- ^ "Have you checked the Java?". Archived from the original on 21 September 2012. Retrieved 25 November 2010.
- ^ "Oracle knew about critical Java flaws since April". The Register. 30 August 2012. Retrieved 30 August 2012.
- ^ "'Silent but deadly' Java security update breaks legacy apps - dev". The Register. Retrieved 15 May 2016.
- S2CID 4112294.
- ISBN 978-0-13-015592-4.
- ISBN 978-0-321-11889-9.
- ^ Grimes, Roger A. (15 November 2011). "Old Java versions breed new security exploits". InfoWorld. Retrieved 10 September 2023.
- ^ Krill, Paul (4 May 2012). "Oracle urges removal of older Java versions due to security risks". InfoWorld. Retrieved 10 September 2023.
- ^ "Why should I uninstall older versions of Java from my system?". Java. 10 September 2023. Retrieved 10 September 2023.
- ^ "Java 6 Auto-Update to Java 7". Oracle. 10 September 2023. Retrieved 10 September 2023.
External links
- Free But Shackled - The Java Trap, an essay by Richard Stallman of the free software movement (dated April 12, 2004)
- Computer Science Education: Where Are the Software Engineers of Tomorrow? (dated January 8, 2008)
- What are Bad features of Java?