It’s time for another Java update — and it’s a relatively big one. Oracle is releasing fixes for 42 security bugs in its highly vulnerable Java programming language today. Thirty-nine of those bugs enable hackers to hit you with attacks you may never detect.

For security professionals, Java has been the gift that keeps on giving — if the gift was a stomach virus. Despite repeated updates to the programming language, cyber-criminals continue to find new ways to exploit it. They’ve hit hundreds of thousands of nameless individuals to big-time companies such as Apple, Microsoft, and Facebook with their variety of attacks.

Oracle announced the update in an announcement yesterday, saying the patch is slated for today. The company specifically states that the 39 called-out bugs “may be exploited over a network without the need for a username and password.”

New dialog boxes for the Java browser plugin are also being released. These are warning windows that pop up whenever Java is trying to run. The type of warning you receive is based on the quality of the digital certificate of that app.

Low-risk warnings will appear if the certificate can be identified and has been signed by a certificate authority, or if the identified certificate has extra information. For these you will see either the Java logo, publisher’s logo, or a blue shield. You’ll be able to hide future warnings for publishers who provide these credentials.

High-risk apps, however, will show you a yellow warning triangle for those apps that have an untrusted or expired certificate. A yellow shield is displayed for unsigned or invalid certificates. For these apps you will have to both check a box that says, “I accept the risk and want to runt his app” and then click “run.” Or you can immediately click cancel.

As we’ve seen with the last rounds of Java updates, however, there are more untapped vulnerabilities to be found. Consider keeping Java off (and if you haven’t turned it off yet, you should do so) and waiting to see if anything is uncovered in the weeks following the release.

hat tip Ars Technica; Oracle image via Peter Kaminski/Flickr, Unsigned cert dialogue box image via Oracle

ZeroTurnaround, an Estonian company with its hands deep in the Java cookie jar, has just bought Javeleon, a tool that lets you instantly see changes to code in a running Java application.

ZeroTurnaround makes JRebel, a tool for Java development. One of JRebel’s features is pretty much exactly what Javeleon does — instantly viewing changes to code.

Javeleon co-founders Dr. Allan Gregersen and Michael Rasmussen will meld into ZeroTurnaround’s Estonian product and engineering teams. The duo founded the company in 2012 based on research done at the technology-focused Mærsk Mc-Kinney Møller Institute at the University of Southern Denmark; sounds like ZeroTurnaround has bought itself one heck of a brain trust.

“We are thrilled to be joining the ZeroTurnaround team and excited to dive right in and help integrate the Javeleon technology with the JRebel product line,” said Dr. Gregersen in a statement on the news.

“We have admired the ZeroTurnaround success story for years, and we believe our involvement will positively impact ZeroTurnaround’s future growth.”

ZeroTurnaround was founded in 2009 and has two locations in Estonia, one in Prague, and a sales and marketing home base in Boston.

Image credit: bluehand/Shutterstock

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Oracle has issued an emergency patch for its Java software after a string of high-profile hacking incidents at companies including Apple, Facebook, Twitter, and Microsoft.

Java has become a persistent thorn in the side of major companies. A small number of Apple employees had their computers hacked via a Java exploit in February. Facebook disabled Java after several of its employees were hacked as well.

The U.S. Department of Homeland Security even recently recommended to stop using Java because of its persistent security problems.

Oracle’s new emergency patch specifically addresses issues affecting Java running in web browsers. The company writes in its latest security alert:

This Security Alert addresses security issues CVE-2013-1493 (US-CERT VU#688246) and another vulnerability affecting Java running in web browsers. These vulnerabilities are not applicable to Java running on servers, standalone Java desktop applications or embedded Java applications. They also do not affect Oracle server-based software.

These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. For an exploit to be successful, an unsuspecting user running an affected release in a browser must visit a malicious web page that leverages these vulnerabilities. Successful exploits can impact the availability, integrity, and confidentiality of the user’s system.

Sewing patch on jeans via cosma/Shutterstock

Mac-using iPhone developers are the latest targets of a widespread, sophisticated cyberattack.

Microsoft revealed yesterday that it got hit with the same kind of Java-based hack that targeted Apple and Facebook earlier this year, and which may also have compromised Twitter, spilling secrets on 250,000 of its customers.

The Microsoft attack seems to have had a smaller impact than the others.

“During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations,” Microsoft wrote.

It’s not clear if all three companies were targeted by the exact same attacker, but the techniques used were similar:

• Programmers within the targeted company visited a website aimed at mobile app developers, probably iPhone developers specifically.
• The website infected the programmers’ computers, via their web browser’s Java plugin. Initially the malware appears to have targeted Macs, but Reuters reports that there is also a version that targets Windows PCs.
• The malware on the developer computers then attempted to transmit information back to the hackers.

It’s not clear from these reports exactly how much information got leaked, or what kind of information the hackers were seeking. Microsoft says no customer data was compromised. Facebook also said earlier this month that no customer data got out.

VentureBeat’s upcoming DevBeat conference — by and for hackers — will include sessions on what developers need to know about security, including an all-night “breakathon” where you’ll learn black hat techniques. Find out more about DevBeat.

Twitter wasn’t so lucky: 250,000 of its customer accounts were compromised, with hackers making off with usernames, hashed passwords, and session IDs.

Also unclear: The source of these attacks. However, Reuters reports that the attacks may have originated in China. A widely-publicized report from Mandiant this week identified a People’s Liberation Army unit, called APT1, which it claims has been responsible for a long-term, sophisticated cyber espionage campaign.

Apple responded earlier this month by issuing its own patch for OS X. Oracle, which publishes Java, issued its own patch later.

As a side note: Apple has not shipped Java since Mac OS X Lion — which launched in July of 2011 — and also disables Java if it has not been used in 35 days.

That’s looking more and more like a wise idea.

Photo credit: carlosj via photopin cc

Facebook announced that it was hacked in a blog post today after some of its employees visited an infected mobile developer website in January. The company says it has found no evidence that the breach affected user data.

“They gained limited visibility into our systems,” Fred Wolens, a spokesperson for Facebook, told VentureBeat in an interview, “We’ve accelerated our program to disable Java in our environment.”

The company explained in the blog post that the laptops that were infected were “fully patched” and ran the most up-to-date antivirus software prior to the infection. It is currently working with law enforcement to dig into the hack’s details. The malware came through another issue with Java, the programming language that Oracle recently patched to fix a number of other issues. The Department of Homeland Security even recommended that people uninstall Java since hackers were finding new holes often.

“After analyzing the compromised website where the attack originated, we found it was using a ‘zero-day,’ previously unseen exploit to bypass the Java sandbox (built-in protections) to install the malware,” said Facebook in the blog post. “We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability.”

Facebook has not specified who the attackers are, and it very well may not know. The company does, however, say that it was “not alone in this attack” and that it wanted to tell the world about this hack quickly so that others can start their own remediation.

hat tip AllThingsD; Thumbs down image via Shutterstock

They work hard and make good money — which got even better in 2012.

Source: Riviera Partners

Average salary by programming language

The average salary of a Silicon Valley developer jumped about $4,300 in 2012 to reach $118,900, a new study by Riviera Partners, a technical recruiting firm in the Bay Area says.

Database specialists brought home the most bacon, at $130,500, while lowly front-end developers wrangling CSS, Javascript, and some small remnants of HTML pulled in a relatively lowly $109,200.

Interestingly, when you break down the numbers by coding specialty, relatively out-of-favor Java developers make the most money, at $122,400. Developers in the popular but perhaps more accessible PHP programming language make $106,700, while devotees of relatively new languages Python and Ruby bring home $117,900 and $121,400, respectively.

So what else is new?

Not gender equality. Silicon Valley engineers are still overwhelming male, with 86 percent of developers prominently featuring a Y chromosome.

More details in the infographic below:

photo credit: Carsten Schertzer via photopin cc

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Get your exploit here, get your exploit here! Only days after Oracle patched a critical hole in Java, a new vulnerability is being sold on the black market for $5,000 or the highest bidder.

A post popped up on a “hacker forum,” according to Krebs on Security, the day after Oracle released its fix for Java. The post, created by one of the forum’s administrators, boasted about a zero-day attack in Java that is not included in any exploit packs — or bundled tools to aid a person in hacking someone’s systems that are often sold on these underground markets. The advertisement has since been removed from the website, perhaps because someone already paid up the money. It read, in part:

“And you thought Java had epically failed when the last 0day came out. I lol’d. The best part is even-though java has failed once again and let users get compromised… guess what? I think you know what I’m going to say… there is yet another vulnerability in the latest version of java 7. I will not go into any details except with seriously interested buyers.”

The hacker did mention, however, that the exploit came with Java source code and that it is a “weaponized version.” Bids higher than $5,000 are, of course, accepted.

The most recent hold Java fixed allowed hackers to enter a computer by using compromised websites as the entry-point into Java. Once in the system, they could steal any information, or hook up the computer to a botnet — or a string of infected computers that can be used to launch attacks against other computers.

The Department of Homeland Security issued a message prior to the fix, urging people to disable Java until it was patched up. After the patch came, however, DHS was unconvinced and warned people that Java likely still had holes in it, and that people should keep Java disabled.

Spilled coffee image via Shutterstock

The Department of Homeland Security warned today that you should still disable Java soon after Oracle released a patch for a hole in Java that enabled hackers to sneak into your computer to steal information or hook you up to a botnet.

“DHS is skeptical because it’s highly likely yet another Java vulnerability is found soon, starting this all over again,” said F-Secure chief research officer Mikko Hypponen in an email to VentureBeat. “The problem is the Java plugin in the browser. Remove the plugin from your daily browser. Then, if some site that you really need needs Java, use a secondary browser with the plugin enabled just for that site.”

The hole recently fixed in Java 7 enables an attacker to secretly install software on your computer by using an infected website to access Java and secretly slip into your system. Criminals may also create fake websites intended to trick a user into thinking that it is legitimate. From there, the hackers can grab your personal information or use your computer as part of a botnet string that could be used to attack other systems.

“Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11,” the Department of Homeland Security warned in its advisory, “This will help mitigate other Java vulnerabilities that may be discovered in the future.”

The hole affects Windows computers, Macs, and Linux machines. DHS warns that other devices that use Java 7 may also be at risk.

Oracle provides detailed instructions on how to disable Java on a number of different systems on its website.

hat tip The New York Times; Homeland Security image via DonkeyHotey/Flickr

(Updated)

The U.S. Department of Homeland Security’s Computer Emergency Readiness Team says no one should use Java until Oracle fixes a hole that permits attackers to jump inside your computer and steal information.

“We estimate that about 100 million computer users are now in immediate danger of getting exploited. Given the current circumstances – wide availability of the exploit code and no fix from Oracle scheduled for the near future – disabling the Java feature in the browser is the wisest choice,” Bitdefender senior e-threat analyst Bogdan Botezatu told VentureBeat in an email.

Java is a widely-used programming language, now overseen by Oracle, that runs on many different platforms, including PCs, Macs, and mobile devices. Java programs are supposed to run in a secure “sandbox,” but security researchers recently found a vulnerability that allows attackers to infect that computer’s systems with software that further allows them to steal personally identifiable information. Of course, that can lead to bank accounts being drained or identity theft.

Beyond that, however, the hole also lets the attacker hook your computer up to a botnet, or a string of computers that can be used to do the bidding of the cyber criminal.

The malicious software is distributed through infected websites that Homeland Security points out could be made to look like legitimate websites.

“This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered,” the Homeland Security advisory states. “To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available.”

This vulnerability only affects PCs, but a recent and similar incident involving the “Flashback Trojan” showed that Java has weaknesses in Macs as well. According to MacRumors Apple isn’t taking any chances this time and has blacklists Java entirely for its OS X.

We have contacted Oracle and will update the post if we hear back from the company.

UPDATE 1/12/2013: Oracle has stated that “a fix will be available shortly” for the Java flaw, Reuters reports.

via Reuters; Oracle image via Peter Kaminski/Flickr

Washington state is the toughest recruiting market for companies looking for agile developers, according to staffing and recruiting agency Yoh … which makes it the best place to be looking for a job. California is not far behind, with San Francisco being the city with the highest ration of open jobs to job-seekers in the agile market.

Yoh and jobs site CareerBuilder say that the imbalance is resulting in impressive earning opportunities for Java developers, web developers, project managers, business analysts, and .Net developers. Agile developers are getting average salaries of $110,781 — and a 90th percentile salary in the $160,000 to 170,000 range — as startups, development shops, and established enterprises such as Microsoft, IBM, and Northrop Grumman compete for scarce talent.

The states with the most demand include:

• Washington
• Oregon
• California
• Utah
• Minnesota
• New York
• Massachusetts

The cities with the most talent, however, have only a partial overlap — which means that developers who are willing to move could see impressive income gains.

• San Jose
• Chicago
• New York
• Houston
• Atlanta
• Austin
• Dallas

Here’s the full infographic:

photo credit: Tess Aquarium via photopin cc

The infographic is licensed under a Creative Commons Attribution-NoDerivs 3.0 Unported License. Based on work by Yoh at www.agiletalentstudy.com.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Now stop imagining and just watch the video below.

I just interviewed Kent Mitchell, Zend’s senior director of product management. Zend, of course, is the company that makes the most-used PHP development environment. It’s the company started by Andi Gutmans and Zeev Suraski, the primary originators of the PHP language (after founder Rasmus Lerdorf).

PHP jockies out there will be impressed, I think, to find that Mitchell is not just a marketing drone … he’s a full-on, hard-core, honest-to-goodness developer.

And given that Zend just announced the ability to create mobile apps directly within Zend Studio, I challenged him to show me how it works, from start to finish.

I think when you’ll watch that you will find he came pretty damn close:

As Mitchell says, “In just a few minutes, I’ve created a new web service, I’ve deployed it into the cloud, and I’ve created some new widgets on this mobile site. Now, we want to turn around and make this a native application.”

And he does, in just a few more clicks, create a project that is tied to the Xcode tools that iOS developers would normally use to create native apps. The same functionality, of course, is possible for Android applications.

Frankly, this is pretty amazing.

While creating apps, developers can test and view their apps right on their development machine, and integrated debugging is included. It’s an over-used expression, but this is a game-changer for developers and enterprises.

Photo credit: John Koetsier

Disclosure: Zend paid most of my travel expenses to attend ZendCon. My reporting, however, remains my own.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

New: watch a PHP developer create a native mobile app in 10 minutes.

This morning at ZendCon, Zend chief executive Andi Gutmans announced that Zend Studio 10 will let PHP developers prototype and build native mobile apps right from the language they know best, PHP. The new capability includes a WYSIWYG drag-and-drop mobile interface builder, integration with the Apache project’s Cordova to access native mobile APIs such as those for cameras and accelerometers, and built-in PhoneGap integration so developers can publish native app packages to the various app stores.

Zend CEO Andi Gutmans at ZendCon 2012

This is a major game-changer for PHP developers, who until now have been shut out of the mobile app revolution. Apps for iPhone and iPad are coded in Objective-C, while apps for Google’s Android mobile operating system are built in Java. This new announcement means that millions of new developers have just been invited to the mobile development party.

“We’re the only vendor that is really taking a really strong approach on this,” Gutmans told me last week in a sneak preview. “This is a seamless development experience.”

This new capability, Gutmans said, allows developers to build out backend code and front-end interface at the same time. That’s actually the hard part, according to Zend SMO Elaine Lennox.

“Modern apps connect to multiple different back-end systems such as CRM systems, cloud services, and social networks. With all these different data services in lot of different places, wiring them together can be harder to build than the app,” she said. “But now, a developer can go into Zend studio, create the front-end with a WYSIWYG interface builder, and connect it all on the backend.”

But it’s not just about mobile.

Instead, Gutman’s vision is about two massive revolutions: mobile and cloud. The new Zend Server is built for cloud, whether developers use Amazon, Rackspace, Windows Azure, or other clouds. In the new development architecture, apps access clouds, which then access APIs, social services, or SaaS options such as Salesforce.

“We’re giving you a common workflow between client and cloud for building mobile apps,” Gutmans told me. “We’re defining a new architecture: cloud service architecture. I think it’s completely a first … I haven’t seen it before.”

Source: Zend

Zend’s view of the mobile app

Andi Gutmans, who is also one of the primary authors of the PHP language, had hinted at new mobile options for PHP developers to VentureBeat three weeks ago.

Zend and PHP have made significant inroads into the enterprise market in the last few years — Gutmans told me that “when we go up against Java or .Net, we win — and the new integrated development environment for mobile, cloud, and business applications is part of a new mobile-first push for the company.

Citing a study saying that mobile development projects will outnumber PC-focused projects by four to one, and that the world will have 7.4 billion mobile devices by 2015, Gutmans wants to help enterprises create “composite” apps, apps that combine intelligence from internal business systems, external networks and applications, and personalizations to individual users.

The new Zend Studio will allow drag-and-drop connection to various cloud services as well as the visual creation of mobile interfaces, allowing developers to manage all the components of development for complex, connected mobile apps up in one interface.

“We’re bringing mobile and cloud together,” Gutmans said.

And that’s going to give PHP developers — and PHP-using enterprises — a massive new opportunity to use familiar tools to create new experiences for users in the office, and out.

photo credit: Sugar Daze via photopin cc

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Today, that’s exactly what they’ve done, making the code available to developers in a Github repository.

We open sourced the @clutchio bits finally so you can run the service on your own engineering.twitter.com/2012/10/open-s…

—
Twitter Open Source (@TwitterOSS) October 11, 2012

Clutch.io’s A/B testing tool allows mobile developers to add multivariate tests to their apps with just a few lines of code. They can then show different versions of their app to different users and measure the effectiveness of each variation.

The recently acquired company has also open-sourced its Clutch Framework, which enables developers to mix native code and web technology in a single app. Native code — Objective-C for iOS and Java for Android — gives the app speed and platform-standard look-and-feel. Web technologies allow developers to change parts of their apps, which now live on their own servers, quickly and easily without having to go through an app store approval process.

Source: Clutch.io

Code to integrate Clutch.io into your mobile app

As a little bonus, Clutch Framework also provides app analytics, telling developers what users are doing with their apps, which helps with future development.

Now that the open source version is available, Clutch.io’s hosted application has been end-of-lifed, and its termination is Nov. 1.

The negative of the open source code, of course, is that it is not a hosted service. It will require installation and maintenance. In addition, and perhaps worse, unless a core team adopts it and maintains it, the codebase will age while other tools improve their functionality.

Developers who don’t want to manage their own services will have to look at other options such as Leanplum or Swrv, who, incidentally, we interviewed at MobileBeat 2012.

photo credit: opensourceway via photopin cc

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

A certain kind of developer loves to hate on PHP. They are really going to hate where PHP’s custodians are taking it next.

PHP was created by Danish programmer Rasmus Lerdorf in 1995. In 1997, Israeli programmers Andi Gutmans and Zeev Suraski rewrote the parser, creating the base for PHP 3. By 1999, they had built the Zend Engine, which is still the interpreter for PHP.

Update October 18: Andi Gutmans just gave us more details about where PHP is going in mobile.

Gutmans and Suraski continued their partnership with Zend Technologies, a commercial entity that creates add-on products and services for PHP developers, particularly developers in the enterprise.

Today, after multiple massive iterations to the codebase, 35 percent of web traffic is handled by PHP, says Gutmans. Wikipedia says 75 percent of websites use PHP. Facebook, Wikipedia, Yahoo, and Photobucket are all built in PHP. WordPress, the most popular blogging platform in the world, runs on PHP and probably accounts for half of that 35 percent. Most of the other major content management systems, such as Drupal and Joomla, are also built in PHP.

No respect?

Still, the language can’t seem to get any respect and has been derided for years by programmers coding in C, Java, .NET, Python, or Ruby. In terms of trends, PHP as a search term has been dropping for years, and the mobile app revolution has led to the revival of Objective-C and Java.

So is the programming language that powers so much of the web disappearing gently into the night?

Not if Gutmans has anything to say about it. VentureBeat talked to him about PHP and the future, and he’s more bullish than ever, especially when it comes to the mobile-focused ace up his sleeve.

Riding the U.S.S. Enterprise

“All dynamic languages are gaining share from Java and .NET right now,” says Gutmans. “We’re getting a lot of benefit.”

Source: Wikipedia

Andi Gutmans

So the noise around trendier technologies like Ruby on Rails or Node.js doesn’t especially bother him. Mindshare is nice, of course, but market share is nicer. And market share is what Gutmans is focused on, especially in the enterprise.

“From a maturity point of view,” Gutmans told me, “I don’t think any other dynamic language right now has the full tool set. Our competition is Java and .NET … never with other dynamic languages.”

While he likes what Ruby on Rails is doing, and thinks there are some things there that PHP can learn and grow from, Gutmans points to PHP’s massive support in packaged solutions like WordPress, Drupal, and Magento.

“We’re better off than we were eight years ago … today we’re the only ones who have really hit the mainstream enterprise,” says Gutmans. “We do believe that the momentum and the size of PHP will continue. We don’t see it slowing down right now.”

Gutmans speaks with the enthusiasm of a founder; of course, there are other companies catering to the PHP-related needs of the enterprise. But Zend remains one of the biggest and best-known, especially due to its provenance.

And he’s got a point: Two-thirds of developers in a recent study reported spending half their time in PHP. And in a recent study by Rails developer Marc Gayle, half of all developer job postings on Craigslist call for PHP developers. When I talked to Gayle, he surmised the reason might be PHP’s super-popular content management systems.

“I think that is skewing the results,” he said. “But I can’t be sure.”

And a mysterious mobile story, coming soon

When it comes to mobile apps, Gutmans sides with the likes of JavaScript creator Brendan Eich in a firmly held belief that the web and web languages will eventually catch up and win out over native stacks.

But, he hinted to me, PHP and Zend will be providing client-side app-enabling tools.

Gutmans declined to comment further, saying he would only announce the full details at Zend’s conference in late October. However, it sounds like PHP will have a mobile app story of some sort, in spite of being the web’s predominant server-side language.

What that looks like and how it will be distributed is still mysterious. But a strong mobile story, says Gutmans, will only help PHP continue to grow.

It’s hard to argue with that.

photo credit: Red Bonzai

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Heroku today has launched a new enterprise-level service for Java. Stop laughing, you cynical, 20-something Rubyist. Heroku’s got a plan.

See, as uncool as Java has become in Startuplandia, it’s still a very big deal out there in the real world. In fact, in a recent survey of job listings for developers, Java developer was the number-one language-specific title on the list. And a lot of the entities seeking Java developers are some of the biggest, oldest, richest tech companies in existence.

So while it might not look cool to startup types, a Java service for the enterprise is a smart move for Heroku. Much like selling Viagra at the annual party of the Monte Carlo Yacht Club, you can achieve success by knowing your market, your product, and who’s willing to pay for what.

But enough editorializing! On to the news.

Heroku (currently owned by enterprise behemoth Salesforce.com) has expanded its PaaS (that’s Platform as a Service) offering to include Java. Heroku Enterprise for Java is aimed at larger companies and IT organizations (possibly even government and defense contractors) that need to build and run Java applications in the cloud.

From the release:



Java is the most widely adopted language in the enterprise, with millions of Java developers building and maintaining Java applications worldwide. Traditionally, creating these applications has required piecing together both a range of development and runtime infrastructure tools—such as source code control systems, continuous integration servers, testing and staging environments, load balancers, application server clusters, databases and in-memory caching systems. This painstaking process typically extends application building and deployment by months, taking developer attention away from their core focus of app development. With Heroku Enterprise for Java, for the first time, enterprise developers can get a complete Java solution in a single package, provisioned with a single click.

The new service will support the latest builds of Java JDK and JVM, as well as memcache and Postgres. The service will include separate staging and development environments and will support Eclipse, one of the more popular Java IDEs. Pricing starts at $1,000 per month per app.

Top image courtesy of olly, Shutterstock

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Oracle patched the hole in Java 7 that allows hackers to secretly download malware to your computer today in an uncharacteristic update to its software, according to Forbes. But it seems the company knew about the issue far longer than the rest of us.

Oracle usually only pushes out updates to its Java software on a quarterly basis, and many did not expect the company to provide a patch for this hole. Indeed, researchers suggested people who did not need to use Java should turn it off just in case. But while the patch is a positive step toward protecting Java users, security researchers at Security Explorations are saying that they told Oracle about the issues four months ago.

The security firm released a list of all the vulnerability reports it supposedly sent to Oracle in April, as well as confirmation that the Java creator received the bug reports. In it, Oracle says it received the report, and pushes a code update in June, but “continues to investigate” other existing issues into August.

The vulnerability in Java 7 Runtime allowed malware writers to push viruses to both PC and Mac computers since both are compatible with the software. It reminded researchers of the Java vulnerability that enabled the Flashback virus that forced Mac users to realize that the Apple-made computers are not impervious to malware. Exploits seen in the wild, however, only attacked PC computers, more than likely because PCs are a larger, more profitable market for hackers.

People “caught” the virus by visiting infected websites. The malware executed a download when the webpage opened, and it did not give any signals that it was downloading other than a few people who saw a “loading” sign over a java icon pop up and disappear.

The vulnerability was even being sold as part of an exploit kit in the hacker underground market. Find the patch for the hole on Java’s website.

via Forbes; Oracle HQ image via Mark Coggins/Flickr

A couple of months after Oracle’s billion-dollar fishing expedition went bust when Google’s Android was found not to infringe on Java patents, the judge has asked both parties which bloggers they paid.

In judge William Alsup’s own words:

The Court is concerned that the parties and/or counsel herein may have retained or paid print or internet authors, journalists, commentators or bloggers who have and/or may publish comments on the issues in this case.

… each side and its counsel shall file a statement herein [clearly] identifying all authors, journalists, commentators or bloggers who have reported or commented on any issues in this case and who have received money (other than normal subscription fees) from the party or its counsel during the pendency of this action.

The case is basically over, and anything that surfaces as a result of this disclosure is extremely unlikely to change anything, but the results should be interesting.

The request may be related to Florian Mueller of FOSSpatents, who reported on the legal proceedings while also consulting for Oracle (and disclosing that fact).

According to Oracle, however, Google might have more to say. As an Oracle spokesman told The Verge,

Oracle has always disclosed all of its financial relationships in this matter, and it is time for Google to do the same. We read this order to also include indirect payments to entities who, in turn, made comments on behalf of Google.

Indirect payments? Curiouser and curiouser. We’re digging for more details.

[ update August 8 ]

Oracle PR returned my message with a short one-line comment:

Sorry. Can’t comment further.

So: speculation. It’s probably not about bloggers getting paid via AdSense … the word “entities” seems to indicate analysis firms, or larger corporate groups. Still digging.

Image credit: Ultrashock/ShutterStock

Google scored a legal victory today, as a federal jury has decided that the search giant wasn’t guilty of patent infringement claims made by Oracle.

The two companies have been wrapped up in a legal battle since August 2010, when Oracle accused Google’s mobile operating system Android of violating patents and copyrights related to Java that Oracle owns. The trial is seen as very important because it’d one of the most prominent battles over intellectual property in the software industry. In addition, it could set a precedent for whether or not a programming language can be copyrighted, as VentureBeat’s Jolie O’Dell previously pointed out.

Today’s verdict wraps up the second, patent-oriented phase of the overall trial. The first portion, focused on copyrights held by Oracle, concluded earlier this month, with the jury reaching a mixed verdict — basically finding that Google did infringe on some of the structure, sequence, and organization (SSO) of the 37 Java APIs used in Java.

Google still has yet to be charged with damages related to first phase’s outcome.

In a statement related to the trial, a Google spokesperson said: “Today’s jury verdict that Android does not infringe Oracle’s patents was a victory not just for Google but the entire Android ecosystem.”

Via WSJ

Taking the witness stand today in an ongoing legal battle royale, Android co-founder Andy Rubin may have given Oracle some heavy artillery in its lawsuit against Google.

Rubin, who began working on building Android in 2003, said in court today that while Android was being developed, he was under the impression that key Java APIs were protected by copyright and that Google would need to work with Sun Microsystems or license the technology from Sun in order to make Java for Android work.

However, when Oracle bought Sun in a strategic acquisition in early 2010, no such arrangement had been reached. Oracle was quick to file a lawsuit for patent violation and copyright infringement.

Oracle lead attorney David Boies asked Rubin specifically if Rubin thought Google needed Sun’s permission to use the java.lang APIs, and Rubin answered in the affirmative.

Whether or not a programming language can be copyrighted has become a cornerstone of this lawsuit. Android has been using (at least parts of) Java, an open-source language, for the better part of a decade. Oracle argues that Google is violating several patents and copyrights with Android and is demanding a per-device licensing fee — which might be enough to ruin Android’s already small revenues.

Currently, Google’s position is that an open-source programming language is not copyrightable — a position that Rubin seemed to contradict today.

The testimony as it stands could end up being something of a smoking gun, but Rubin’s turn in the witness stand ended with Oracle’s questions. Tomorrow, Rubin will be in the stand again with Google’s attorneys questioning him to get another side of the story. VentureBeat will be in the courtroom at that time, so stay tuned for live reporting.

The Google/Oracle trial began last Monday and is expected to stretch through the summer.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Apple released a second update to its form of Java today that will clean up “the most common variants” of the Flashback Trojan affecting Mac computers.

The Java update will not only clean up these variants, but will also disable automatic execution of Java applets. You can turn these back on in the preferences tab. If no applets are run in a certain amount of time, however, the Java plug-in will re-disable automatic executive of Java applets. Prior to this update, Apple had patched the hole in Java, but hadn’t yet released a way to get rid of the virus. Get the update here.

Yesterday security company F-Secure released its own tool for cleaning up the Trojan. To use F-Secure’s tool, all you have to do is download a zip file found here, unzip it and follow the instructions. The program will then both identify and quarantine the virus — if it’s present on your machine — into a password protected file. From there, it will give you instructions how to remove the Trojan. F-Secure chief research officer Mikko Hypponen noted his surprise that Apple had not created its own cleaner in a blog post on the tool.

The Flashback Trojan enters computers through infected websites. When a user visits the infected website, they are prompted to download a browser plug-in, such as Flash, in order to see more content. When they download the “plug-in,” the malware accesses a hole in Apple’s customized version of Java and thereby gain access to the computer.

Users are easily tricked into downloading the malware because asking people to download a plug-in is common practice on the Internet. It’s hard to decipher between a legitimate request (especially when a website you trust is infected) and malware.

Flashback has reportedly only hit around 600,000 Mac computers, but the surprise comes from those who believed Macs were impervious to the virus. Indeed, Macs are vulnerable to attack, but given the high proliferation of Windows computers, it is more profitable for the hacker to target that mass market.

hat tip MacRumors; Janitors image via Shutterstock

As Apple grows, so will the number of viruses that can affect its systems. Today, it issued a Java update to keep one of these viruses, the Flashback Trojan, at bay.

Flashback is a type of malware that is transferred to your computer by masquerading as a safe browser plug-in. When you visit an infected website housing the malware, you’ll be prompted to download a plugin in order to view content. Giving permission to install that plugin allows the malware to download to your computer and begin running. Evolved versions of the virus use a hole in Apple’s version of Java to download to your Mac immediately after you open the webpage.

Russian antivirus vendor Doctor Web estimates that up to 550,000 Macs have been infected thus far, with over half of those located in the United States.

“There has been a significant increase in Mac malware in the last several quarters, so what we’ve seen with the Flashback Trojan isn’t particularly surprising,” said Dave Marcus, director of advanced research and threat intelligence at McAfee Labs, in an e-mail to VentureBeat. “As the popularity of Macs increases, so will attacks on the Mac platform. Users should always take the proper precautions to protect themselves by ensuring that their security software … and all Apple patches are up to date.”

Apple latest update to Java patches the hole and closes the malware’s ability to easily get in. But like most malware, the writers will be able to find a new vulnerability and exploit it. Cnet makes the point that Apple uses its own version of Java rather than the public versions, so while this hole had been patched by Java back in February, Apple’s version took until now to fix.

F-Secure explains how to check if you have the malware installed on your Mac. Do a search of your computer using Spotlight for “Terminal” and open the program. In it type the following:

• defaults read /Applications/Safari.app/Contents/Info LSEnvironment
• defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

If you get anything other than “does not exist” back, F-Secure can show you how to remove the virus and do other tests.

Doctor Web has identified some websites that have been infected with the malware, but warns that there are many more out there. These websites include:

• godofwar3.rr.nu
• ironmanvideo.rr.nu
• killaoftime.rr.nu
• gangstasparadise.rr.nu
• mystreamvideo.rr.nu
• bestustreamtv.rr.nu
• ustreambesttv.rr.nu
• ustreamtvonline.rr.nu
• ustream-tv.rr.nu
• ustream.rr.nu

Trojan horse image via Shutterstock

When the quarterback hands you the ball, what do you do? You run. You run hard, and you run fast. If you hesitate for just a second, you immediately get demolished by a bunch of defenders.

In football or business, the last thing you want to do is freeze up in a critical situation. Yet every holiday season, the e-commerce systems of retailers across America are failing companies and end-users alike, leading to mass frustration and millions of dollars of lost revenue.

What’s the problem?

Well, as user loads increase, their Java-based applications start to slow down — or even shut down altogether. That can cost a company thousands of shoppers in the event of even one single instance of failure to complete transactions. And maybe those frustrated shoppers won’t come back to try and shop again in the future.

Amazon sold the equivalent of 158 items per second during Cyber Monday 2011, but if their online services had gone down for only one minute, it would have cost them 9,480 shoppers.

Obviously, the stakes for e-tailers to deliver a positive customer experience are extremely high.

“In a competitive market segment, such as e-commerce, providing online shoppers with a rich user experience and response time consistency is an important factor for growing revenue and sustaining customers,” wrote Gene Alvarez, research vice president at Gartner Research.

Unfortunately for most retailers, Java systems (far and away the most prevalent systems used in enterprises today) are not capable of providing runtime consistency during peak loads. As user load increases, e-commerce apps demand more processing and memory, but their Java runtime infrastructures are very rigid and can’t react in real-time to rapid changes in user demand.

This leads to degraded performance for all e-commerce users, causing systems hang-ups, application crashes, and lost customers. That’s bad news, considering that the holidays make up 40 percent of a retailer’s online sales.

Last year, 80 percent of Black Friday shoppers bought online. Online retailers made $18.7 billion last year, $1 billion of that on Cyber Monday alone.

If an e-tailer can’t handle that kind of surge in holiday sales volume, it will go out of business quickly.

To make matters worse, what used to be a problem limited to several weeks of holiday buying has become a year-round problem. Retailers will regularly blast out promotions to their customers (e.g., 24-hour flash sales, specials for certain items, private sales for select clientele, etc.) but often aren’t able to predict the success of those promotions, leading again to needing to plan for unpredictable spikes in demand for services.

When Target.com launched the Missoni Collection in September 2011, the resultant influx of visitors crashed Target’s entire website for hours.

An improvement in the Java virtual machine (JVM) can make a world of difference.

E-commerce application failures can often be sourced back to limitations of conventional JVMs, which constrain application resources and make it challenging to scale apps beyond a few gigabytes of memory, which can effect performance under load.

Conventional JVMs also suffer from stop-the-world pauses because the JVM needs to clean up its internal memory, the impact of which causes applications to freeze and become unresponsive.

Programmers must tune Java to work around the JVM’s limited scalability and very carefully manage the amount of memory a given application uses. For e-tailers, this is bad news, because e-commerce applications must handle users loads that are never static and require more memory for each user and transaction to ensure consistent user response times and high sustained throughput.

What if e-tailers had a JVM that could elastically manage application memory allocation before it ever became a limitation?

The Java runtime (i.e. the JVM) would sense the demands of the application in real-time and grow its memory beyond the static limitation of conventional JVMs and never encounter those nasty stop-the-world pauses. Rather than freezing during demand surges and peak requirements, e-commerce applications would stay highly available and responsive. Such a JVM would enable the Java runtime to be consistent regardless of sales volume.

Now that’s a win for retailers and their customers alike.

Scott Sellers is the CEO and co-founder of Azul Systems, a company focusing on Java and JVM performance and issues. His company delivers highly elastic Java runtime platforms with scalability, manageability, and production-time visibility. Designed and optimized for commodity servers running in virtualized and cloud deployments, Azul’s Zing platform is a Java runtime that allows throughput-intensive and QoS-sensitive Java applications to run and perform better virtualized than non-virtualized.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

How the hell do you write a review for a game that’s been out since 2009? A game that you’ve played across many changes, with additions and subtractions, a game without a box, a user manual, or, really, any sort of guiding pedagogy. I’ve personally spent at least 100 hours, probably more, playing this procedurally generated oddity of a video game across the beta and official versions, on servers, my own server, and in single player modes. And yet, I still can’t seem to get a simple handle on it, and why it keeps me coming back for more.

I first experienced Minecraft as many geeks did – I read about it and was intrigued enough to grab it and download it. I spent the $20 to create an account so I could play the game offline. It seemed worth it, if all the other geek gamers I knew were right.

The game as I played it first was one of “holy crap now what?” I was there, a disembodied blocky arm in a preschool-colored world. There were trees, pigs, cows, trees. I pressed the ‘W’ key and walked and walked and walked. And then night fell. And then I died, only to respawn back where I had started.

It took several of these false starts till I did what any good geek gamer will do – I Googled the hell out of it. Turns out, there was many a guide on “surviving your first night in Minecraft.” They all went something like this – knock the crap out of some trees until they fall apart in weird blocky wood pieces, pop them into your inventory (with that glorious popping sound), and then go find a mountainside with some coal in plain view. Do all this before nightfall, because the monsters come out at night. Sssssss….BOOM. Creepers will get you. Or Zombies. Or spiders making odd straw slurping noises. SOMETHING is gonna get you, so grab that wood, and some coal, and dig into that mountain, my friend. Craft some torches (handy recipes were provided in these survival guides), build a wall between you and the monsters, and pound that torch into the wall. Wait for night to be over. Just ignore all the horrifying sounds outside the tenuous boundary you’ve just created. You’ll be fine.

Rinse. Repeat. And yet? There was so. much. more. to learn.

That is the draw, for me and for thousands of players. Minecraft brings, literally, a whole world of potential. The ruleset is deceptively simple – there’s day, and night. There are monsters, lava, water, and tall things you can fall from or into – all great ways to get to that respawn. If you respawn, all your carefully crafted items are left where you die. Good luck finding them again – the visual aesthetic is unhelpfully regular.

Crafting consists of taking raw materials, putting them into either an inventory or workbench grid, and creating something new out of different ingredients. Sometimes, ore needs to be cooked in a furnace, using coal that’s been dug out of the ground. The recipes are visual and only found on the internet. There is no way, in game, to figure this stuff out. And that’s a good thing. It’s like one big gaming Easter Egg hunt, with only the cool kids getting the best stuff. If, of course, by cool kids I mean folks able to sift through literally thousands of sites, videos and wiki pages. And I do.

Let’s talk mining. If you have any bit of obsessive-compulsive tendencies, you might want to steer clear of this game. I had no idea how compelled I’d be, digging regular pathways down into the game earth. Cube by cube, learning new ways to efficiently cut downward into the skin of the world from friends and YouTube, I found myself paying more and more attention to the patterns I created while digging. Every once in a while, iron, coal, gold, lapis lazuli, and even diamond blocks appeared seemingly at random. I knew, somehow, that if I just figured out the pattern, I’d be able to get all the iron and diamond I needed. Just a little more digging, a little more risk at falling into a lava pit or running into a cavern filled with arrow-shooting skeletons. I’d find the good stuff randomly, at variable intervals — the same reinforcement system that keeps gamblers coming back for more. I dug and dug and found materials, smelted iron weapons, crafted diamond armor, found monster spawners and gloriously brilliant lava flows. I lost my way more than once, over and over in fact – it’s dark down there. I’d carve my way to the surface, digging out stairs leading upward.

My fingers cramped and sore, my eyes craving different colors than the gray walls and earth toned gravel blocks deep within the mountains and mines of my own making, I dug upward for long tens of minutes. I’d crawl, slowly blinking, out of the torchlight and into the full light of day, learning how to build up and up and up and up. I began building platforms in the sky, jumping up and placing blocks of material under my feet that I might get ever closer to the sky, past the clouds, right up to the very tallest point in Minecraft, where no other blocks can be placed.

Minecraft is nothing if not immersive.

The recent 1.0 release has a few differences from the original beta I began playing. It’s got experience points, a new health system that allows players to recharge their health as long as their hunger meter is filled up, a marked change from the one to one “eat a porkshop and gain some health back” days of yore. Now there’s more to manage, but less fear of dying from too many cumulative hits or falls. Just make sure to eat those pork chops. And mushroom stews. And, yes, even cake. The cake is not a lie, it just takes some eggs, milk (in an iron bucket that must be created in a furnace), sugar refined from sugar cane plants and some wheat, which can be grown topside with any sufficient sunlight and water supply.

If I continue to digress, perhaps that’s the point. Minecraft is one continual digressive experience. Once you get the hang of surviving the night, indeed several nights, you then start building and mining. Craft doors, open them with pressure plates, grow your own trees fast with bone meal you’ve pulled from the bones of skeleton mobs you’ve defeated. Build a house, put up bookshelves, create a bed, put paintings on the wall. And don’t get me started on running your own server, inviting some trusted friends, and seeing what the world, continuously pervasive while the server runs, will evolve into. We had a scale model of an actual U.S. aircraft carrier next to a three-story glass building on top of an incredibly organized and labeled multilevel mining operation. I created a castle upon the ramparts of a nearby mountain, while others created a thousand-blocks long tunnel to a new area of the map we christened, “New Holland.” There’s nothing like this game.

A new mode was given an official place at the table with the release of Minecraft this past November – Creative Mode. My kids found this mode in an update to the beta at some point. I figured this out because they were flying around their single player worlds, making the most horribly multicolored structures across the land. In Creative Mode, players are given a quite thorough set of the basic building blocks of the Minecraft system, the power of flight, and no monsters to speak of. It’s a Lego-builder’s dream, enabling us all to create a playskool-themed Second Life environment with no restrictions, no challenges other than that of taking what’s in our heads and translating it to the Minecraft play world, one cubey block at a time.

There’s a third mode, of course, for people like me – Hardcore mode. This is, in my opinion, the ultimate purists Minecraft mode. Create a new world, live in it just like Survival Mode, with one simple difference: if you die, there is no respawn. You are finished. Done. That world cannot be accessed again. It’s Ben Abraham’s Far Cry 2 Permadeath experiment writ small and pixellated, and it’s tremendously compelling. I’ve been living in my own private hardcore Idaho since the mode was released, loving every minute of it. I’d surely love to have friends come visit, provided I could trust them not to set me on fire with a lava block they carefully secreted in a metal bucket from some underground lair. Yeah, Hardcore Mode is serious business.

In this official release, there’s also an ending. What? The developers have taken upon themselves to create a “primary win condition,” which is a fancy way of saying ending. In fact, to trigger the ending, you need to build a portal to an alternate dimension known as The End and then defeat the deadly Enderdragon that flies around. See? They even call it The End. Crazy, I know. Why is this even in the game? Might it be a clever statement on the completion needs of a more mainstream audience? I’d like to think so, given the developers’ hardcore indie aesthetic. However, it may just be a way to provide us all with a way to step away from the computer monitor and get some vitamin D, perhaps. Says lead developer Markus Persson, “For survival mode, I’d rather make the game too difficult than too easy. That also means I’m going to have to include some way of winning the game (or some other climax) to prevent it becoming too exhausting.” So there you have it.

So, Minecraft, the review? It’s impossible. There’s only experiential description to keep this reviewer from falling into a recursive, procedurally generated nightmare of Borgesian proportions (and shuddering at each use of the word “you” in a professional review). If we must, then, score this kind of game, we give it a 90/100. Whether you find joy in creating the Taj Mahal in square-ish blocks, building sky castles with friends in multiplayer, or derive an obscure satisfaction of a good life well lived in Hardcore mode, Minecraft abides. The cost is low and the computer specifications are fairly generous. Mac or PC, you can play this game. And you should.

---

GamesBeat 2013 is our fifth annual conference on disruption in the video game market. You'll get 360-degree perspectives from top gaming executives, developers, and analysts on what’s to come in the industry. Our theme this year is “The Battle Royal.” Check out full event details here, and grab your early-bird tickets here!

---

At one point, Chance’s father, Jeff, found himself sitting in the principal’s office with the Spanish teacher when a wild idea struck him.

“I thought, he loves computers, why not let him pursue that instead? Why not let him take Java as a foreign language.”

In a conversation with VentureBeat, Williams, who runs a web security company, told us that he expected a negative response to the idea, but the educators were actually open to it. The school didn’t offer a Java class, so the father and son organized an independent study course, complete with a syllabus and textbook.

“It turned out to be a really wonderful choice,” said Williams.

Chance dove into the project, going through the work at a much faster pace than was expected, and was very self-directed in his studies.

“He liked it, he really latched onto the puzzle,” said Williams. “In one semester, he worked through the book. Over the summer, he did some independent projects. He wanted to write apps for his Android phone.”

Already, 500 people have downloaded Chance’s first app, Droidbox — quite a vote of confidence for a kid who was just picking up programming. Williams hopes Chance will get his Java certification by the end of 9th grade.

“Tech has always been an option, but it’s not part of the mainstream curriculum,” Williams told us.

“It’s good for our country… We’ve staked a lot of our future on our ability to be innovators, so it’s a national priority. There are good effects in building tech literacy in kids today, because if you don’t start early, you end up falling behind.”

And falling behind we are.

In 2003, the Program for International Student Assessment, an international test, showed that 15-year-old students in the U.S. lagged behind students in other nations when it came to math and science. In 2006, the National Academies publicly raised concerns about a marked decline in U.S. students’ knowledge of science, technology, math and engineering. Currently, American students rank low for math and science skills, coming in 25th in math and 21st in science compared to students in 30 industrialized countries.

Williams said when he was his son’s age, he was put through several years of French instruction, which didn’t come naturally to him and required a lot of extra mental effort. “But the discipline of learning computer languages, learning to think that way, brings critical thinking skills you can only learn that way.”

While Williams noted that programming isn’t the right choice for every student, “For those who do fall in that bucket and have skill in this area, it just makes sense to develop them early on, to get them into programming.”

Williams also thinks that having programming as a more regular part of the curriculum early on could have beneficial effects on the gender balance in the tech industry.

“I dont know why more girls don’t get into technology. It could be cultural, it could be gender bias in how classes are offered. But it is really important to encourage girls to get into technology; plenty of them have skills in this area. It is unfortunate that we’re steering so few into the top of the funnel.”

Check out DevBeat, VentureBeat’s brand new channel specifically for developers. The channel will break relevant news and provide insightful commentary aimed to assist developers. DevBeat is sponsored by the Intel AppUp developer program.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Sources close to the matter tell us the trial, which was previously scheduled to begin on October 31, had to be put off because of the judge’s full schedule, which includes a particularly thorny gang trial.

Also, the U.S. Patent and Trademark Office (USPTO) is still in the process of reexamining the patents and claims in question.

While many of us do not imagine the lawsuit will actually end in a trial but rather, as many corporate disputes do, in a settlement, the judge in the case had already ordered three mediation hearings. A Google spokesperson told VentureBeat today that all of those hearings have already taken place, and, as he said, “Nothing was settled.”

Google has been shown to be open to the idea of settling out of court. However, the search-focused company may actually be at some degree of fault — the operative word being “may.” And if Oracle can wrest prohibitive licensing fees out of Android sales, it might make a significant dent in the OS’s profit margins.

We asked our Google source whether the Android operating system itself was in danger of, at worst, coming to a premature close, as many consumers have worried throughout the initial findings of this lawsuit.

“Absolutely not. There’s no indication that Android is under threat,” said the Googler.

“From a consumer standpoint, consumers should not be concerned about losing their Android phone. But they should be concerned with the way in which Oracle is taking a platform they supported for years [the Java programming language] and is now trying to capitalize on our success.”

Oracle has owned and maintained the open-source Java language since its acquisition of former Java owner Sun two years ago. However, Android is also Java-based and has roundly crushed the Oracle-owned Java ME mobile OS. As you can imagine, that hasn’t gone over too well with Oracle, and the resulting lawsuit has raised massive questions about how intellectual property law comes into play when open-source software is on the line.

“We’re actively pushing back on Oracle to preserve choice in the marketplace in the long term,” said the Google rep, who repeated Google’s well-known intentions about keeping the Android operating system open-source.

Related articles

• Google’s patent plot thickens with new Microsoft lawsuit against Motorola Mobility (venturebeat.com)
• Google ups its Android patent defense with Motorola purchase (venturebeat.com)
• Sun Was Close to Licensing Java Patents to Google for $28M (pcworld.com)
• Oracle v Google: Ellison, Schmidt, and Page to take witness stand over Android (guardian.co.uk)

Confused about the difference between trademark and copyright? Don’t be. It’s a mad, mad world, and even Oracle is getting it mixed up, in its suit against Google.

Sun v. Microsoft

Ten years ago, when Sun sued Microsoft over Java, Sun alleged trademark infringement because Microsoft was not implementing Java according to Sun’s specification. Microsoft had entered into a license agreement with Sun — promising to follow the specification. When Microsoft deviated from the specification, Sun rightly claimed breach of contract and trademark infringement. Sun sought an injunction against Microsoft to stop using the Java logo and to remove the incompatible Microsoft code from the market. Sun ultimately prevailed, and received a large settlement, in part due to Microsoft’s anticompetitive conduct over Java.

Attorney David Boies is familiar with the Java issues in the Microsoft antitrust case. According to Boies’s biography, he served as Special Trial Counsel for the United States Department of Justice in its antitrust suit against Microsoft. At the conclusion of that antitrust suit, U.S. District Court Judge Jackson found that Microsoft took actions “with the sole purpose of making it difficult for developers to write Java applications … that would allow them to be ported.”

Oracle v. Google

Boies now represents Oracle (which has since acquired Sun, including its rights to Java) in its case against Google for patent and copyright infringement of Java. He surely knows the differences between the issues in the prior lawsuits. Unlike Microsoft, Google never licensed Java from Sun. It never agreed with Sun to implement the Java specification, and it doesn’t call its product Java. It calls it Android and Android is not a candidate for an antitrust case. In fact, the Microsoft .NET Framework and Java are the two dominant middleware platforms.

In court pleadings, Oracle constantly argues that Google breaks the “write once, run anywhere” promise of Java.

“Google undermined the compatibility of Java. It took the APIs it wanted, to attract developers to Android and gain market share quickly, and left those it did not — fragmenting Java and its “write once, run anywhere” promise.”

“Oracle has been harmed because Google fragmented the Java APIs, severely undercutting Java’s “write once, run anywhere” promise.”

“Google’s fragmentation of Java has violated the “write once, run anywhere” creed.”

“Google has significantly harmed the value of the APIs by fragmenting Java and undercutting its “write once, run anywhere” capability.

The problem for Oracle is that Google made no license promise, and doesn’t need to worry about Oracle’s “write once, run anywhere” registered trademark because that trademark has nothing to do with Android, any more than Objective C has anything to do with C#.

Moreover, Oracle is suing Google for copyright infringement, not trademark infringement. Oracle never alleged any Java trademark claims, only harm by “fragmentation” of the Java “write once, run anywhere promise” and “creed.” But promise, creed and fragmentation are not copyright claims, they relate to trademarks. It’s a nice example of the adage that “if you repeat something often enough, people will believe it’s true.” Accordingly, on September 15, 2011, Judge William Alsup in his order regarding summary judgement says:

Android allegedly supports some, but not all, of the APIs defined for the Java platform… This so-called fragmentation undermines the “write once, run anywhere” concept underlying the Java system and supposedly damages Oracle by decreasing Java’s appeal to software developers.

Trademarks v. Copyrights

Google could have long ago pointed out that Oracle is alleging trademark harm using copyright infringement claims. But why should Google help Oracle plead correctly? Google never agreed to the “write once, run anywhere” promise (in any license) from which Oracle claims to have suffered harm. Google calls its software Android, not Java. While Oracle could have argued that Google has confused the market by making references to Java in Android marketing and documentation, Oracle cannot now amend the complaint with a trademark infringement cause of action. It’s too late.

Google has already prevailed on the key issue of non-copyrightability of API names. In his partial summary judgement order of September 15, 2011, Judge Alsup held that “the names of the Java language API files, packages, classes, and methods are not protectable as a matter of law.” Oracle has its work cut out, because it will have to explain to a trial jury that even though the names of the Java files, packages, classes and methods are not protectable, Oracle somehow has a substantial copyright claim to snippets of code, declarations, and the arrangement of the specification.

Oracle is not giving up however, and the API copyright issue isn’t the whole lawsuit. Oracle is also claiming patent infringement, and there are still questions of fact and law about the scope of Google’s alleged copying. But those don’t relate to the “write-once, run anywhere” promise from which Oracle claims to have suffered harm.

Nevertheless, Oracle’s latest alleged copyright damages and lost profits estimate is still in the neighborhood of a whopping $800 million.

So don’t feel bad if you don’t understand the difference between trademark and copyright. A lot of fine people get it mixed up too.

John Koenig is the founder of Compute Media and developer of “The Patent Studio”. You can follow him on Twitter at @johnkoenig.

Top image via Ioan Sameli/Flickr.

Gosling is a former Sun Microsystems fellow who is best known as the father of the Java programming language, which has become pervasive as a web-based programming environment since it was first released in 1994. Bill Vass, chief executive of Liquid Robotics, was a former president of Sun’s federal subsidiary and recruited Gosling.

“The first time Bill described it to me, my first reaction was you’re kidding,” Gosling said in an interview. “The notion of having a fleet of autonomous ocean-going vehicles wandering the world collecting data is something out of fiction.”

It turns out that these robot fleets need a lot of enterprise software, including in-situ data reduction (cleaning out the noise as the data is collected on the robot itself before sending it along), and back-end cloud processing.

“So much of our platform is software these days,” Vass said in an interview. “They’re like data centers on the ocean.”

Gosling spent 26 years of his career at Sun, from 1984 to 2010. He left in April of last year after Sun was acquired by Oracle. He has noted that Oracle appeared to be very interested in how it could use Sun’s patents in a legal battle with Google, which is ongoing. Earlier this March, Gosling joined Google. But the lure of Liquid Robotics, which has offices in Sunnyvale, Calif., and Kamuela, Hawaii, proved to be stronger.

Gosling admits to being a robot geek, though he says he is not as hardcore about it as some of the attendees of Silicon Valley’s Maker Faire. Recently, he has spent much of his time researching real-time software code, which runs on robot vehicles.

“This brings it all together,” Gosling said.

Liquid Robotics makes the Wave Glider unmanned maritime vehicle (UMV), which uses waves to propel itself. Wave Gliders harvest natural energy and can be used for commercial, scientific and defense purposes. The Wave Gliders can prowl the ocean for as much as 2.5 years. They are doing tasks such as testing the water for leaks around oil rigs or measuring the radioactivity of the ocean outside of the Fukushima nuclear reactor facility in Japan.

The Wave Gliders are more versatile than their rivals, which include ships, buoys, and satellites. Since they get their energy from waves and the sun, they don’t have to use energy for propulsion. That leaves them with plenty of power for computation and sensing, Vass said. The company was started in 2007 and it has 73 employees. The company raised $22 million in a fourth round of funding in June from VantagePoint Capital Partners, with participation from oilfield services firm Schlumberger.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

Java will join Ruby, Node.js and Clojure on Heroku’s Celadon Cedar runtime stack.

While Ruby in particular is popular in the world of web startups and Node.js is wildly buzzy at the moment, Java is without doubt the most widely used programming language now supported by Heroku and may do a lot to increase Heroku’s adoption within the greater developer community.

As Heroku co-founder Adam Wiggins writes on the company blog, “Java boasts an estimated population of six million developers, with a vast ecosystem of tools, libraries, frameworks and literature. It is the most mature and established programming language for building server-side applications in existence today.”

Wiggins also enthuses about the Java Virtual Machine, which he calls “one of the best runtime VMs in the world.”

Other JVM-based languages, such as JRuby, Scala and Jython, will also be bootstrappable on the Heroku platform with pom.xml.

In the post, Wiggins explains why the Cedar stack supports the Jetty webserver with Java rather than J2EE application containers, which he said are a relic of older software distribution methods.

“Heroku is built for the new era of software-as-a-service,” he writes. “Java teams are often still stuck with the classic process because it’s built into the toolchain. Heroku for Java is optimized for compact applications that require robust yet agile deployment and rapid iterations. You can deploy any Java application to Heroku, including J2EE applications, but you aren’t constrained by the J2EE deployment process.”

Check out the Heroku blog for a sample hello world app to get you started.

Image of Duke the Java mascot courtesy of Wikipedia.

Check out DevBeat, VentureBeat’s brand new channel specifically for developers. The channel will break relevant news and provide insightful commentary aimed to assist developers. DevBeat is sponsored by the Intel AppUp developer program.

---

Big Data and Predictive/Real-time Analytics startups: Are you looking to jumpstart development & accelerate market traction? Sign up for the SAP Startup Focus program to receive technology, support, resources and community to help you develop new applications on SAP HANA, a cutting edge database platform. Get started here, and enter promo code “VB2013″ on the form.

---

CloudBees was founded by Sacha Labourey, the former chief technology officer of JBoss. Its first investors included JBoss founder Marc Fleury. Kohsuke Kawaguchi, creator of Hudson, the most popular continuous-integration tool in the Java world, also works for the company, making CloudBees something of a Java dream team.

In a blog post announcing the funding, Labourey said he’s certain PaaS “is going to be incredibly big and strategic” but that it’s not clear when it will trigger. “Consequently,” he said, “the right thing we can do at CloudBees is to keep innovating, flawlessly deliver on quality releases and top service and aim for the long term. More of the same essentially.”

A typical Java development team uses a range of software life-cycle tools for source control (stores the latest version of the code and manages changes), builds (compiles and tests code and produces an executable release) and continuous integration (schedules and manages builds on multiple servers and environments). These tools are usually hosted, configured and maintained on local servers.

CloudBees provides a Java PaaS that covers all these areas. Instead of locally hosting tools like Subversion for source control, Maven for builds and Hudson for continuous integration, CloudBees provides them all in the cloud in a product called DEV@cloud. After building you can deploy your apps via the company’s RUN@cloud product. The company also recently launched an ecosystem of cloud-based services available to customers via CloudBees’ partners. CloudBees charges a monthly subscription fee and a fee per minute when builds are in progress.

The advantage of development in the cloud is that life-cycle tools no longer need to be configured and maintained in house. Builds can be run in parallel and there is no restriction on the server capacity. IT departments often don’t want to handle development tools so the developers themselves end up using valuable development time configuring and maintaining these tools. However, some companies may be leery of placing their most precious asset, their source code, into the cloud.

CloudBees’ services could be particularly useful for stress and performance testing, which determine the capacity and speed of the software and how robust it is when it is running on multiple machines under high load. This type of testing tends to be performed intermittently and requires a much higher number of servers than normal builds.

CloudBees currently has about 6000 customers. When the company launched DEV@cloud, the main competitor was Google App Engine.  Many developers have complained about the restrictions Google App Engine imposes on the Java environment, and it is designed for running applications rather than developing them.

More recently though, two of the four major middleware vendors have announced a PaaS strategy. Amazon’s Elastic Beanstalk focuses on deployment rather than development in a similar way to RUN@cloud and Google App Engine. VMWare’s Code2Cloud PaaS was announced in Oct 2010 but doesn’t seem to be available to developers yet.

CloudBees is based in Boston, launched in August 2010 and has 27 employees. Matrix Partners led the previous investment round of $4 million in the company.

If Oracle’s claims (that Android violates patents in Oracle’s Java programming language) are found to be valid in a trial, Google could end up paying between $1.4 and $6.1 billion, depending on whether the alleged infringement was willful or unintentional.

Google’s most recent statement hinting at the possibility of an out-of-court settlement, which was tellingly made in a publicly filed document rather than in private talks with Oracle, suggests that Google thinks it might save a few billion dollars by giving Oracle some ideological leeway.

Free and open-source software (FOSS) advocate and IP law expert Florian Mueller told VentureBeat in an interview that althought Google has “pushed the envelope” on patent law with smaller companies — such as former Java owner Sun used to be before it was acquired by Oracle in 2009 — it won’t have the same leeway with a giant like Oracle.

“I don’t think Oracle wants to kill Android,” said Mueller, “but what it does could nevertheless have major impact.”

Last year, Oracle asserted that Google had knowingly and willfully infringed on Java copyrights and patents in its creation and distribution of the Android platform.

Google first embarked on a rather facile line of defense, invoking the fact that Oracle’s Java programming language is open-source software. Later, the company stated that no patents were violated, and if they were, the fault lay with third parties, not with Google.

However, this hard-and-fast rejection of fault is beginning to waver. In Google’s most recent filing, the company stated that certain conditions in the proceedings would “make it more likely that the parties could reach an informal resolution of the matter.” For the first time, Google is entertaining the possibility of settling out of court — in exchange for Oracle dropping some of its claims and, perhaps, its option to collect a per-unit royalty.

The trial is slated to start in October and continue for three weeks. Google is requesting a stay of the case, a move Oracle vehemently opposes.

Seven patents and a string of copyright claims are in question at the moment. Currently, the U.S. Patent and Trademark Office (PTO) has issued non-final rejections against four of those seven patent claims, and two of the claims are up for reexamination. One claim has been confirmed as valid by the PTO.

“Oracle wants to make a substantial amount of money,” said Mueller, “and Google may not be able to meet Oracle’s demands without being forced to change Android’s business model in terms of abandoning the current royalty-free approach in favor of a license fee that would have to be passed on to device makers.”

Oracle’s per-unit requests surfaced early in the suit, and given that, according to Mueller, Google makes less than $10 per Android device, any per-unit fee would have a significant impact on the Android bottom line.

Microsoft, meanwhile, has signed patent-licensing agreements with the manufacturers of many Android phones, with the ironic result that Microsoft makes more money from Android than it does from Windows Phone 7.

We’ll continue to monitor this case as it evolves.

Image courtesy of isriya.