Java security comes down to 'war of attrition'