Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!feeder2.ecngs.de!ecngs!feeder.ecngs.de!Xl.tags.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!local2.nntp.ams.giganews.com!nntp.bt.com!news.bt.com.POSTED!not-for-mail NNTP-Posting-Date: Sun, 27 Apr 2014 06:21:26 -0500 From: "Chris Uppal" Newsgroups: comp.lang.java.programmer References: <53583247$0$2956$e4fe514c@news2.news.xs4all.nl> Subject: Re: Java vs JavaScript Date: Sun, 27 Apr 2014 12:20:44 +0100 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2900.5512 X-RFC2646: Format=Flowed; Response X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512 Message-ID: Lines: 28 X-Usenet-Provider: http://www.giganews.com X-AuthenticatedUsername: NoAuthUser X-Trace: sv3-I4JGFJbH96Q9I1Cy/RDVKopT8KxogFEgKWDvX9+OzTTR+GdurnpCk8tjydUajRg5ceiBE8lqnF92RHl!oXCFyO9Vo3wCeHXOpvX5wjNQWnmI/Z/IqwxxQ/UanDSKdmihzVnRS1oClCby0huzUUjGtHRLZnI= X-Complaints-To: abuse@btinternet.com X-DMCA-Complaints-To: abuse@btinternet.com X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.40 X-Original-Bytes: 2643 Xref: csiph.com comp.lang.java.programmer:28256 Silvio wrote: > Java was not designed to be safe in any particular way in > that it does not restrict you from doing anything potentially dangerous > (accessing file systems, doing socket level IO, executing native > code...). The runtime that executes your code is responsible for taking > away capabilities from the code as an afterthought. This is very hard to > do thoroughly and exhaustively. Agreed that this is not the way to design a security arhutecture if you have the opportunity to build the thing from the ground up. (Of course, the designers were in a tearing hurry at the time this stuff was set in stone). > JavaScript and it's traditional runtime profile (inside a browser > embedded in a web page) is very limited in what it can do.No need for > the browser to enforce much restriction (barring stuff like XSS). > Insecurity has to be added via libraries provided by the runtime. Agreed that JS gains some security from the fact that it just doesn't have the ability to touch as much as the Java runtime (assuming the application that embeds the JS runtime is done right -- a very dubious assumption). But JS shares the same approach to tacking security on afterwards as Java, and has a number of rather serious problems relating to its almost uncontrolled abillity to manipulate the UI. (Of course, the designers were in a tearing hurry at the time this stuff was set in stone). -- chris