Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: blmblm@myrealbox.com Newsgroups: comp.lang.java.programmer Subject: Re: How to make my java applets more user friendly Date: 11 Jul 2014 21:30:37 GMT Organization: None Lines: 38 Message-ID: References: <04c1fe18-b023-4f45-8fa3-3c2f78cba69e@googlegroups.com> <00019c29-614d-4cfc-aca8-4606bee766dd@googlegroups.com> X-Trace: individual.net E9Io9bgc+v7nX8klJIn2XQCMbLnBoQGSfteO5QthqZl76hLy7o X-Orig-Path: not-for-mail Cancel-Lock: sha1:iVh6M76TEkIPP+fY4ZMET30Zx0I= X-Newsreader: trn 4.0-test76 (Apr 2, 2001) Xref: csiph.com comp.lang.java.programmer:29057 In article , Eric Sosman wrote: > On 7/3/2014 9:01 AM, w.tom.adams@gmail.com wrote: > > [...] > > One question I have is this: Why is Javascript not as vulnerable as Java Applets? > > Experts (I'm not one) have opined that the security models for > JavaScript and Java are fundamentally different. JavaScript (they > say) was designed from its infancy to run in a browser's sandbox, > but Java is a fully-functional general-purpose language with a > sandbox bolted on afterwards. Hm! I thought I had read, back when I first started learning Java (1998?), that one of the original design goals of the language was to provide just the kind of sandbox that would make it safe to run applets from possibly-untrustworthy sources, and its evoluation into a general-purpose language came later. But I haven't researched the history, so you could be right. > Another way to look at this is that > JavaScript can do only what the browser itself can do, while Java > can do anything the JVM fails to prevent. > > This is not to say that JavaScript is 100% secure -- plenty of > malware relies at least in part on JavaScript -- just that it's a > more limited risk than Java is. Or so say those who seem to know. > > > The history seems to be that Java Applets were exploited big-time by hackers and apparently neglected by Oracle and Cert had a tantrum and now they are not a viable option. But if I converted to Javascript, could the same thing happen to Javascript. > > In my opinion (and that's all it is), applets are not viable. > Not everybody subscribes to this view -- but those who do will not > be in your website's audience. > -- B. L. Massingill ObDisclaimer: I don't speak for my employers; they return the favor.