Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: blmblm@myrealbox.com Newsgroups: comp.lang.java.programmer Subject: Re: How to make my java applets more user friendly Date: 12 Jul 2014 23:19:55 GMT Organization: None Lines: 44 Message-ID: References: <04c1fe18-b023-4f45-8fa3-3c2f78cba69e@googlegroups.com> X-Trace: individual.net m2fsQMLCZ6ucvrM/SZm1xgCfMoiC11w6Zs0JCOwSPLUyjH6n5f X-Orig-Path: not-for-mail Cancel-Lock: sha1:Psde5CRNM9hi54VOE1PE5q1ZfDQ= X-Newsreader: trn 4.0-test76 (Apr 2, 2001) Xref: csiph.com comp.lang.java.programmer:29077 In article , Eric Sosman wrote: > On 7/11/2014 5:30 PM, blmblm@myrealbox.com wrote: > > In article , > > Eric Sosman wrote: > [ .... ] > >>> [...] > >>> One question I have is this: Why is Javascript not as vulnerable as Java Applets? > >> > >> Experts (I'm not one) have opined that the security models for > >> JavaScript and Java are fundamentally different. JavaScript (they > >> say) was designed from its infancy to run in a browser's sandbox, > >> but Java is a fully-functional general-purpose language with a > >> sandbox bolted on afterwards. > > > > Hm! I thought I had read, back when I first started learning Java > > (1998?), that one of the original design goals of the language was > > to provide just the kind of sandbox that would make it safe to run > > applets from possibly-untrustworthy sources, and its evoluation into > > a general-purpose language came later. But I haven't researched > > the history, so you could be right. > > > lists "robust and secure" as one of five primary goals for Java, > but it's not clear whether these goals were "original" or just sort > of retrofitted after Java/Green/Oak moved beyond set-top boxes. > Also, it seems to me that each of the five goals offers at least > some opportunity to meditate on the difference between "goal" and > "achievement," and to mutter the old saying that one's reach should > exceed one's grasp ... There is that! > offers a few > words on Java security, although some of the gripes seem to have more > to do with Oracle's support of Java than with Java itself. The page > at gets more specific > about particular flaws and exploits thereof. (I imagine a security > expert might have a few quibbles with the latter page, though.) > -- B. L. Massingill ObDisclaimer: I don't speak for my employers; they return the favor.