Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news2.arglkargh.de!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: blmblm@myrealbox.com Newsgroups: comp.lang.java.programmer Subject: Re: How to make my java applets more user friendly Date: 12 Jul 2014 23:21:27 GMT Organization: None Lines: 57 Message-ID: References: <04c1fe18-b023-4f45-8fa3-3c2f78cba69e@googlegroups.com> X-Trace: individual.net aZaakX45xL67P3gDz8sOVwk8CDxXyzgrU0cFWN/4PZK5Z24Cyx X-Orig-Path: not-for-mail Cancel-Lock: sha1:pYsFWjJjLOweTd7k44qj2F1/8Rs= X-Newsreader: trn 4.0-test76 (Apr 2, 2001) Xref: csiph.com comp.lang.java.programmer:29078 In article , Joshua Cranmer ð § wrote: > On 7/11/2014 4:30 PM, blmblm@myrealbox.com wrote: > > In article , > > Eric Sosman wrote: > >> On 7/3/2014 9:01 AM, w.tom.adams@gmail.com wrote: > >>> [...] > >>> One question I have is this: Why is Javascript not as vulnerable as Java Applets? > >> > >> Experts (I'm not one) have opined that the security models for > >> JavaScript and Java are fundamentally different. JavaScript (they > >> say) was designed from its infancy to run in a browser's sandbox, > >> but Java is a fully-functional general-purpose language with a > >> sandbox bolted on afterwards. > > > > Hm! I thought I had read, back when I first started learning Java > > (1998?), that one of the original design goals of the language was > > to provide just the kind of sandbox that would make it safe to run > > applets from possibly-untrustworthy sources, and its evoluation into > > a general-purpose language came later. But I haven't researched > > the history, so you could be right. > > Java was originally designed for *safety*, not *security*. According to > Wikipedia, Java (the language) was originally designed to be used for > programming smart appliances, and was basically meant to fix C++'s > deficiencies, particularly its compatibility with horribly-unsafe C and > its lack of portability. Apparently, they changed tack after cable > companies decided they didn't want highly interactive set-top box > platforms, and transitioned to trying to add interactivity to web-pages > afterwards. > As best I can tell from the history section of the Wikipedia article on Java, the switch away from only-for-set-top-boxes happened before the first release of an implementation, so -- eh, maybe "original design goals" is not quite accurate, but "design goals for first implementation" seems to me to be pretty close? Anyway I'm not finding anything yet that to me supports a claim that security was bolted on after the initial design, though of course that doesn't mean that it didn't happen that way .... Also from the Wikipedia article: "Sun Microsystems released the first public implementation as Java 1.0 in 1995.[1] It promised "Write Once, Run Anywhere" (WORA), providing no-cost run-times on popular platforms. Fairly secure and featuring configurable security, it allowed network- and file-access restrictions." But we can probably agree that whenever this goal was added, actual implementations have fallen short. Alas. -- B. L. Massingill ObDisclaimer: I don't speak for my employers; they return the favor.