Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28205

Re: Java vs JavaScript

Show all headers | View raw

On 4/23/2014 10:39 AM, Roedy Green wrote:
> There is something odd going on.
>
> I have always thought the Java sandbox was so restrictive, there was
> nothing a user need worry about. There is no way an unsigned applet
> could do any damage.

Unless the Java VM and/or runtime had security holes.

> On the other hand I don't think JavaScript has any sort of sandbox at
> all, and everyone blissfully runs scripts that can do anything.

"anything" is a bit of a misnomer here. The standard JavaScript runtime 
profile doesn't allow you to:

1. Access the local filesystems
2. Spawn, communicate, or interact with other processes
3. Open generic network sockets
4. Execute arbitrary native code

All of these are possible with part of the standard Java library.

In general, the security model of Java appears to me to be more of an 
afterthought, with ad-hoc securing of APIs. In contrast, the development 
of JavaScript has tended towards not admitting new APIs until after 
security reviews have been done on the APIs. Legacy APIs can be 
problematic sometimes, but the mighty hammer of things like CORS or CSP 
has reduced the scope of problems here.

Certainly, in the past several months, the browser developers appear to 
have been taking security more seriously than Oracle has with Java.

-- 
Beware of bugs in the above code; I have only proved it correct, not 
tried it. -- Donald E. Knuth

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Java vs JavaScript Roedy Green <see_website@mindprod.com.invalid> - 2014-04-23 08:39 -0700
  Re: Java vs JavaScript markspace <markspace@nospam.nospam> - 2014-04-23 09:10 -0700
  Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-04-23 15:48 -0500
  Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-04-23 23:36 +0200
    Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-27 12:20 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:05 +0800
      Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-04-27 22:55 +0200
      Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-01 08:52 +0100
        Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-01 10:26 +0200
          Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-01 14:10 -0700
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:10 +0200
              Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-02 10:20 -0700
                Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-05-02 20:16 +0200
                Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-04 10:38 +0100
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-05 00:16 -0500
                Re: Java vs JavaScript Tim Slattery <tim@risingdove.com> - 2014-05-06 13:06 -0400
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-06 12:40 -0500
            Re: Java vs JavaScript Simon Lewis <simonlewis2001@gmail.com> - 2014-05-02 12:53 +0200
          Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-05-01 21:16 -0400
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:17 +0200
  Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-23 22:22 -0400
    Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:20 +0800
      Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-29 21:07 -0400
  Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:15 +0800
    Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 09:00 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:15 +0800
        Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 16:59 +0100
  Re: Java vs JavaScript Ray Osborne <rko153@gmail.com> - 2014-05-22 05:08 -0700

csiph-web