Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28365

Re: Java vs JavaScript

Show all headers | View raw

On 5/4/2014 4:38 AM, Chris Uppal wrote:
> Security is about the person using the browser, not the browser itself, nor the
> page that the browser is displaying.  /They/ aren't going to loose money, get
> infected, be advertised at unwantedly, whatever...  The person is -- or may be.
> If the whole settup (Java/Flash/JavaScript/HTML/etc) is such that an actual
> user is mislead, then that is security failure, and then it's just a matter of
> finger-pointing as to which part of the system takes how much blame.

I prefer to draw a distinction between "attacks" that rely on confusing 
the user to direct them to a fake site (I'll call this phishing for lack 
of a better name) and attacks that actively harm you (more traditional 
security exploits). To some degree, phishing attacks are unavoidable due 
to stupid users, and you can make a case that many would be better 
handled not by informing the user of the malicious page switch 
beforehand but rather by indicating that the target of the link is not 
what the link claimed it was. Although success in the latter arena isn't 
great, either.

> I expect I'll be able to make the same claim about HTNL5 soon, if I can't
> already.

One point of pedantry I want to bring up: JavaScript the language is not 
the same as the set of JavaScript libraries used in web programming 
(often known as DOM). The set of new additions to this repertoire over 
the past several years has fallen under the terminology of "HTML5" 
(although I know many web engine developers who dislike that term).

> HTML has problems.  JavaScript makes it easier to exploit those problems, and
> adds new ones of its own.  Java, FLash, and any other pluggin can be expected
> to add yet more problems -- it's inherent in the nature of a plugin (by which I
> mean exernal compiled code) that it may open too many doors (NACL aside,
> perhaps).

The source of vulnerabilities is often in libraries, not languages; most 
of the security problems in Java that I can think up are not in the core 
VM but rather in the expansive set of libraries that make up the 
standard library. Similarly, JS's core language isn't the source of most 
problems but rather the DOM. In a similar vein, Flash and NaCl have 
problems simply because they allow access to rather less well-secured 
libraries.

The only way you could get rid of these vulnerabilities would be to 
freeze the allowed access and the implementation except for bug and 
security fixes and then wait for 20 years (think TeX). And that's not 
going to happen.

-- 
Beware of bugs in the above code; I have only proved it correct, not 
tried it. -- Donald E. Knuth

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Java vs JavaScript Roedy Green <see_website@mindprod.com.invalid> - 2014-04-23 08:39 -0700
  Re: Java vs JavaScript markspace <markspace@nospam.nospam> - 2014-04-23 09:10 -0700
  Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-04-23 15:48 -0500
  Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-04-23 23:36 +0200
    Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-27 12:20 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:05 +0800
      Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-04-27 22:55 +0200
      Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-01 08:52 +0100
        Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-01 10:26 +0200
          Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-01 14:10 -0700
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:10 +0200
              Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-02 10:20 -0700
                Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-05-02 20:16 +0200
                Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-04 10:38 +0100
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-05 00:16 -0500
                Re: Java vs JavaScript Tim Slattery <tim@risingdove.com> - 2014-05-06 13:06 -0400
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-06 12:40 -0500
            Re: Java vs JavaScript Simon Lewis <simonlewis2001@gmail.com> - 2014-05-02 12:53 +0200
          Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-05-01 21:16 -0400
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:17 +0200
  Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-23 22:22 -0400
    Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:20 +0800
      Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-29 21:07 -0400
  Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:15 +0800
    Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 09:00 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:15 +0800
        Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 16:59 +0100
  Re: Java vs JavaScript Ray Osborne <rko153@gmail.com> - 2014-05-22 05:08 -0700

csiph-web