Path: csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: =?UTF-8?B?Sm9zaHVhIENyYW5tZXIg8J+Qpw==?= Newsgroups: comp.lang.java.programmer Subject: Re: How to make my java applets more user friendly Date: Thu, 03 Jul 2014 08:54:18 -0500 Organization: A noiseless patient Spider Lines: 55 Message-ID: References: <04c1fe18-b023-4f45-8fa3-3c2f78cba69e@googlegroups.com> <53b4ae7d$0$298$14726298@news.sunsite.dk> <00019c29-614d-4cfc-aca8-4606bee766dd@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Thu, 3 Jul 2014 13:54:24 +0000 (UTC) Injection-Info: mx05.eternal-september.org; posting-host="8cedddb29338592f734c41b16a68fadc"; logging-data="15371"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19lGlSQ3EF37OSQu9v/9rAl2beFm0Nh2bY=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.0 In-Reply-To: <00019c29-614d-4cfc-aca8-4606bee766dd@googlegroups.com> Cancel-Lock: sha1:gVrYr9gluGU0LzQ8r6yIhvU+IdE= Xref: csiph.com comp.lang.java.programmer:28933 On 7/3/2014 8:01 AM, w.tom.adams@gmail.com wrote: > One question I have is this: Why is Javascript not as vulnerable as > Java Applets? There are two reasons why JavaScript could be perceived to be less vulnerable: 1. Most of the code is provided as part of the web browser, so security holes will naturally be fixed as the browser is updated, instead of waiting for another program to update. 2. The Java applet model (to me, at least) is basically taking a full platform library and ensconcing it in a sandbox by turning off every API that is suspicious. The JS model is largely creating the APIs from scratch with the browser sandbox in mind--in effect, Java tries to blacklist insecure things while JS tries to whitelist secure things. Whitelist are inherently more secure than blacklists. > The history seems to be that Java Applets were exploited big-time by > hackers and apparently neglected by Oracle and Cert had a tantrum and > now they are not a viable option. But if I converted to Javascript, > could the same thing happen to Javascript. Oracle really dropped the ball on applets. It seems that they decided that trying to provide (and maintain) a security sandbox was too hard, and instead wanted to merely require signing, which from a security standpoint, is like asking the code "are you secure?"--history has shown that users routinely ignore the contents of security dialogs, so giving a basically unrestricted sandbox to anyone who can prove authenticity (i.e., pay a few dollars to a CA) makes any claims of security really laughable. Could it happen to JavaScript as well? Possibly, but rather unlikely in my estimation. There is strong demand for client-side interactivity. Given the resistance to major players to using any other language than JS builtin to the browser, JS looks set to basically be the necessary client-side interactive language for at least a decade to come. > Of course it also seems that Java Applets declined relative to > Javascript for other reason, not exactly sure why that happened. Java applets were largely killed by Flash, I think, not JavaScript. By the late 2000's, the only Java applets I generally saw were the simple applets used to illustrate something (e.g., this is how an AVL tree balances)--most of the interactive multimedia used Flash. I think Java fell into disfavor in large measure because it is very slow to startup, and also the unsigned sandbox may have been a little too tight for some people. Flash fell into disfavor because it is unstable (I have more issues due to Flash than I do due to the browser--and I run bleeding-edge nightlies). Silverlight was born in the dying days of plugins and never had much favor to begin with. :-) -- Beware of bugs in the above code; I have only proved it correct, not tried it. -- Donald E. Knuth