Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Eric Sosman <esosman@comcast-dot-net.invalid>
Newsgroups: comp.lang.java.programmer
Subject: Re: How to make my java applets more user friendly
Date: Thu, 03 Jul 2014 10:27:23 -0400
Organization: A noiseless patient Spider
Lines: 25
Message-ID: <lp3p8f$s8v$1@dont-email.me>
References: <04c1fe18-b023-4f45-8fa3-3c2f78cba69e@googlegroups.com> <lp1hd2$gb6$1@dont-email.me> <53b4ae7d$0$298$14726298@news.sunsite.dk> <lp2h1b$pi3$1@dont-email.me> <00019c29-614d-4cfc-aca8-4606bee766dd@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Thu, 3 Jul 2014 14:27:27 +0000 (UTC)
Injection-Info: mx05.eternal-september.org; posting-host="bd4e1cba8d8592bec5d5ed9e4537fbfd"; logging-data="28959"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19Mmd3U3oFnjtIZdSJOgKym"
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
In-Reply-To: <00019c29-614d-4cfc-aca8-4606bee766dd@googlegroups.com>
Cancel-Lock: sha1:wM4xGw/M4HGKZAStmTsps35zqfk=
Xref: csiph.com comp.lang.java.programmer:28934

On 7/3/2014 9:01 AM, w.tom.adams@gmail.com wrote:
> [...]
> One question I have is this:  Why is Javascript not as vulnerable as Java Applets?

     Experts (I'm not one) have opined that the security models for
JavaScript and Java are fundamentally different.  JavaScript (they
say) was designed from its infancy to run in a browser's sandbox,
but Java is a fully-functional general-purpose language with a
sandbox bolted on afterwards.  Another way to look at this is that
JavaScript can do only what the browser itself can do, while Java
can do anything the JVM fails to prevent.

     This is not to say that JavaScript is 100% secure -- plenty of
malware relies at least in part on JavaScript -- just that it's a
more limited risk than Java is.  Or so say those who seem to know.

> The history seems to be that Java Applets were exploited big-time by hackers and apparently neglected by Oracle and Cert had a tantrum and now they are not a viable option.  But if I converted to Javascript, could the same thing happen to Javascript.

     In my opinion (and that's all it is), applets are not viable.
Not everybody subscribes to this view -- but those who do will not
be in your website's audience.

-- 
Eric Sosman
esosman@comcast-dot-net.invalid