Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #33684

Re: A very dark day indeed :-(

From Arne Vajhøj <arne@vajhoej.dk>
Newsgroups comp.lang.java.programmer
Subject Re: A very dark day indeed :-(
Date 2016-02-08 14:06 -0500
Organization Aioe.org NNTP Server
Message-ID <n9ap04$jvp$1@gioia.aioe.org> (permalink)
References <n99ukc$11o8$1@gioia.aioe.org> <n9a6fg$u1s$1@news2.informatik.uni-stuttgart.de> <JavaScript-20160208150210@ram.dialup.fu-berlin.de> <n9anmd$2qs$1@news2.informatik.uni-stuttgart.de>

Show all headers | View raw

On 2/8/2016 1:44 PM, Thomas Richter wrote:
> Am 08.02.2016 um 15:04 schrieb Stefan Ram:
>> Thomas Richter <thor@math.tu-berlin.de> writes:
>>> What I do not understand is how Java applets can be insecure and at the
>>> same time, Java webstart is supposed to be secure. In the end, it's all
>>> the same java virtual machine behind it, with the same security problems
>>> and the same issues to begin with.
>>
>>    It is true that Java indeed had security defects. But the press
>> decided
>>    to make it the scapegoat while no one is allowed to mention the
>> elephant
>>    in the room: JavaScript.
>
> Java executes downloaded code, Javascript executes downloaded code. Yes,
> Javascript is complex,and every program complex enough contains bugs,
> Javascript is no difference. The big difference between javascript and
> java is that the former is part of the browser engine and is hence
> updated by the vendor of the browser. The latter required a round-trip
> through Oracle, another level of indirection. Apparently, this worked
> not so well.

On the other hand each browser has its own JavaScript engine (there are
also multiple Java implementations, but for applet usage the SUN/Oracle
is the only relevant one).

I am not so sure that this is what makes the difference.

I think some of the biggest problems of Java applets were:
* the need to support privileged mode which really complicates the
   sandbox design
* the choice to have a generic approach security to cover everything
   from applets to multi-customer servlet engines, which also
   complicates thing
* lack of focus/funding/resources on applet security in the last years
   of SUN ownership

> Javascript has access to the DOM tree, Java does not.... so there are
> many differences.

Java applets do have indirect access via the Java-JavaScript interface.

Arne

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

A very dark day indeed :-( Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2016-02-08 19:36 +0800
  Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 08:45 -0500
  Re: A very dark day indeed :-( Thomas Richter <thor@math.tu-berlin.de> - 2016-02-08 14:50 +0100
    Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 12:37 -0500
    Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 12:55 -0500
      Re: A very dark day indeed :-( Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2016-02-09 05:39 +0800
        Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 17:22 -0500
          Re: A very dark day indeed :-( maherrj@googlemail.com - 2016-02-08 17:08 -0800
            Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 20:30 -0500
              Re: A very dark day indeed :-( maherrj@googlemail.com - 2016-02-08 18:31 -0800
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 22:02 -0500
                Re: A very dark day indeed :-( maherrj@googlemail.com - 2016-02-08 20:04 -0800
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:18 -0500
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:55 -0500
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-10 06:32 -0800
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-09 05:27 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-09 15:24 +0100
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-09 06:38 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-09 16:00 +0100
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-09 07:20 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-09 16:39 +0100
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-09 07:50 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-09 17:16 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:40 -0500
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-10 06:28 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-10 17:21 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-10 22:03 -0500
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-11 09:33 +0100
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-11 05:32 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-11 15:42 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-10 21:58 -0500
                Re: A very dark day indeed :-( Nigel Wade <nmw@ion.le.ac.uk> - 2016-02-09 15:59 +0000
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-09 17:24 +0100
                Re: A very dark day indeed :-( Nigel Wade <nmw@ion.le.ac.uk> - 2016-02-09 16:30 +0000
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-10 01:47 +0100
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-09 08:55 -0800
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-10 01:59 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:48 -0500
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-10 17:35 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-10 22:05 -0500
                Re: A very dark day indeed :-( Silvio <silvio@internet.com> - 2016-02-11 09:39 +0100
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:30 -0500
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:28 -0500
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-09 20:27 -0500
                Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-10 05:27 -0800
                Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-10 22:23 -0500
      Re: A very dark day indeed :-( Eric Douglas <e.d.programmer@gmail.com> - 2016-02-08 13:58 -0800
        Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 17:20 -0500
    Re: A very dark day indeed :-( Thomas Richter <thor@math.tu-berlin.de> - 2016-02-08 19:44 +0100
      Re: A very dark day indeed :-( Arne Vajhøj <arne@vajhoej.dk> - 2016-02-08 14:06 -0500
    Re: A very dark day indeed :-( Brixomatic <brixomatic@yahoo.com> - 2016-02-10 22:39 +0100

csiph-web