Path: csiph.com!aioe.org!.POSTED!not-for-mail From: =?UTF-8?Q?Arne_Vajh=c3=b8j?= Newsgroups: comp.lang.java.programmer Subject: Re: A very dark day indeed :-( Date: Mon, 8 Feb 2016 14:06:46 -0500 Organization: Aioe.org NNTP Server Lines: 45 Message-ID: References: NNTP-Posting-Host: ANasIS7Js9OyLQwgloeBLQ.user.gioia.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.java.programmer:33684 On 2/8/2016 1:44 PM, Thomas Richter wrote: > Am 08.02.2016 um 15:04 schrieb Stefan Ram: >> Thomas Richter writes: >>> What I do not understand is how Java applets can be insecure and at the >>> same time, Java webstart is supposed to be secure. In the end, it's all >>> the same java virtual machine behind it, with the same security problems >>> and the same issues to begin with. >> >> It is true that Java indeed had security defects. But the press >> decided >> to make it the scapegoat while no one is allowed to mention the >> elephant >> in the room: JavaScript. > > Java executes downloaded code, Javascript executes downloaded code. Yes, > Javascript is complex,and every program complex enough contains bugs, > Javascript is no difference. The big difference between javascript and > java is that the former is part of the browser engine and is hence > updated by the vendor of the browser. The latter required a round-trip > through Oracle, another level of indirection. Apparently, this worked > not so well. On the other hand each browser has its own JavaScript engine (there are also multiple Java implementations, but for applet usage the SUN/Oracle is the only relevant one). I am not so sure that this is what makes the difference. I think some of the biggest problems of Java applets were: * the need to support privileged mode which really complicates the sandbox design * the choice to have a generic approach security to cover everything from applets to multi-customer servlet engines, which also complicates thing * lack of focus/funding/resources on applet security in the last years of SUN ownership > Javascript has access to the DOM tree, Java does not.... so there are > many differences. Java applets do have indirect access via the Java-JavaScript interface. Arne