Path: csiph.com!aioe.org!.POSTED!not-for-mail From: =?UTF-8?Q?Arne_Vajh=c3=b8j?= Newsgroups: comp.lang.java.programmer Subject: Re: A very dark day indeed :-( Date: Mon, 8 Feb 2016 17:20:22 -0500 Organization: Aioe.org NNTP Server Lines: 38 Message-ID: References: NNTP-Posting-Host: ANasIS7Js9OyLQwgloeBLQ.user.gioia.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.java.programmer:33692 On 2/8/2016 4:58 PM, Eric Douglas wrote: > On Monday, February 8, 2016 at 12:55:36 PM UTC-5, Arne Vajhøj wrote: >> On 2/8/2016 8:50 AM, Thomas Richter wrote: >>> What I do not understand is how Java applets can be insecure and at the >>> same time, Java webstart is supposed to be secure. In the end, it's all >>> the same java virtual machine behind it, with the same security problems >>> and the same issues to begin with. >>> >>> So why that helps is really not clear to me. >> >> Good question. >> >> Maybe because it prompts differently!? > > I've never written an applet, but I think they were a security risk because they can execute code from a browser. Yes. > Webstart does not execute. You have to download a .jnlp file then manually execute that, which downloads jar files, > checks their signature and asks if you want to allow that author to run code.. Java Web Start also integrates with browser. For regular Java Web Start you click on a link, answer yes to run and the Java app starts up. If you want to try then: https://www.yworks.com/products/yfiles/demos#java And it is also possible to run Java applets via Java Web Start embedded in web page, but I suspect that is being treated like applets. Arne