Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28200 > unrolled thread

Java vs JavaScript

Started byRoedy Green <see_website@mindprod.com.invalid>
First post2014-04-23 08:39 -0700
Last post2014-05-22 05:08 -0700
Articles 8 on this page of 28 — 13 participants

Back to article view | Back to comp.lang.java.programmer

Contents

  Java vs JavaScript Roedy Green <see_website@mindprod.com.invalid> - 2014-04-23 08:39 -0700
    Re: Java vs JavaScript markspace <markspace@nospam.nospam> - 2014-04-23 09:10 -0700
    Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-04-23 15:48 -0500
    Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-04-23 23:36 +0200
      Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-27 12:20 +0100
        Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:05 +0800
        Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-04-27 22:55 +0200
        Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-01 08:52 +0100
          Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-01 10:26 +0200
            Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-01 14:10 -0700
              Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:10 +0200
                Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-02 10:20 -0700
                  Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-05-02 20:16 +0200
                    Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-04 10:38 +0100
                      Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-05 00:16 -0500
                        Re: Java vs JavaScript Tim Slattery <tim@risingdove.com> - 2014-05-06 13:06 -0400
                          Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-06 12:40 -0500
              Re: Java vs JavaScript Simon Lewis <simonlewis2001@gmail.com> - 2014-05-02 12:53 +0200
            Re: Java vs JavaScript Arne VajhĂžj <arne@vajhoej.dk> - 2014-05-01 21:16 -0400
              Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:17 +0200
    Re: Java vs JavaScript Arne VajhĂžj <arne@vajhoej.dk> - 2014-04-23 22:22 -0400
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:20 +0800
        Re: Java vs JavaScript Arne VajhĂžj <arne@vajhoej.dk> - 2014-04-29 21:07 -0400
    Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:15 +0800
      Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 09:00 +0100
        Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:15 +0800
          Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 16:59 +0100
    Re: Java vs JavaScript Ray Osborne <rko153@gmail.com> - 2014-05-22 05:08 -0700

Page 2 of 2 — ← Prev page 1 [2]

#28207

FromArne VajhĂžj <arne@vajhoej.dk>
Date2014-04-23 22:22 -0400
Message-ID<53587557$0$294$14726298@news.sunsite.dk>
In reply to#28200
On 4/23/2014 11:39 AM, Roedy Green wrote:
> I have always thought the Java sandbox was so restrictive, there was
> nothing a user need worry about. There is no way an unsigned applet
> could do any damage.

That is true assuming there are no bugs in the Java applet security
implementation.

I think they have found 200-300 bugs during the last 2-3 years.

> But Oracle and the browsers are acting like unsigned Applets are
> highly dangerous, making you do override after override to run them.

If a bug in Java allows an unsigned applet to gain privs, then it is
extremely dangerous as a malicious site could run a 1 pixel applet
that infected the PC without the user not even knowing that Java was
running.

Apparently Oracle does no longer believe that they can fix all
security bugs.

Given the recent history, then that seems realistic.

> On the other hand I don't think JavaScript has any sort of sandbox at
> all, and everyone blissfully runs scripts that can do anything.

Not true.

JavaScript is sandboxed and has about the same access as an unsigned
applet.

And because there are no concept of signed JavaScript with granted
privs then it is probably easier to avoid bugs as the code must be
a lot simpler.

> Why the double standard? Is JavaScript safer than I thought?

There has been found plenty of JavaScript bugs over the years.

But JavaScript has done better than Java in recent years.

Arne

[toc] | [prev] | [next] | [standalone]

#28210

FromRichard Maher <maher_rjSPAMLESS@hotmail.com>
Date2014-04-24 16:20 +0800
Message-ID<ljahhc$tkg$1@speranza.aioe.org>
In reply to#28207
On 4/24/2014 10:22 AM, Arne VajhĂžj wrote:
> On 4/23/2014 11:39 AM, Roedy Green wrote:
>> I have always thought the Java sandbox was so restrictive, there was
>> nothing a user need worry about. There is no way an unsigned applet
>> could do any damage.
>
> That is true assuming there are no bugs in the Java applet security
> implementation.
>
> I think they have found 200-300 bugs during the last 2-3 years.

So what? How does the imapact-meter rate with the likes of Heart-Bleed 
and OpenSSL?
>
>> But Oracle and the browsers are acting like unsigned Applets are
>> highly dangerous, making you do override after override to run them.
>
> If a bug in Java allows an unsigned applet to gain privs, then it is
> extremely dangerous as a malicious site could run a 1 pixel applet
> that infected the PC without the user not even knowing that Java was
> running.

You don't need a 1px applet; 0x0 is just fine. Once again, look at the 
following link to BSD Socket functionality and Contacts lookup and so on 
and then ask the Applet Slaggers to shut their fucking mouths!

https://wiki.mozilla.org/WebAPI
>
> Apparently Oracle does no longer believe that they can fix all
> security bugs.

Just the incompetent people they've hired.

>
> Given the recent history, then that seems realistic.

Given you're a knob I need not respond.
>
>> On the other hand I don't think JavaScript has any sort of sandbox at
>> all, and everyone blissfully runs scripts that can do anything.
>
> Not true.
>
> JavaScript is sandboxed and has about the same access as an unsigned
> applet.

Wake up to modern Web-Apps!

>
> And because there are no concept of signed JavaScript with granted
> privs then it is probably easier to avoid bugs as the code must be
> a lot simpler.
>
>> Why the double standard? Is JavaScript safer than I thought?
>
> There has been found plenty of JavaScript bugs over the years.
>
> But JavaScript has done better than Java in recent years.

There are none so blind as those who will not see.

>
> Arne
>

[toc] | [prev] | [next] | [standalone]

#28317

FromArne VajhĂžj <arne@vajhoej.dk>
Date2014-04-29 21:07 -0400
Message-ID<53604ce8$0$298$14726298@news.sunsite.dk>
In reply to#28210
On 4/24/2014 4:20 AM, Richard Maher wrote:
> On 4/24/2014 10:22 AM, Arne VajhĂžj wrote:
>> On 4/23/2014 11:39 AM, Roedy Green wrote:
>>> I have always thought the Java sandbox was so restrictive, there was
>>> nothing a user need worry about. There is no way an unsigned applet
>>> could do any damage.
>>
>> That is true assuming there are no bugs in the Java applet security
>> implementation.
>>
>> I think they have found 200-300 bugs during the last 2-3 years.
>
> So what? How does the imapact-meter rate with the likes of Heart-Bleed
> and OpenSSL?

For number of actual impacted users: much higher.

>>> But Oracle and the browsers are acting like unsigned Applets are
>>> highly dangerous, making you do override after override to run them.
>>
>> If a bug in Java allows an unsigned applet to gain privs, then it is
>> extremely dangerous as a malicious site could run a 1 pixel applet
>> that infected the PC without the user not even knowing that Java was
>> running.
>
> You don't need a 1px applet; 0x0 is just fine.

That just makes it worse.

>                                                Once again, look at the
> following link to BSD Socket functionality and Contacts lookup and so on
> and then ask the Applet Slaggers to shut their fucking mouths!
>
> https://wiki.mozilla.org/WebAPI

That does not remedy observed Java security problems.

>> Apparently Oracle does no longer believe that they can fix all
>> security bugs.
>
> Just the incompetent people they've hired.
>
>> Given the recent history, then that seems realistic.
>
> Given you're a knob I need not respond.
>>
>>> On the other hand I don't think JavaScript has any sort of sandbox at
>>> all, and everyone blissfully runs scripts that can do anything.
>>
>> Not true.
>>
>> JavaScript is sandboxed and has about the same access as an unsigned
>> applet.
>
> Wake up to modern Web-Apps!
>
>> And because there are no concept of signed JavaScript with granted
>> privs then it is probably easier to avoid bugs as the code must be
>> a lot simpler.
>>
>>> Why the double standard? Is JavaScript safer than I thought?
>>
>> There has been found plenty of JavaScript bugs over the years.
>>
>> But JavaScript has done better than Java in recent years.
>
> There are none so blind as those who will not see.

The stats are rather hard on Java:

October 2010 - 6u22 - 29 security fixes
February 2011 - 6u24 - 21 security fixes
June 2011 - 6u26 - 17 security fixes
October 2011 - 6u29/7u1 - 20 security fixes
Februar 2012 - 6u31/7u3 - 14 security fixes
June 2012 - 6u33-7u5 - 14 security fixes
August 2012 - 6u35/7u7 - 1/4 security fixes
October 2012 - 6u37/7u9 - 30 security fixes
February 2013 - 6u39/7u13 - 50 security fixes
February 2013 - 6u41/7u15 - 5 security fixes
March 2013 - 6u43 /7u17- 2 security fixes
April 2013 - 6u45/7u21 - 42 security fixes
June 2013 - 7u25 - 40 security fixes
October 2013 - 7u45 - 51 security fixes
January 2014 - 7u51 - 36 security fixes
April 2014 - 7u55/8u5 - 37 security fixes

Arne

[toc] | [prev] | [next] | [standalone]

#28209

FromRichard Maher <maher_rjSPAMLESS@hotmail.com>
Date2014-04-24 16:15 +0800
Message-ID<ljah66$sji$1@speranza.aioe.org>
In reply to#28200
On 4/23/2014 11:39 PM, Roedy Green wrote:
> There is something odd going on.
>
> I have always thought the Java sandbox was so restrictive, there was
> nothing a user need worry about. There is no way an unsigned applet
> could do any damage.
>
> But Oracle and the browsers are acting like unsigned Applets are
> highly dangerous, making you do override after override to run them.

I have commented in detail to your various other posts; the truth is out 
there!
>
> On the other hand I don't think JavaScript has any sort of sandbox at
> all, and everyone blissfully runs scripts that can do anything.

I suggest/recommend/insist the dinosaurs here at java-IS-the-new-cobol 
read the following several times over: -

https://wiki.mozilla.org/WebAPI

As usual the cognoscente here do not know what they are talking about 
:-( WebApps have moved on but they'll never replace the functionality 
Applets provide out-of-the-box!
>
> Why the double standard? Is JavaScript safer than I thought?
>

Google, Apple, and Microsoft say Larry is a fat lazy vain old bitch who 
is too tired to defend his patch.

[toc] | [prev] | [next] | [standalone]

#28249

Fromlipska the kat <lipskathekat@example.com>
Date2014-04-27 09:00 +0100
Message-ID<ptWdnf558rCQJMHOnZ2dnUVZ8gWdnZ2d@bt.com>
In reply to#28209
On 24/04/14 09:15, Richard Maher wrote:
> On 4/23/2014 11:39 PM, Roedy Green wrote:
>> There is something odd going on.
>>
>> I have always thought the Java sandbox was so restrictive, there was
>> nothing a user need worry about. There is no way an unsigned applet
>> could do any damage.

<snip>

>
> As usual the cognoscente here do not know what they are talking about
> :-( WebApps have moved on but they'll never replace the functionality
> Applets provide out-of-the-box!

Have you seen what some people can do with HTML5?


-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#28259

FromRichard Maher <maher_rjSPAMLESS@hotmail.com>
Date2014-04-27 20:15 +0800
Message-ID<ljiscl$g9g$1@speranza.aioe.org>
In reply to#28249
On 4/27/2014 4:00 PM, lipska the kat wrote:
>
> Have you seen what some people can do with HTML5?
>
>

I've certainly seen it and done it (see the link I've posted several 
times); many here haven't!

Show me true multi-threading with that Worker-Thread crap . . .

Show me true BSD sockets instead of that WebSocket shit that was tacken 
out of the HTML5 standard because it was so functionally and security 
deficient . . .

Show me global memory between multiple browser tabs and the intrinsic 
segue to single-sign-n out of the box . . .

Show me someone who can think outside of Larry's bollocks JavaFX and 
reel at the wonton functionality destruction at the hands of Eric 
Costlow. . .

Show me someone who has lived in awe of Adobe Flex Charting for almost 
10 years. . .

And I'll show you a sad and sorry newsgroup full of arse-wipes who see 
life through lambda coloured glasses :-(

[toc] | [prev] | [next] | [standalone]

#28260

Fromlipska the kat <lipskathekat@example.com>
Date2014-04-27 16:59 +0100
Message-ID<DeKdnekdOqPwtMDOnZ2dnUVZ8mydnZ2d@bt.com>
In reply to#28259
On 27/04/14 13:15, Richard Maher wrote:
> On 4/27/2014 4:00 PM, lipska the kat wrote:
>>
>> Have you seen what some people can do with HTML5?
>>
>>
>
> I've certainly seen it and done it (see the link I've posted several
> times); many here haven't!
>
> Show me true multi-threading with that Worker-Thread crap . . .
>
> Show me true BSD sockets instead of that WebSocket shit that was tacken
> out of the HTML5 standard because it was so functionally and security
> deficient . . .

Taken out of HTML5 standard ??? are you sure?

http://dev.w3.org/html5/websockets/

That's a new Editor's Draft of the websocket API published on 23 April 
2014 ... hardly 'old hat' is it?

<snip>

> And I'll show you a sad and sorry newsgroup full of arse-wipes who see
> life through lambda coloured glasses :-(

You are one angry human being aren't you?


-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#28544

FromRay Osborne <rko153@gmail.com>
Date2014-05-22 05:08 -0700
Message-ID<b31c8021-2e90-4010-a334-dd28b8f4fb20@googlegroups.com>
In reply to#28200
Interesting and meaningful thread of posts. I will cross-post this to my group
at https://groups.google.com/forum/#!forum/a1a-javajobs

On Wednesday, April 23, 2014 11:39:52 AM UTC-4, Roedy Green wrote:
> There is something odd going on. 
> 
> 
> 
> I have always thought the Java sandbox was so restrictive, there was
> 
> nothing a user need worry about. There is no way an unsigned applet
> 
> could do any damage.
> 
> 
> 
> But Oracle and the browsers are acting like unsigned Applets are
> 
> highly dangerous, making you do override after override to run them.
> 
> 
> 
> On the other hand I don't think JavaScript has any sort of sandbox at
> 
> all, and everyone blissfully runs scripts that can do anything.
> 
> 
> 
> Why the double standard? Is JavaScript safer than I thought?
> 
> -- 
> 
> Roedy Green Canadian Mind Products http://mindprod.com
> 
> "Don't worry about people stealing an idea; if it's original, you'll
> 
>  have to shove it down their throats." 
> 
> ~ Howard Aiken (born: 1900-03-08 died: 1973-03-14 at age: 73)

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.java.programmer

csiph-web